Invicti vs Veracode DAST

Invicti is an application security platform for finding, prioritizing, and fixing application risk. Its testing engines cover DAST, SAST, software composition analysis, infrastructure as code, secrets, and container security. The platform discovers and tests REST, SOAP, and GraphQL APIs, including authorization flaws such as BOLA and BFLA. Invicti says Proof-Based Scanning confirms vulnerabilities with 99.98% accuracy. Findings are prioritized using runtime reachability, exploitability, business impact, and threat intelligence. DAST results can be correlated with SAST, developer ownership, reproduction context, and remediation guidance. Integrations include more than 110 tools, such as GitHub Actions, Jira, Jenkins, Azure Pipelines, ServiceNow, and Slack. Deployment varies by package; AppSec Flex includes cloud, on-premises, Bring Any Cloud, and air-gapped options. Compliance reports cover HIPAA, PCI DSS, OWASP Top 10, and other standards. Agentic Pentest costs $500, paid once for one application and its API suite, delivered within 24 hours with audit-ready PDF reports.

Veracode DAST scans live web applications and REST APIs for security vulnerabilities. It can test authenticated or unauthenticated assets, including applications behind firewalls, and inspect API endpoints and workflows to validate business logic. Scans can run automatically or on a schedule, with configurable depth, speed, and accuracy; the cloud-native engine is designed for hundreds of assets across environments. Veracode reports a false positive rate below 5%. CI/CD connections are available through webhooks or the Veracode CLI, and reports can be downloaded as PDF, JUnit, or CSV files. A Quick scan takes approximately three to five minutes and runs non-invasive checks for basic misconfigurations. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. A free 14-day trial is available through the Veracode Platform, while pricing is on request. The service is offered as SaaS with hybrid deployment options. Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform.