IE to Invicti Platform upgrade reference
This document provides a detailed breakdown of how individual settings and configurations are handled when upgrading from Invicti Enterprise to Invicti Platform.
For a high-level summary of what's carried over and what isn't, refer to the Moving from Invicti Enterprise to Invicti Platform document. For integration-specific upgrade details, refer to the IE integrations upgrade guide document.
Why this matters
The high-level overview tells you which broad areas carry over, but the details matter when you're verifying your configuration after the upgrade or troubleshooting something that doesn't look right. This document covers the mapping logic, edge cases, and silent behavior changes - the things you'd otherwise only discover by checking each setting manually.
Discovery service
The Discovery service is a shared service between Invicti Enterprise and Invicti Platform. During the upgrade, your Discovery data is cloned into Invicti Platform as a one-time operation. After the upgrade completes, the two copies aren't synchronized - changes in one environment don't affect the other.
What's carried over
| Area | Details |
|---|---|
| Discovered websites | All discovered web applications and websites, including their tags and ignored status |
| Match settings | Email matching, website matching, reverse IP lookup, organization name matching |
| Inclusion criteria | Main domains, second-level domains, organizations, IP addresses and ranges |
| Exclusion criteria | Excluded domains, second-level domains, top-level domains, organization names, IP addresses |
| Connections | All Discovery Service connection settings |
What isn't carried over
The risk score configuration isn't carried over. After the upgrade, review, and reconfigure your risk score settings in Invicti Platform's Discovery section.
Targets
This section explains how Invicti Enterprise targets are converted into Invicti Platform targets and what settings each target receives.
How targets are created
In Invicti Enterprise, targets are URL entries that can be scanned with different configurations each time. In Invicti Platform, each target contains its own embedded scan configuration. Because of this difference, the upgrade creates separate Invicti Platform targets from different source configurations in Invicti Enterprise. Each target includes a description identifying its source, so you can trace it back to the original configuration.
| Source | Description added to target |
|---|---|
| Scan profile | Created From Scan Profile [profile name] |
| Scheduled scan | Created for Scheduled Scan [scan name] |
| Scheduled group scan | Created for Scheduled Group Scan [group scan name] |
| No scan profile or scheduled scan | Created a Default Target with no configuration |
Use these descriptions in Invicti Platform to identify where each target came from. After reviewing your targets, delete any you no longer need.
A target created from a scheduled scan is only added if that scheduled scan didn't already use a saved scan profile - in that case, the profile creates the target in the first step.
For more on why multiple targets with the same URL appear after the upgrade, refer to the Multiple targets showing the same URL after upgrade document.
Target defaults
The following defaults are applied to all targets carried over from Invicti Enterprise:
- Asset type: Webapp
- Business impact: Critical (set to Low if the Invicti Enterprise target was marked as a demo or test site)
- Tags: Same tags as the original Invicti Enterprise target
Target groups
Target groups are carried over to Invicti Platform as Collections.
API Security
This section covers how the API Security product feature and its data are handled during the upgrade.
What's carried over
| Item | Notes |
|---|---|
| API Security configuration | Carried over to the corresponding target in Invicti Platform |
| API Hub / inventory | All discovered API endpoints and inventory data |
| Imported API definitions | API definitions attached to targets in Invicti Enterprise |
| API associations | Associations between API definitions and targets |
What isn't carried over
Historical API scan outputs aren't carried over. This includes scan history, vulnerability findings from API scans, and reports generated from API security scans. This data populates fresh as you run new scans in Invicti Platform.
Scan settings
This section covers how scan settings from Invicti Enterprise map to target configurations in Invicti Platform.
Scope
Invicti Enterprise has three scope options. These map to two boolean settings in Invicti Platform:
| Invicti Enterprise scope | Restrict scans to imported files and API specs | Limit crawling to address and sub-directories only |
|---|---|---|
| Only entered URL | Enabled | Enabled |
| Entered path and below | Disabled | Enabled |
| Whole domain | Disabled | Disabled |
After the upgrade, review your target scope settings to confirm the mapping matches your intended scan behavior.
Invicti Enterprise supports an "Include URLs" filter that limits crawling to a specified set of URLs. This option has no equivalent in Invicti Platform and isn't carried over. After the upgrade, use the scope mode and exclusion rules to control which URLs Invicti Platform scans.
Imported links and files
Links:
| Link type | Upgrade behavior |
|---|---|
| Entered links | Links entered directly in scan settings carry over as a Generic Links.txt file attached to the corresponding target |
| API links | API URLs attached to scan settings carry over and appear in the target's imported links section. All URLs transfer exactly |
File types carried over:
| File type | Extension |
|---|---|
| Fiddler session archives | .saz |
| Burp Suite exports | .xml |
| Generic files | .json |
| ASP.NET files | .xml |
| HTTP Archive files | .har |
| Postman / OpenAPI collections | .json |
File types not carried over:
| Category | File types |
|---|---|
| API and service definitions |
|
| Security scanner exports |
|
| Import utilities |
|
| Other |
|
Scan time window
Invicti Enterprise lets you configure scan time windows at 15-minute intervals. Invicti Platform works with full 1-hour blocks.
During the upgrade, if a scan was blocked for any portion of an hour - even a single 15-minute slot - the upgrade marks that entire hour as excluded in Invicti Platform. This means scans may be blocked slightly earlier or later than in your previous configuration.
After the upgrade, review your Excluded hours settings and adjust as needed. Excluded hours profiles are named after the scan profile they came from when the setting was customized.
Secrets
The upgrade transfers secrets configured in Invicti Enterprise to Invicti Platform's centralized Secrets module.
To avoid naming conflicts, the upgrade appends a GUID to each secret's name (for example, my-secret becomes my-secret-a1b2c3d4-...). After the upgrade, open the Secrets module to find the secrets with their new names and update any references in your target configurations.
Other settings carried over
| Setting | Notes |
|---|---|
| Business Logic Recorder (BLR) files | Carried over and available in the target configuration |
| Custom cookies | Carried over to the target configuration |
| URL Rewrite exclusions | Excluded URL paths are carried over |
| Scan tags | Scan-level tags are carried over with the scheduled scan and group scan configuration |
Settings not carried over
| Setting | Notes |
|---|---|
| URL Rewrite mode and rules | Exclusions are carried; mode and rules are not |
| Advanced crawling settings | Must be reconfigured in Invicti Platform |
| Pre-request scripts | Not transferred |
| Post-request scripts | Not transferred |
| PCI scan settings | Not transferred |
| Third-party connections | Not transferred |
| Custom Bridge URL and port | Not supported in Invicti Platform |
| Notification settings per scan profile | Not transferred; carried over separately as Automations |
| Scan profile comments | Not transferred |
| Excluded usage trackers | Not supported in Invicti Platform; not transferred |
Most disallowed HTTP methods carry over as configured. However, DEBUG, TRACK, LINK, and UNLINK aren't supported in Invicti Platform and are silently dropped during the upgrade. After the upgrade, review your disallowed method settings to confirm the expected methods are present.
Scan policies
Scan policies aren't transferred as standalone objects. Instead, the upgrade applies selected settings from each scan policy directly to the corresponding target configuration. The following settings are mapped.
User agent
The upgrade transfers the user agent selected in the Request tab of each scan policy to the target configuration in Invicti Platform.
Proxy settings
The following proxy fields are carried over from the Proxy tab of each scan policy:
- Address
- Port
- Username
- Password
- Domain
The Bypass List isn't carried over.
Scan speed
The Requests per second value from the HTTP Request settings in each scan policy is converted to a scan speed tier in Invicti Platform:
| Requests per second (Invicti Enterprise) | Scan speed (Invicti Platform) |
|---|---|
| 1 or fewer | Sequential |
| 2-24 | Slow |
| 25-74 | Moderate |
| 75 or more | Fast |
CSS selector exclusions
CSS Selector Exclusions from the JavaScript tab of each scan policy are carried over and added to the target configuration under Advanced settings > DeepScan settings > Exclude by CSS selector.
To view CSS selector exclusions in Invicti Platform, Allow users to configure advanced scan configurations must be enabled. Select Settings > Scanning settings and enable that option. If this setting is off, the exclusions are applied during scans but not visible in the target configuration UI.
Technologies
The Technologies section from Invicti Enterprise isn't carried over. Technology detection data - including detected frameworks, libraries, and server software - isn't transferred to Invicti Platform. This data populates fresh as you run new scans.
Authentication settings
This section covers how each authentication type is handled during the upgrade and what may need reconfiguration after the upgrade.
Form authentication
Form authentication settings carry over in one of two ways, depending on the configuration in Invicti Enterprise:
- Default script (unchanged): Carries over as Simple Form Authentication in Invicti Platform.
- Custom script: Carries over as a Login Sequence Recording.
After the upgrade, both types require additional configuration - session validation patterns and logout restrictions aren't carried over. For full post-upgrade steps, refer to the Form authentication upgrade guide document.
HTTP authentication (Basic, NTLM, Kerberos)
The upgrade transfers HTTP authentication settings to the HTTP auth section of the target configuration in Invicti Platform. If multiple HTTP authentication entries were configured in Invicti Enterprise, the upgrade transfers only the first entry.
Header authentication
Header authentication isn't supported in Invicti Platform and isn't carried over. If you used header authentication in Invicti Enterprise, configure an alternative authentication method after the upgrade.
Client certificates
The upgrade carries over client certificates configured in scan profiles to the individual target configuration in Invicti Platform.
Invicti Enterprise supports global client certificates shared across multiple scan profiles. This concept doesn't exist in Invicti Platform. During the upgrade, any global client certificate referenced by a scan profile is copied to that target's individual configuration. The certificate data is preserved, but applied per-target rather than as a shared global resource.
OAuth 2.0
OAuth 2.0 settings transfer with some limitations. The following aren't carried over:
- Custom flow type
- Some Authorization Code tab settings
- POST method and Content-Type for Access Token and Authorization Code requests
For full OAuth 2.0 setup in Invicti Platform, refer to the Configure OAuth 2.0 authentication document.
Team management
This section covers how users, teams, and roles are handled during the upgrade.
Users
| Item | Upgrade behavior |
|---|---|
| Name, email, phone, timezone | Carried over as-is |
| Password | Carried over |
| Email and phone verification status | Carried over |
| Account active/inactive state | Carried over |
| API key | Carried over, re-encrypted with the Invicti Platform encryption key |
| TOTP (authenticator app) | Carried over, including the authenticator app secret |
| SSO exemption status | Carried over |
| Team membership | Carried over |
| U2F hardware security keys | Not transferred - not supported in Invicti Platform |
| Date format preference | Not transferred - not supported in Invicti Platform |
| Login history | Reset to zero; last login timestamp set to null |
| Allowed Website Limit | Not transferred - not supported in Invicti Platform |
If an inactive user shares an email address with another user, the upgrade appends a suffix to their email to prevent conflicts (for example, user+disabled1@example.com). After the upgrade, review your user list if you have inactive accounts that share email addresses with active accounts.
Teams
Team names and all user-to-team memberships are carried over. The following aren't transferred:
- LDAP Distinguished Name (for LDAP-linked teams)
- Audit history (who created or modified the team)
- Original creation and update timestamps (reset to the upgrade date)
Roles and permissions
Invicti Enterprise uses a flat, action-based permission model. Invicti Platform uses a more granular resource-action model (for example, scans:create, vulnerabilities:read). The upgrade maps custom roles with their permissions to the closest Invicti Platform equivalents.
Key behaviors during the role upgrade:
- The upgrade renames the Account Administrator role to Account Administrator (Imported) to avoid conflicts with Invicti Platform's built-in roles.
- The upgrade drops Invicti Enterprise permissions with no equivalent in Invicti Platform. The role is still carried over with all other permissions intact.
- After the upgrade, review your roles in Invicti Platform. The more granular permission model may expose access options that weren't separately configurable in Invicti Enterprise.
Internal agents
This section covers how internal scanning agent configurations are handled during the upgrade.
Agent names transfer from Invicti Enterprise to Invicti Platform as temporary placeholder agents with a migrated status. These placeholders aren't functional until you reconfigure them to connect to an installed Invicti Platform Agent.
The upgrade creates a separate agent entity in Invicti Platform for each source configuration in Invicti Enterprise:
| Invicti Enterprise configuration | Invicti Platform result |
|---|---|
| Preferred agent | A new agent entity named after the Invicti Enterprise agent |
| Preferred agent group | A separate new agent entity |
| Any available agent | A separate new agent entity |
If no internal agent was configured in Invicti Enterprise, the upgrade creates one placeholder named Internal Agent.
After the upgrade, install the Invicti Platform Agent for each environment that requires internal scanning and update each placeholder to connect to the installed agent. Refer to the upgrade steps document for the installation procedure.
Account settings
This section covers how organization-level settings are handled during the upgrade and which settings need reconfiguration after the upgrade.
SSO / SAML
SSO settings are carried over but are turned off by default after the upgrade. Invicti Platform generates new SAML 2.0 Service URL and Identifier values that differ from those in Invicti Enterprise. Your Identity Provider (IdP) must be updated with these new values before SSO works.
What's carried over:
- SSO provider type (Okta, Azure AD / Entra ID, Ping Identity, and others)
- IdP Identifier
- SAML 2.0 Endpoint URL
- X.509 Certificate
- Auto-provisioning setting
- Enforcement setting
After the upgrade, follow the SSO upgrade steps document to update your IdP configuration and re-enable SSO.
Support access window
After the upgrade, Invicti support access (impersonation) is automatically enabled for 14 days. This lets the Invicti team verify your data and assist with any issues immediately after the upgrade. After 14 days, access is automatically turned off. To re-enable it later, go to your organization settings in Invicti Platform.
Warning banners
Login Warning Banner and Page Top Warning Banner settings are carried over for accounts upgraded after 8 June 2026. If your account was upgraded before that date, reconfigure these banners manually in your Invicti Platform organization settings.
IP restrictions
IP restriction settings aren't carried over. Any IP-based session restrictions from Invicti Enterprise must be reconfigured manually in Invicti Platform after the upgrade.
Other settings not carried over
| Setting | Notes |
|---|---|
| Data retention settings | Not currently supported in Invicti Platform |
| Scan control settings | Operational controls; configure on demand in Invicti Platform as needed |
| Advanced settings | Not carried over |
| Default policy settings | Scan policies are configured per-target in Invicti Platform; report policies aren't supported |
| PCI reporting settings | Not carried over |
| "Prevent sensitive information" setting | Supported in Invicti Platform but not automatically carried over; configure manually after the upgrade |
| SCIM settings | Not carried over; set up SCIM from scratch in Invicti Platform |
| LDAP settings | Not carried over (relevant to on-premises deployments) |
| User session timeout | Not carried over |
| Scan Data Download Expiration | Not carried over |
Troubleshooting
A target has the wrong scan speed after the upgrade
Invicti Platform derives the scan speed from the Requests per second value in the Invicti Enterprise scan policy. Check the conversion table in the Scan speed section to see which tier the original value maps to. If the resulting speed isn't correct, edit the target's scan configuration in Invicti Platform to set the right speed.
A secret is missing from the target configuration after the upgrade
The upgrade transfers secrets to Invicti Platform's centralized Secrets module with a GUID suffix added to each name. Open the Secrets module to find the secret with its new name, then update any references in your target configurations.
CSS selector exclusions aren't visible in target settings
The upgrade applies CSS selector exclusions to the target configuration, but they're only visible when Allow users to configure advanced scan configurations is enabled. Select Settings > Scanning settings and enable that option to make the Advanced settings section visible in target configurations.
Excluded hours are blocking scans at different times than expected
Invicti Enterprise scan time windows work at 15-minute intervals; Invicti Platform uses full 1-hour blocks. Any hour that had even a single 15-minute exclusion in Invicti Enterprise becomes a fully excluded hour in Invicti Platform, so scans may stop earlier than you intended. Review your Excluded hours settings and adjust the blocking windows to match your original intent.
A file type from Invicti Enterprise isn't available in the target after the upgrade
Not all file types from Invicti Enterprise are supported in Invicti Platform. RAML, WADL, WSDL, GraphQL, gRPC Proto, and several others are skipped during the upgrade. Refer to the Imported links and files section for the full list. Unsupported files need to be converted to a supported format (such as OpenAPI JSON) and re-uploaded to your targets.
Agents show a "migrated" status in Invicti Platform after the upgrade
Agent entries from Invicti Enterprise transfer as temporary placeholder agents with a "migrated" status. They aren't connected to any running agent and aren't functional until reconfigured. To restore internal scanning:
- Install the Invicti Platform Agent in your internal network environment. Refer to the upgrade steps document.
- Open Scans > DAST agents in Invicti Platform.
- Update each placeholder agent to point to the newly installed agent.
If you see a placeholder named "Internal Agent" and didn't have a named agent configured in Invicti Enterprise, this is expected - the upgrade creates it as a fallback.
SSO isn't working after the upgrade
SSO is turned off by default after the upgrade because Invicti Platform generates new SAML Service URL and Identifier values. You must update your IdP with the new values before enabling SSO. Refer to the SSO upgrade steps document for the full reconfiguration procedure.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center