North Carolina Headlines

AUSTIN, Texas, October 24, 2026 – Invicti, an application security company specializing in dynamic application security testing (DAST) and AI-powered penetration testing, has published new benchmark results positioning Invicti Agentic Pentest as a leading agentic pentesting solution for vulnerability detection, reporting speed, and cost efficiency.

The research, conducted by the Invicti Security Research Team, evaluated Invicti Agentic Pentest against the same versions of two open-source applications previously examined in a Doyensec study comparing competing security platforms Aikido and XBOW.

Across four assessments combining black-box and source-assisted testing, Invicti reported 52 unique, verified vulnerabilities, compared with 49 findings independently validated by Doyensec for Aikido and 31 for XBOW.

The results also highlighted Invicti’s speed. Selected source-assisted assessments produced reports in 46 minutes for Fider and 50 minutes for Photoview, compared with approximately eight hours per target for Aikido and multi-day elapsed timelines for XBOW.

Although differences in testing environments and validation methodologies make the comparisons directional rather than a controlled head-to-head evaluation, the findings demonstrate Invicti’s competitive performance across several important application security metrics.

Invicti Outperforms Competing Tools in Reported Vulnerability Coverage

The benchmark examined Fider version 0.33.0 and Photoview version 2.4.0, matching the application versions used in Doyensec’s earlier Aikido and XBOW research.

Across the two applications, the published results showed:

• Invicti Agentic Pentest: 52 unique, verified findings across four black-box and source-assisted assessments.

• Aikido: 49 Doyensec-validated findings.

• XBOW: 31 Doyensec-validated findings.

Invicti’s combined total exceeded Aikido’s published total by three findings and XBOW’s by 21.

In the narrower Fider source-assisted assessment, Invicti identified 24 true positives, matching XBOW’s reported 24 and exceeding Aikido’s 17.

The research also examined vulnerability severity and evidence quality rather than relying solely on total findings.

During a controlled, two-user Photoview assessment, Invicti confirmed 18 vulnerabilities, including one Critical SQL injection and three High-severity authorization or session findings.

These findings demonstrate the importance of testing real application behavior, authenticated workflows, and user permission boundaries when evaluating the effectiveness of automated penetration testing.

Benchmark Highlights Faster Pentesting and Report Delivery

Beyond vulnerability detection, the benchmark identified time to report as a significant competitive advantage for Invicti Agentic Pentest.

Invicti completed its selected Fider source-assisted assessment in 46 minutes and its controlled Photoview source-assisted assessment in 50 minutes, with reports available immediately upon completion.

By comparison, Doyensec recorded approximately eight hours and 40 minutes for Aikido’s Fider assessment and less than eight hours for Photoview.

XBOW’s documented testing and reporting timelines extended across multiple calendar days, including interruptions and additional coordination for the Fider assessment.

The findings suggest that Invicti’s hybrid architecture could help security teams shorten the time between identifying an application vulnerability and receiving evidence needed to investigate or remediate it.

For organizations managing frequent deployments and continuous application security programs, faster access to actionable findings can support more timely security decisions.

Hybrid DAST and Agentic AI Testing Expands Vulnerability Detection

A distinguishing feature of Invicti’s Agentic Pentesting Tool is its combination of established dynamic application security testing with autonomous AI-driven security investigation.

Rather than relying exclusively on autonomous agents, Invicti uses its DAST capabilities for repeatable vulnerability discovery while applying agentic reasoning to application-specific attack surfaces and complex workflows.

The benchmark demonstrated the contribution of both technologies.

Of the 52 unique findings reported across the four assessments:

• 27 vulnerabilities (52%) originated from DAST testing.

• 25 vulnerabilities (48%) originated from agentic testing.

Within the reviewed dataset, the combined approach increased finding coverage by approximately 93% compared with the DAST-attributed findings alone.

This result highlights how agentic testing can complement traditional vulnerability scanning by identifying additional application-specific security weaknesses while retaining the efficiency and reproducibility of established DAST techniques.

Verified Evidence Helps Reduce Security Review Effort

The benchmark also examined the quality of vulnerability evidence delivered to security teams.

Across the selected Invicti source-assisted runs, all 42 true-positive findings included HTTP request-and-response evidence. Of these, 38 included standalone evidence, 31 included explicit reproduction steps, and 30 included links to source files.

This documentation gives security analysts and development teams additional information for investigating reported vulnerabilities, understanding underlying causes, and validating remediation.

Evidence quality is particularly important as organizations evaluate AI-powered penetration testing systems, where finding volume alone does not necessarily demonstrate actionable security value.

Benchmark Demonstrates Cost-Efficient Application Security Testing

The research also reported favorable assessment costs for Invicti Agentic Pentest.

Across four assessments covering both applications, Invicti reported a combined cost of approximately $346 under introductory pricing available through December 31, 2026.

For comparison, the Doyensec study selected $4,000 pentesting tiers for both Aikido and XBOW. Applying those published tiers separately to the two applications implies a directional list-price comparison of $8,000 per competing vendor, although actual charges and pricing structures were not established as equivalent.

The cost findings suggest that hybrid DAST and agentic testing could make frequent, evidence-based security assessments more accessible within development and security workflows.

Research Methodology and Independent Validation

The Invicti Security Research Team conducted its assessments on September 27–28, 2026, using the same Fider and Photoview application versions examined in Doyensec’s earlier comparison.

Invicti performed one authenticated black-box assessment and one source-assisted assessment for each application. Results underwent endpoint normalization and duplicate review.

Importantly, the evidence sources differed. Invicti’s findings were measured locally and auto-validated without an external reviewer, while the Aikido and XBOW findings were independently validated by Doyensec in an Aikido-sponsored study.

The benchmark should therefore be interpreted as a directional comparison, not an independently conducted, uniform head-to-head ranking of all three products.

Nevertheless, the findings position Invicti Agentic Pentest as a strong competitor in AI-powered penetration testing, particularly in reporting speed, evidence completeness, and the combined detection capabilities of DAST and agentic AI.

The full research findings and methodology are available in the Invicti Agentic Pentest benchmark.

About Invicti

Invicti is an offensive runtime application security platform designed to help organizations identify, prioritize, and remediate application risk at scale. Built on deep expertise in dynamic application security testing (DAST) and runtime intelligence, Invicti connects security across code, applications, APIs, and the software supply chain. Its application security solutions combine agentic and automated vulnerability discovery, with proof-based validation, and AI-powered testing capabilities to help organizations reduce security noise, accelerate remediation, and make application security measurable. For more information, visit Invicti.

About QuantRadius

QuantRadius is a technology and data-driven consulting firm focused on helping businesses improve performance, increase profitability, and reduce operational costs. With expertise dating back to 2008, its founding members have leveraged innovative technologies, data-driven insights, and strategic solutions to help organizations improve KPIs, mitigate risk, and gain a competitive advantage. QuantRadius is committed to making cutting-edge technology accessible while delivering measurable business results.

Media Contact
Company Name: QuantRadius
Contact Person: Jesse Winston
Email: Send Email
Phone: 1-708-470-7172
Address:123 W Madison St Ste 806
City: Chicago
State: Illinois
Country: United States
Website: https://quantradius.com/