Deployment: Invicti Platform on-demand, Invicti Platform on-premises
Differences between Invicti Enterprise and Invicti Platform
Know what changes before you move from Invicti Enterprise (IE) to Invicti Platform, or when you compare the two products side by side. This document explains how they differ in features (including AI-aided capabilities and vulnerability management), scanning, configuration, integrations, and the API, and it points to the detailed upgrade documents for each area.
Why this matters
Invicti Platform isn't the same product with a new version number. Some capabilities are new, some work differently, and some settings and integrations don't carry over. Invicti Platform also adds capabilities that Invicti Enterprise doesn't have, such as AI-aided scanning, AI pentesting, and vulnerability management. Knowing the differences up front helps you plan what to reconfigure, what to rebuild, and which new capabilities to adopt. It also helps you set the right expectations for the teams that rely on your scan results, integrations, and API scripts.
Overview
With some exceptions, Invicti Platform is an upgrade from Invicti Enterprise, and it's also a complete rewrite. It adds capabilities that Invicti Enterprise doesn't have, such as AI-aided scanning and broader API security, and it changes how some familiar things work, such as where scan settings live and how the API is structured.
This document covers the differences that matter most. It doesn't list every small change, such as differences in filtering options.
- For what carries over when you upgrade, refer to Moving from Invicti Enterprise to Invicti Platform.
- For how individual settings are converted, refer to the IE to Invicti Platform upgrade reference.
Architecture
Invicti Platform has a new architecture. You can use it on-demand, hosted by Invicti, or on-premises, hosted by you. The on-premises deployment runs on Kubernetes, and you can install it in one of three ways:
- Helm: install the Helm chart on your own Kubernetes cluster. Refer to Helm installation, and to Architecture for the components.
- Linux scripts: run the installation scripts on a clean, dedicated Linux host. The scripts set up Kubernetes (k3s by default, or RKE2) and deploy the platform. Refer to Installation scripts.
- Windows installer: run the installer on Windows 11 or Windows Server 2022 or later. It runs a lightweight Kubernetes cluster (k3s) in a WSL2 Ubuntu distribution and deploys the Helm chart inside it. Refer to Windows prerequisites and Windows installation.
For an overview of what's different on-premises, refer to the On-premises overview.
Internal scan agents in Invicti Platform are lightweight and can run scans concurrently. You can install an agent on Windows or with Docker. For scalable scanning, deploy an autoscaling agent on Kubernetes with a Helm chart.
Feature comparison
The following tables compare the features of Invicti Enterprise with Invicti Platform on-demand and Invicti Platform on-premises.
Some Invicti Platform features depend on your license, and not every license includes every feature. The Invicti Platform on-demand column shows what's available with the most complete license. Check what your license includes before you plan around a feature.
Scanning and discovery
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| DAST and web application scanning | Yes | Yes | Yes | AI-powered DAST is available in Invicti Platform on-demand only |
| Scanning for 1,600+ vulnerabilities | Yes | Yes | Yes | |
| Web discovery | Yes | Yes | Yes | |
| Pre-request scripts | Yes | Yes | Yes | |
| Post-request scripts | Yes | No | No | |
| Custom security check scripts | Yes | Yes | Yes | |
| Form authentication scripts | Yes | Yes | Yes | |
| IAST | Yes | Yes | Yes | |
| Dynamic URL scanning | No | Yes | Yes | Refer to Scan dynamic URL target |
| Shadow AI discovery and LLM scanning | No | Yes | Yes | Refer to LLM-based app vulnerability testing |
| Runtime SCA | Yes | Yes | Yes | Called Technologies in the product |
| PCI ASV | Yes | Yes | No | Invicti Platform on-demand includes company-personalized reports |
API security and discovery
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| API scanning | Yes | Yes | Yes | Invicti Platform adds stateful API scanning |
| API discovery | Yes | Yes | Yes | From scans and the Network Traffic Analyzer (NTA) |
| API discovery from source code | No | Yes | Yes | |
| Invicti Source Scan | No | Yes | No | Generates OpenAPI specifications from your source code. Refer to Invicti source scan |
| API discovery from encrypted traffic (eBPF) | No | Yes | Yes | Refer to NTA with eBPF Sniffer |
| API gateway integration | Yes | Yes | Yes | |
| Advanced API catalog | No | Yes | Yes | Includes endpoints, HTTP methods, and PII. Refer to API catalog overview |
| IDOR and BOLA checks | No | Yes | Yes | Refer to API access control testing overview |
AI-aided capabilities
These capabilities use AI. Except for predictive risk scoring, they're new in Invicti Platform: they aren't available in Invicti Enterprise, and they aren't available on-premises.
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| Predictive risk scoring | Yes | Yes | Yes | Predicts how likely a discovered website is to have vulnerabilities, so you can scan the riskiest sites first. Refer to Introduction to Predictive risk scoring |
| AI-aided login | No | Yes | No | Finds login forms that standard heuristics miss. Refer to Enable AI features |
| AI-aided form filler | No | Yes | No | Generates suitable values for form fields the scanner doesn't recognize, so it can submit the form and test what's behind it. Refer to AI-enhanced coverage and crawling |
| AI-aided business logic discovery | No | Yes | No | Detects multi-step flows, such as a checkout, so the scanner tests them as one sequence. Refer to AI-enhanced coverage and crawling |
| AI-aided path and endpoint discovery | No | Yes | No | Predicts paths and endpoints that crawling didn't reach and passes them back to the scan. Refer to AI-enhanced coverage and crawling |
| AI-aided API discovery from source code | No | Yes | No | Uses AI to find API endpoints in your source code |
| AI pentesting (Octo) | No | Yes | No | Uses AI agents to run penetration tests and produce a pentest report. Refer to Agentic pentests |
Vulnerability management and application security posture
These capabilities are new in Invicti Platform: they aren't available in Invicti Enterprise, and they aren't available on-premises.
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| Vulnerability database and deduplication | No | Yes | No | Refer to Vulnerability database overview |
| Bullseye vulnerability prioritization | No | Yes | No | Refer to Prioritize vulnerabilities with Bullseye |
| Software bill of materials (SBOM) | No | Yes | No | Refer to SBOM components overview |
| Suppression rules and requests | No | Yes | No | Refer to Suppression rules |
| Automation rules and workflows | No | Yes | No | Refer to Automation rules overview |
| Inventory of products, projects, and collections | No | Yes | No | Refer to Products overview and Understand projects |
| Committer benchmark | No | Yes | No | Refer to Committer benchmark overview |
| Repository access integrations | No | Yes | No | For example, GitHub and Azure DevOps Services |
| Vulnerability import from CSV and tool reports | No | Yes | No | Refer to Import vulnerabilities |
Login and authentication
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| Interactive login (for example, CAPTCHA and MFA) | Yes | Yes | Yes | Also known as manual intervention. Invicti Enterprise requires Invicti Standard for this feature |
| Automatic target login | Yes | Yes | Yes | Invicti Platform records the visual login sequence |
| Centralized secrets store | No | Yes | Yes | Invicti Enterprise saves credentials in each scan profile. In Invicti Platform, you store a credential once as a secret and reuse it across targets |
| Interactive login directly from the UI | No | Yes | Yes | Refer to Instant scan |
Agents and scan automation
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| Internal scan agent | Yes | Yes | Yes | Invicti Platform agents are lightweight and run concurrent scans |
| Scalable internal scan agent | No | Yes | Yes | Helm-based. Refer to Install an autoscaling agent using K8s |
| Invicti Scan CLI (Docker container for CI/CD pipelines) | No | Yes | Yes | Invicti Enterprise has no CLI scanning tool. You can start scans from your CI/CD pipeline with the Invicti Enterprise CI/CD integrations, or write your own scripts that use the API. For Invicti Platform, refer to Integrate CI-driven scans |
Access, reporting, and governance
| Feature | Invicti Enterprise | Invicti Platform on-demand | Invicti Platform on-premises | Notes |
|---|---|---|---|---|
| Dashboards | Yes | Yes | Yes | |
| Reports | Yes | Yes | Yes | Invicti Platform includes advanced reports |
| Email notifications | Yes | Yes | Yes | |
| Third-party issue tracker and CI/CD integrations | Yes | Yes | Yes | Invicti Platform supports fewer integrations than Invicti Enterprise. Refer to the Integrations comparison |
| Third-party AST connectors | No | Yes | Yes | |
| Role-based access control | Yes | Yes | Yes | |
| Customizable roles | Yes | Yes | Yes | |
| Single sign-on | Yes | Yes | Yes | |
| Audit logs | Yes | Yes | Yes | |
| Workspaces | No | Yes | Yes | Refer to Workspace overview |
Scanning engine: performance and detection
Invicti compared scans run by both products and found that Invicti Platform's scanner is faster and finds more vulnerabilities. Based on data from scans of more than 9,000 targets that both products scanned, on average:
- Invicti Platform's scanner completed scans 1.8 times faster than Invicti Enterprise, measured by scan duration.
- Invicti Platform detected 28% more Critical, 59% more High, and 43% more Medium vulnerabilities.
Results vary by target.
What starts fresh in Invicti Platform
The upgrade doesn't carry over results data. After you move, Invicti Platform fills with new data as you run new scans.
- Scans and vulnerabilities: past scans (including requests, responses, and scan activity logs) and existing vulnerability records aren't carried over.
- Reports: saved historical reports aren't carried over.
- Technologies: technology detection data fills as you run new scans.
- Audit logs: audit logs from Invicti Enterprise aren't retained.
For the full list, refer to Moving from Invicti Enterprise to Invicti Platform.
Configuration differences
Invicti Platform organizes scan configuration differently from Invicti Enterprise. The following table shows the differences that affect you most. For how each setting is converted during an upgrade, refer to the IE to Invicti Platform upgrade reference.
| Area | Invicti Enterprise | Invicti Platform |
|---|---|---|
| Where scan settings live | Targets are URLs that you scan with different configurations. Scan policies are separate objects. | Each target has its own scan configuration. Scan policies aren't standalone objects, and their settings apply to each target. |
| Scan scope | Three options: Only entered URL, Entered path and below, and Whole domain. An Include URLs filter limits crawling. | Two settings: Restrict scans to imported files and API specs and Limit crawling to address and sub-directories only. There's no equivalent of the Include URLs filter. To get the same result, import a list of URLs and restrict the scan to the import file. Use the scope settings and excluded paths to narrow scans further. |
| Scan time windows | You set blocked times at 15-minute intervals. | You set blocked times in full 1-hour blocks. |
| Scan speed | You set the number of requests per second. | You choose a speed: Sequential, Slow, Moderate, or Fast, or set custom speed controls. |
| Roles and permissions | A flat, action-based permission model. | A more granular resource and action model. |
| Report policies | Report policies change how detected vulnerabilities appear in reports, for example the information shown for each vulnerability. They don't customize the report itself, such as its title or a banner. | Report policies aren't supported. You can customize only the severity of vulnerabilities. Refer to Severity overrides. |
| Scripts | Scripts written for Invicti Enterprise. | You rewrite pre-request scripts for Invicti Platform. Refer to Pre-request scripts. Post-request scripts aren't supported. |
| Notifications | Notification settings per scan profile. | You set up notifications as automations. Refer to the IE notifications upgrade guide. |
Integrations
Invicti Platform supports a smaller set of integrations than Invicti Enterprise for issue trackers and project management tools, and it adds integrations that Invicti Enterprise doesn't have. Only some Invicti Enterprise integrations carry over during an upgrade: Jira, Azure Boards, GitHub, GitLab, ServiceNow Incident Management (on-demand only), Slack, Microsoft Teams, webhooks, and the HashiCorp Vault, CyberArk Vault, and Azure Key Vault secret managers. After the upgrade, check the configuration of each integration. Refer to the IE integrations upgrade guide for details.
| Category | Invicti Enterprise | Invicti Platform |
|---|---|---|
| Issue trackers |
|
|
| Project management |
| None |
| Communication |
|
|
| Secret managers |
|
|
| Automation tools |
| Webhook |
Invicti Platform also offers integrations that Invicti Enterprise doesn't list, including ServiceNow Vulnerability Response, a Splunk add-on, and a connection to Mend as a third-party AST connector. Both products support CI/CD integrations. For the Invicti Platform options, refer to Continuous integration overview.
API
Invicti Platform has a different API from Invicti Enterprise. Endpoints, request models, and authentication schemes all differ, so scripts and integrations that use the Invicti Enterprise API don't work with Invicti Platform. You need to rebuild them.
Invicti Platform provides several API definitions for different use cases, and you can browse them in Swagger UI. For what to change and where to find the new API, refer to the API upgrade guide. To start using the Invicti Platform API, refer to Get started with the Invicti Platform API.
Troubleshooting
A feature I used in Invicti Enterprise is missing in Invicti Platform
First, check the feature tables in this document. Some features are available only on-demand or only on-premises, so confirm that the feature is available in your deployment type.
If the feature still isn't there, check whether it's one of the items that aren't carried over in Moving from Invicti Enterprise to Invicti Platform. If you need help, contact Invicti Support.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center