Invicti Agentic Pentest Reports 52 Verified Flaws, Topping Aikido and XBOW

Invicti Security published benchmark results on October 24, 2026, showing its Agentic Pentest tool found 52 unique, verified vulnerabilities across two open-source applications, surpassing Aikido's 49 and XBOW's 31. The FinancialContent Business Page reported the findings. Invicti is an Austin-based application security company founded in 2017 that sells a proof-based platform combining dynamic application security testing with AI-driven prioritization to more than 3,600 enterprise and government customers.

How the Invicti Benchmark Was Run

The Invicti Security Research Team conducted its assessments on September 27–28, 2026, using Fider version 0.33.0 and Photoview version 2.4.0, the same application versions examined in an earlier Doyensec study of Aikido and XBOW. Invicti performed one authenticated black-box assessment and one source-assisted assessment for each application, then normalized endpoints and reviewed duplicates.

Across four assessments, Invicti reported 52 unique, verified vulnerabilities. Aikido's 49 findings and XBOW's 31 were independently validated by Doyensec in an Aikido-sponsored study, while Invicti's findings were measured locally and auto-validated without an external reviewer. The published results describe the comparison as directional rather than a controlled head-to-head evaluation.

In the narrower Fider source-assisted assessment, Invicti identified 24 true positives, matching XBOW's reported 24 and exceeding Aikido's 17. During a controlled two-user Photoview assessment, Invicti confirmed 18 vulnerabilities, including one Critical SQL injection and three High-severity authorization or session findings.

Speed, Evidence and Cost Figures

Invicti completed its selected Fider source-assisted assessment in 46 minutes and its controlled Photoview source-assisted assessment in 50 minutes, with reports available immediately upon completion. Doyensec recorded approximately eight hours and 40 minutes for Aikido's Fider assessment and less than eight hours for Photoview, while XBOW's documented timelines extended across multiple calendar days.

Of the 52 unique findings, 27 originated from DAST testing and 25 from agentic testing. Across the selected Invicti source-assisted runs, all 42 true-positive findings included HTTP request-and-response evidence, 38 included standalone evidence, 31 included explicit reproduction steps and 30 included links to source files. Invicti reported a combined cost of approximately $346 across four assessments under introductory pricing available through December 31, 2026, against a directional list-price comparison of $8,000 per competing vendor based on the $4,000 pentesting tiers selected in the Doyensec study.

Invicti's Path to the Agentic Pentest Launch

Invicti launched the Invicti Agentic Pentest in July 2026, a solution combining autonomous AI with its existing proof-based DAST technology, according to Third News. In September 2026, PR Newswire reported that Invicti Security was named a Leader in the IDC MarketScape for dynamic application security testing in 2026, an assessment recognizing its proof-based scanning, AI-assisted testing and API discovery.

In August 2026, PR Newswire reported that Invicti Security was offering qualifying U.S. water utilities three months of complimentary access to its application security platform to help them identify and address vulnerabilities in web applications and APIs, following FBI and EPA warnings.

What the Benchmark Records Show

According to akta.pro company records, Invicti launched Invicti AppSec Core in June 2026, an all-in-one platform consolidating proof-based DAST, SAST, SCA, container security, secrets detection and automated SBOM generation on the Kondukto-derived ASPM backbone. The same records list a confirmation accuracy of 99.98% for exploitable vulnerabilities and more than 110 integrations with tools including Zapier, FortiWeb, Cloudflare, Slack, AWS, GitHub Actions, Azure Pipelines, Jenkins, JIRA and ServiceNow.

The company's full research findings and methodology are available in the Invicti Agentic Pentest benchmark.