Invicti named a Leader in 2026 IDC MarketScape for dynamic application security testing

Invicti was recognized for strengths in exploitability validation through proof-based scanning, AI-assisted business logic and abuse case testing without predefined scripts, and end-to-end API discovery and testing.

AUSTIN, Texas, Sept. 29, 2026 /PRNewswire/ -- Invicti Security, a leader in application security, today announced that it has been positioned in the Leaders Category in the IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Doc #US54119126, September 2026).

The IDC MarketScape evaluated 16 dynamic application security testing (DAST) vendors based on current capabilities and future strategy, drawing on detailed vendor surveys and briefings, publicly available information, and customer feedback. The assessment recognized Invicti for strengths in exploitability validation through proof-based scanning, AI-assisted business logic and abuse case testing without predefined scripts, and end-to-end API discovery and testing.

The recognition comes as AI-assisted software development increases both the speed of delivery and the importance of testing applications in their running state for organizations. According to the report, "IDC research finds that 90% are piloting or have adopted AI coding tools and nearly three-quarters agree that these tools raise the risk that developers merge code they do not fully understand, even when scans pass (source: IDC's DevSecOps and Software Supply Chain Security Survey, July 2026). Further, this same survey found that 48% of organizations using AI coding tools reported either a moderate or a significant increase in security issues reaching production. As security issues increasingly reach production, DAST provides an essential backstop by testing applications as they run and exposing weaknesses and behaviors that may escape manual review and earlier-stage scanning."

"DAST has always been about understanding what software actually does when it runs, and that runtime perspective is becoming even more important as AI changes how quickly software is created and shipped," said Neil Roseman, CEO of Invicti Security. "We believe being named a Leader in the IDC MarketScape validates both the strength of the DAST technology our customers rely on today and the direction we're taking it: bringing proven runtime intelligence together with application security testing during development and agentic pentesting so teams can find, validate, and prioritize the risks that matter."

The IDC MarketScape highlights three Invicti strengths. Together, we believe they show how Invicti combines validated vulnerability detection, AI-assisted testing, and API security to extend DAST across modern applications and development workflows:

• Exploitability validation through proof-based scanning: Rather than reporting a candidate vulnerability, Invicti's engine executes a nondestructive follow-on payload to retrieve verifiable evidence, such as a database version or system output, and tags confirmed findings distinctly from unconfirmed ones. This feature provides teams with a basis for prioritizing remediation without routing every finding to a security team for manual confirmation.
• AI-assisted business logic and abuse case testing without predefined scripts: AI-driven login agent handles authentication, and an AI-assisted form filler supplies contextually valid data, and stateful API scanning infers parameter relationships to catch workflow manipulation and business rule bypass, extending coverage beyond signature-based detection without scripted test cases.
• End-to-end API discovery and testing: Invicti combines multilayer API discovery across scanning, source code, traffic, and eBPF analysis to build an API inventory. AI-enriched schemas add source code context to improve testing depth, while native CI/CD integration automates API security testing throughout the SDLC.

According to the report, "Customers describe Invicti's output as trustworthy and largely free of false positives, requiring limited additional triage before a finding reaches a developer. They also cite the platform's configuration flexibility, such as the ability to scope scans to a specific technology stack, as a strength. They also value the vendor relationship itself, citing direct access to engineering staff, rather than sales contacts, and a responsive technical account team."

"Application security teams continue to spend considerable time manually validating scanner findings before routing them to developers. Invicti addresses this problem through proof-based scanning, which is designed to confirm exploitability by executing a nondestructive follow-on payload and retrieving verifiable evidence," said Katie Norton, Research Director at IDC. 'The company's longer-term strategy builds on DAST as a foundation for continuous, validated runtime testing, and it reflects the market's movement toward adaptive and agentic security models."

DAST as the runtime foundation for modern AppSec

We believe the IDC MarketScape reflects a broader change in the role of dynamic testing.

This direction reinforces Invicti's strategy of building on its deep DAST foundation to expand into an all-in-one AppSec platform. Runtime intelligence from dynamic testing provides a verification layer that helps teams understand which vulnerabilities can be demonstrated in running applications, while integrated application security capabilities provide the context and workflows needed to manage risk across the software development lifecycle. Invicti's Agentic Pentest extends this foundation with autonomous, adaptive offensive testing for deeper security assessments.

The IDC MarketScape recognition follows additional independent recognition of Invicti's DAST capabilities in 2026. Latio named Invicti an Application Security Testing Leader and DAST Innovator in its 2026 Application Security Market Report, while independent benchmark testing by Miercom found Invicti DAST was the only tested solution to detect all 31 critical vulnerabilities across 11 modern application targets, earning the Miercom Certified Secure designation.

To learn more about IDC MarketScape's evaluation and Invicti's position in the Leaders Category, read the IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Excerpt for Invicti).

About IDC MarketScape

IDC MarketScape vendor assessment model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market. The research utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each supplier's position within a given market. IDC MarketScape provides a clear framework in which the product and service offerings, capabilities and strategies, and current and future market success factors of technology suppliers can be meaningfully compared. The framework also provides technology buyers with a 360-degree assessment of the strengths and weaknesses of current and prospective suppliers.

About Invicti Security

Delivering the industry's most accurate application security platform, Invicti Security has been transforming the way web applications are secured for nearly 20 years. Recognized as a leader in Application Security Testing and a DAST Innovator by Latio, Invicti enables organizations to continuously scan and secure their web apps and APIs with the rigor of runtime testing and the speed of constant innovation. Based in Austin, Texas, Invicti serves more than 5,000 organizations worldwide. To learn more, visit Invicti.com or follow us on LinkedIn.

Media contact

Invicti Security
Priyank Savla
[email protected]

SOURCE Invicti Security