Skip to main content

Invicti Platform on-premises release notes

RSS feed

This document highlights the new features, new security checks, improvements, and fixed issues introduced in the Invicti Platform across recent releases. Each update focuses on enhancing usability, visibility, security coverage, and integration capabilities for security teams and developers.

2026

This section summarizes all Invicti Platform on-premises releases, including new features, improvements, and fixes as they’re added.

Release 26.243.260831140137

Helm chart: 26.243.260831140137
Windows installer: 26.9.2.1328

Release date: 1 September 2026

New features

  • Custom Security Checks: You can now create and run custom security checks in your on-premises deployment, extending DAST scan coverage with checks designed for your specific environment and security requirements.

  • Ephemeral API targets: You can now create API targets with a dynamic base URL that resolves at scan time, making it easier to scan temporary or CI/CD-provisioned environments without manually updating target configuration before each scan.

Improvements

  • Organization-specific SSO identifier: The SSO settings page now shows a unique identifier for your organization that you can copy and use when registering Invicti as a SAML service provider in your identity provider.

  • Multiple proto files as a ZIP archive for gRPC scanning: You can now upload multiple gRPC proto file definitions as a single ZIP archive, making it easier to scan services that span multiple proto files without importing them one by one. (Read more)

Resolved issues

  • License key update: Applying a new license key through a Helm upgrade or the on-premises configuration center now takes effect correctly on startup.

  • SSO login for organizations with DER-encoded IdP certificates: Organizations whose identity provider certificate is stored in bare base-64 DER format can now sign in using SSO.

  • SCIM2 patch operations: SCIM2 patch operations now complete successfully.

  • Client credentials endpoint: The /clients endpoint now returns ClientId and ClientSecret values when the credentials expand parameter is used, so API consumers can retrieve full client credential details in a single request.

  • Audit log filter for system actions: Filtering the audit log by the System user now returns the correct results.

  • Permission enforcement in Inventory: Permission checks across the Targets, Collections, and Applications pages in Inventory now work correctly for all users.

  • Vulnerability update operations: Updating a vulnerability's status, assignee, or comment now works correctly for users whose role includes the Vulnerabilities: Update permission.

  • Agents filter on the Scans page: The Agents filter on the Scans page now loads correctly for users who don't have the agents:read permission.

  • Manage Users team filter: The team filter on the Manage Users page now works correctly for organizations with a large number of teams.

  • FQDN registration for multi-workspace licenses: Paid multi-workspace license holders can now reuse expired FQDN registrations within their allocation.

  • FQDN usage and licensed target counts: The workspace FQDN usage breakdown now correctly distinguishes between licensed target FQDNs and the total allocation, giving you an accurate view of your license consumption.


Release 26.224.260812114052

Release date: 14 August 2026

New features

  • Internal scan agents: Internal scan agents are now supported in on-premises deployments. You can deploy agents within your environment to extend scanning coverage to targets that aren't reachable from the main Invicti Platform installation.

  • Group Scheduled Scans: You can now schedule recurring scans against a collection or application of targets from a dedicated Group Scheduled Scans section.

Improvements

  • Scanner base image: The scanner base image has been updated, improving scan engine security and reliability.

  • LDAP synchronization settings: LDAP synchronization can now be configured through a dedicated settings page, where you can manage your LDAP connection, synchronization rules, and user provisioning options.

Resolved issues

  • Vulnerability details in large scans: Vulnerability details now load correctly from scans with a very large number of results.

  • Settings access for administrators: Account administrators and owners can now access the Settings section correctly.

  • Asset URL placeholder in issue tracker integrations: The {Asset URL} placeholder in field mappings for Jira, Azure Boards, GitHub, and GitLab integrations now correctly populates with the target URL when issues are created.


Release 26.216.260804113742

Release date: 5 August 2026

New features

  • LDAP user synchronization: You can now synchronize users from your LDAP directory (OpenLDAP or Microsoft Active Directory) into Invicti Platform, automating user provisioning and keeping team membership in sync with your directory.

  • HashiCorp Vault integration: You can now connect Invicti Platform's Secrets Manager to HashiCorp Vault, retrieving credentials directly from your vault when configuring authentication for scans. (Read more)

  • New API scan profile: A new scan profile designed specifically for APIs is now available in your account. All new API targets use it by default, ensuring comprehensive API vulnerability coverage from the start. (Read more)

  • HTTP request and response details in LSR reports: Login Sequence Recorder (LSR) reports now include the full HTTP request and response for each recorded step, so you can review the exact traffic your login sequence generates. Invicti automatically obfuscates sensitive tokens in headers and bodies.

  • Website Discovery export: You can now export the list of websites found during Website Discovery to a CSV file, giving you a portable record for review, tracking, and reporting outside of Invicti Platform.

  • Offline activation for Windows installations: You can now activate Invicti Platform on-premises offline directly from the Windows installer, without requiring internet access during setup.

Improvements

  • Severity filter in vulnerability view: The Severity filter on the Vulnerabilities page is now available when browsing by individual vulnerability (expanded view), not only when browsing by type.

  • All scan profiles available for API targets: The default scan profile setting for API targets is no longer locked to OWASP Top 10 API. You can now select any scan profile available in your account when configuring an API target.

  • Sensorless API Discovery on out-of-scope sites: Sensorless API Discovery now reports APIs found on sites that are out of scope for DAST scanning, giving you a more complete picture of your API surface even for sites you haven't scanned.

  • Persistent vulnerability state in subsequent scans: Vulnerabilities you've marked as Ignored or False Positive are now carried forward to future DAST scans. They're shown with their assigned state rather than appearing open again.

  • Custom scan speed: A new Custom scan speed option is now available in scan configuration that allows you to set the number of concurrent requests and how frequently they're sent, giving you precise control over scan throughput. (Read more)

  • Client certificates in Secrets Manager: You can now store client certificates in Secrets Manager by providing the certificate in base64 format.

  • Secrets available during Login Sequence recording: Secrets configured for a target are now accessible to the Login Sequence Recorder (LSR) during recording, so you can use stored credentials instead of entering them directly when recording authentication flows. (Read more)

  • Azure Pipelines plugin link in CI/CD integration: The Azure Pipelines CI/CD integration setup now includes a direct link to the Invicti plugin in the Azure Marketplace, giving you a plugin-based integration option alongside the existing script-based method.

  • Resizable columns in list views: You can now resize columns across all list views in Invicti Platform, making it easier to adjust the layout to fit your content and workflow.

  • AI BLR discovery shown in site structure: Endpoints identified by the AI Business Logic Recorder (BLR) are now marked in the site structure view, giving you visibility into which parts of the application AI-assisted recording covered.

  • Start date for recurrence-based scan schedules: When scheduling a scan where the recurrence interval determines timing, you can now set a start date to control when the first occurrence fires.

Resolved issues

  • GitHub Actions script: The GitHub Actions sample script correctly produces scan results and report artifacts.

  • User page filters in large accounts: Status filters on the Users page (such as Disabled) now return correct results in accounts with a large number of users.

  • Advanced Target settings applied during Login Sequence recording: Advanced Target settings, such as Prefer HTTP/2, are now correctly applied when recording a Login Sequence Recorder (LSR) session.

  • Jira integration field loading: Field values in Jira integrations (such as Assignee, Reporter, and Labels) now load correctly instead of timing out in some configurations.

  • Scans page collection filter: You can now correctly filter the Scans page by collection.

  • SSO settings save: SSO configurations that include Require signed assertions or Sign requests now save correctly.

  • Advanced Target Settings visibility: The Advanced Target Settings section is now visible to all users with the appropriate permissions, not only account Owners.

  • HTTP responses in Comprehensive and Sarbanes-Oxley reports: Comprehensive and Sarbanes-Oxley reports now include HTTP response data alongside requests.

  • Advanced Settings input value rendering: Input value fields in the Advanced Settings section now display correctly.

  • Scan profile selection for API targets: Changing the default scan profile for an API target now saves and persists correctly.

  • Long JWT Bearer Tokens in IDOR/BOLA credentials: The character limit for authentication values in IDOR/BOLA credentials has been increased from 1,024 to 4,096 characters. (Read more)

  • Internal agent scans stuck in queued state: Scans dispatched to an internal agent no longer get stuck in a queued state when a rate-limit error occurs during scan startup.

  • Scan results on Windows-hosted internal agents: Vulnerabilities and technologies detected during scans now upload correctly to cloud storage when the scan runs on a Windows-hosted internal agent. Previously, backslash path separators caused result files to be stored at incorrect locations.

  • Vulnerability counts in automation notification emails: Automation notification emails now report only open vulnerabilities, matching what you see after applying your configured filters.

  • Custom scan speed throttling: Scans configured with a custom scan speed and a throttling delay now run at the configured request rate. (Read more)

  • Vulnerability export with active filters: Exporting vulnerabilities to CSV, JSON, or XML now works correctly when collection or severity filters are applied.

  • SCIM-provisioned account status: User accounts provisioned via SCIM no longer show as "Invite Expired" before the user first signs in. Accounts created through automatic SCIM provisioning are now correctly shown as active.

  • Vulnerability details in scan reports: Vulnerability details now load correctly when accessed from a scan report.

  • LDAP-synced account owner protection: The account owner is no longer removed when their LDAP group is deleted.

  • Login sequence recording through proxies on internal agents: Login Sequence Recorder playback now works correctly when an internal scanning agent connects through a proxy.

  • OAuth2.0 Business Logic Recorder credentials: OAuth2.0 authentication credentials in Business Logic Recorder configurations now save correctly.

  • "Last" position in ordinal monthly scheduling: The "Last" position option is now available when configuring ordinal monthly scan schedules. You can now schedule scans to run on, for example, the last Monday or last Friday of each month.

  • API operations preview for URL-linked imports: The API operations preview no longer shows for URL-linked API specifications, where it was displaying incorrectly. Previews continue to work for uploaded API specification files.


Release 26.180.260629113725

Release date: 1 July 2026

New features

  • Suspend all scheduled scans: Organization administrators can now suspend all future scheduled scans across the account at once, giving you a single control to pause automated scanning during maintenance windows or change freezes. Scans missed while suspended are not rescheduled; manual scans are not affected. (Read more)

  • Multiple HTTP authentication credentials per target: Targets can now hold more than one set of HTTP authentication credentials, enabling coverage of web applications where different site sections require different credentials. When multiple credentials are configured, a URL is required for each entry to ensure correct routing during scans.

  • Collection dashboard: Collections now have their own dashboard, giving you the same at-a-glance security posture view for a collection that’s already available for applications.

Improvements

  • More resilient GraphQL schema parsing: GraphQL schema imports no longer fail when they contain unrecognized directives. Schemas that use newer specification features, such as the oneOf input directive, now import successfully instead of returning a syntax error.

  • Interactive login for internal agent scans: Interactive login is now supported for scans run through internal agents, not just cloud agents. You can manually complete CAPTCHAs or MFA steps at the start of a scan to get past authentication that can’t be fully automated. (Read more)

  • Authentication settings for API targets: Authentication settings for API targets, including IDOR/BOLA authentication configuration, have moved from the API catalog to the API target settings. (Read more)

  • Ordinal monthly scan scheduling: You can now schedule scans to run on a specific weekday of the month, such as the first Monday or the second Thursday, for more flexible recurring schedules. (Read more)

  • Asset filter on the Technologies page: You can now filter the Technologies page by asset name, making it easier to find the technologies identified on a specific asset.

  • Auditing for SCIM configuration changes: Changes to your SCIM configuration are now recorded in the audit log, so you can track who changed provisioning settings and when.

  • More detail in target exports: CSV and JSON exports of targets now include tags, vulnerability counts by severity, and the last scan date, giving you a more complete picture without opening each target.

Resolved issues

  • LSR recording on internal agents: Recording a Login Sequence Recorder (LSR) session through an internal agent failed in some cases. Recording now works correctly on internal agents. (Read more)

  • Too many filters on the Scans page: The Scans page previously showed an empty "No results" state with no explanation when a filter combination became too long. It now displays a clear message so you know to reduce the number of filters applied.


Release 26.160.260609074715

Release date: 9 June 2026

New features

  • Outbound proxy support for on-premises installations: Invicti Platform on-premises now supports HTTP proxy configuration for outbound traffic, available in both the Windows installer (Read more) and Helm deployments (Read more).

  • Interactive login for DAST scans: You can now configure DAST scans to use interactive login, allowing you to manually complete CAPTCHAs or MFA steps at the start of the scan. This makes it possible to effectively scan sites that can't be fully automated. (Read more)

  • Reusable credentials for form authentication: You can now store credentials in Scans > Secrets and reference them in simple form authentication fields instead of entering plain-text values directly. (Read more)

  • Workspaces: You can now create isolated, self-managed workspaces to organize teams, projects, or environments independently within your organization. (Read more)

Improvements

  • Login sequence and business logic recording on internal agent targets: You can now record Login Sequence Recorder (LSR) and Business Logic Recorder (BLR) sessions for Targets assigned to an internal scanning agent, not just cloud agent Targets. (Read more on the LSR and the BLR)

  • Invicti AI Assistant for all users: Invicti AI Assistant, including the Get help feature, is now available to all users in the account, not only Owners.

  • Filter DAST scans by URL: You can now filter the DAST scans list by target URL using a partial match, making it easier to find scans for specific targets.

  • Improved auditing for Target configuration changes: Changes to Target settings (business criticality, authentication, scan configuration, agent settings, excluded hours, IAST settings, name, and tags) are now audited with previous and new values for accountability and compliance.

  • Internal agent resource information: The internal agent details panel now shows information on machine resources, so you can self-troubleshoot resource-related scanning issues.

  • Higher import file limit: You can now upload up to 10 import files per Target, up from the previous limit of 5.

  • Confidence level now included in CSV and JSON vulnerability exports: Vulnerability exports now consistently include confidence level data.

  • OWASP Top 10 report for all licenses: The OWASP Top 10 report is now available on all licenses, including Essentials.

  • Vulnerabilities list can now be filtered by target business criticality: A new Business Criticality filter in the DAST vulnerabilities list lets users focus on issues belonging to the most business-critical targets. A Business Impact column has also been added to the vulnerability view, providing this context at a glance without needing to navigate to the target.

  • SCIM implementation updates: SCIM2 patch operations no longer fail when a request references an unsupported attribute, unblocking user updates from Microsoft Entra ID and other identity providers.

  • Administrators can now request support access without involving an account owner: Support access requests were previously restricted to account owners only. Administrators can now submit support access requests directly, enabling faster engagement with the support team.

  • SCIM2 provisioning can now be enabled or disabled per organization: Ultimate license customers can now toggle SCIM2 provisioning endpoints on or off for their organization. Disabling it prevents user and team updates or deletions through SCIM2-provisioned accounts, giving organizations more control over their identity management configuration.

  • Persistent vulnerabilities view: The Vulnerabilities page now remembers whether you last used the grouped or ungrouped view and restores it the next time you open the page.

  • Download logs for failed scans: You can now download debug logs for failed scans, not only successful ones, making it easier to troubleshoot scan failures.

  • Incremental scan type indicator: Scan details now show whether a scan ran as incremental or full, so you can quickly confirm the scan type without checking the scan configuration.

  • Delete scans created by a schedule: When you delete a scan schedule, you can now choose to also delete the scans created by that schedule, keeping the Scans page tidy.

  • Improved scan progress indicator: Scan progress is now calculated using a more accurate algorithm, so you get a clearer view of scan status and a better ETA.

  • APIs linked back to their scans: APIs discovered by a scan are now linked back to that scan from the API catalog, so you can trace any endpoint to the scan that found it.

Resolved issues

  • Teams with many members: Teams with a large number of members now load correctly.

  • Cross-organization tag suggestions: The Scans page Tags autocomplete now only shows tag suggestions belonging to your current organization.

  • Scan creation for ephemeral Targets via API: POST /api/v1/scans no longer returns 400 Invalid profile_id when launching scans against ephemeral (Dynamic URL) Targets in CI/CD pipelines with valid profile IDs.

  • CI/CD script generators now produce output when minimum severity is left blank: Previously, leaving the minimum severity field empty in the CI/CD script generator caused the script output to be blank rather than generating a script with no minimum vulnerability threshold. This affected all integrations - Azure Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, and Jenkins. Scripts now generate correctly in this scenario.


HF Release 26.118.260428084120

Release date: 28 April 2026

Resolved issues

  • Corrected navigation settings in the on-premises installation: Users on OnPrem deployments will now correctly see the Version Updates page, and the Organization Data page is now properly restricted from general user access.

Release 26.113.260423132556

Release date: 23 April 2026

New features

  • Windows (WSL) installation: You can now install the Invicti Platform on-premises on Windows using Windows Subsystem for Linux (WSL), without needing a dedicated Linux machine. (Read more)

  • Dynamic (rotating) authentication tokens for API scanning: API scans can now authenticate using rotating tokens, meaning scans no longer fail or produce incomplete results when tokens expire mid-scan. (Read more)

  • Configurable login warning banner: You can now show a configurable warning banner at login with acknowledgment and decline options, designed for large and federal organizations with strict access control requirements. (Read more)

  • Customizable platform header banner: You can now display a customizable banner in the header across all platform pages to communicate important information to all users. (Read more)

  • API Discovery from encrypted traffic: You can now discover APIs from encrypted network traffic using eBPF, with no infrastructure changes required. (Read more)

  • IP address restrictions for user sessions: You can now restrict user sessions to specific IP addresses for improved security and compliance. (Read more)

Improvements

  • Parameters displayed for endpoints in API catalog: Each endpoint in the API catalog now displays its parameters, giving you a more complete view of your API surface. (Read more)

  • SCIM user provisioning with Microsoft Entra ID: SCIM integration with Microsoft Entra ID now uses long-lived OAuth tokens instead of short-lived bearer tokens, so user provisioning stays active without you having to manually refresh the token every hour. (Read more)

  • Extended character support in tags: Tags now accept any character, including spaces and multiple : separators, across all services.

  • Delete scheduled scans: You can now delete scheduled scans directly from the platform. (Read more)

  • Severity per check in scan profiles: Scan profiles now show the highest severity level reported by each check, so you can quickly understand the risk profile of your scan configuration before running a scan. You can also filter checks by severity. (Read more)

  • Incremental scans are now available for instant and one-time scheduled scans: You can now use incremental scans when running an instant scan or a one-time scheduled scan, allowing you to focus only on what has changed since your last scan. It saves you time and reduces noise on unchanged parts of your application.

  • WAF indication during scans: You can now clearly see when a Web Application Firewall is blocking or influencing scan results, so you can better interpret findings and adjust your scan configuration accordingly. (Read more)

  • Filter scans by target collection: When managing many targets, you can now filter your scan list by collection to quickly find the scans that matter to you.

  • Content type in Site structure: The Site structure now shows the content type (such as application/json) for each path, so you can quickly see what format each endpoint expects. (Read more)

  • HTTP request and response in Comprehensive Report: The Comprehensive Report now includes the full HTTP request and response for each finding, giving you more context for investigating and reproducing vulnerabilities.

Resolved issues

  • Scheduled scan times for EU customers after summer time change: Fixed a one-hour discrepancy in scheduled scan times for EU customers following the CET to CEST (summer time) transition.

  • Saving scheduled scans: Fixed a bug preventing users from saving scheduled scans due to a null reference error during scan updates.

  • Scans no longer abort before reaching the Max Scan Duration limit: Scans were stopping at 2 days even when the configured maximum duration was set to longer. Scans now run for the full configured duration.


Release 26.71.260312122304

Release date: 12 March 2026

New features

  • Compliance classification information is now included in vulnerability details to support regulatory alignment and audit readiness (Read more)

Improvements

  • Improved visibility of data in the API catalog
  • Added support for MSSP licensing business logic
  • Targets can now be filtered by Collections
  • DAST Scan schedules are no longer shown in the DAST scans page. These are shown in the DAST scheduled scans
  • Added the ability to assign tags to scans for better organization and filtering (Read more)
  • Scan details now include information on the scan agent used for each scan
  • Scanning agent IP addresses are now visible, improving transparency
  • Scheduled scans can now be assigned custom names to improve identification (Read more on scheduled scans and recurring scans)
  • AI-powered features are now enabled by default for new accounts. Account owners retain the ability to turn off these features during account creation (Read more)
  • Sorting by status on the DAST scans page now automatically uses the scan date as a secondary sort to provide more accurate results
  • Updated DAST engine to handle examples for $ref'd schemas in OpenAPI

Resolved issues

  • Resolved an issue where API specifications and related scans weren't displayed correctly for certain targets
  • Resolved a limitation that prevented successful uploads of larger CSV files
  • Resolved an issue where rediscovered vulnerabilities weren't included in scan and target reports
  • Fixed an issue that prevented reports being generated
  • Extended default scan timeout values for On-Prem environments and Internal Agents
  • Corrected an issue where updated threat levels weren't immediately reflected in the UI after severity changes
  • Resolved an issue that caused unexpected errors related to missing scan creator information
  • Fixed an issue where the Download Logs option wasn't available for aborted scans
  • Fixed an OAuth API validation issue

Release 26.34.260203090313

Release date: 3 February 2026

New features

  • Implemented a feature that allows users to override the severity of vulnerabilities detected in DAST scans (Read more on individual vulnerability's and global severity changes)
  • Implemented screenshot capture during DAST scans to improve visibility of the scanning process and authentication failures (Read more)
  • Compliance classification information is now included in vulnerability details to support regulatory alignment and audit readiness (Read more)
  • Added support for automatic user provisioning during IdP-initiated SAML SSO login
  • Added CircleCI integration (Read more)
  • Improved API Insights dashboard to respect user access restrictions, preventing users from viewing results for targets they don't have permission to access. Only users who have access to all targets can view the dashboard (Read more)
  • Users can now add bulk comments and tags to vulnerabilites (Read more)
  • Enabled users to re-register multiple times using the same NTA token, improving registration flexibility
  • Users can now add API specs via URL reference in target settings, allowing the scanner to pull specs at runtime from targets not accessible to Invicti cloud services (Read more)
  • NTA now automatically shuts down after multiple failed connection attempts to Invicti Platform (Read more)
  • Dark mode is now available
  • Added preview capability for REST API specifications (OpenAPI, Swagger, RAML) after uploading (Read more)
  • WAFs detected by DAST scanner are reported in the Scan activity log

Improvements

  • Discovered and inventoried APIs can now be exported directly from the API catalog view, allowing users to download their full API inventory
  • Enabled users to re-register multiple times with the same NTA token
  • Improved the user experience after creating or linking a target in the API security platform, ensuring users land in the API catalog with an informative success message.
  • Users can now preview uploaded or linked API specifications directly within the target configuration.
  • When the API Security add-on license is added or removed, engine-based discovery is automatically enabled or disabled accordingly to reflect the current license state.
  • APIs can now be added as reference URLs even when the endpoint is not reachable from the cloud, supporting the use of internal or private URLs.
  • The Kong Konnect integration has been upgraded to use the latest API v3.
  • The time-zone picker in user profile settings has been upgraded and now includes India Standard Time (GMT +5:30).
  • AI-powered features are now enabled by default for all new accounts, with account owners given the option to disable them at the time of account creation.
  • The Scan Preparator now supports proxy configuration for remote backend access, enabling internal scanning agents to reach backend services through a proxy.
  • The LSR engine now forwards screenshot data captured during scans to the UI, making visual scan evidence available directly in the interface.
  • The ICBD component has been updated to run on Node.js 20.x (LTS), ensuring compatibility with the latest long-term support release.

Resolved issues

  • Fixed an issue where creating a target from a discovered AWS API failed.
  • Resolved an issue where the API target detail view returned an incorrect number of operations.
  • GraphQL and other unsupported API spec types are no longer incorrectly displayed in API Hub.
  • Fixed an issue where the API Hub Swagger page failed.
  • Resolved an issue where default sorting and manual sorting changes of API operations were not applied correctly.
  • Fixed an issue where the API Target Source type displayed in the UI did not match the value set when uploading from the target configuration.
  • Fixed a communication issue between DAST and Inventory services when updating a target agent.
  • Fixed an issue where the Exemptions list failed to display more than 50 users.
  • Fixed an issue where the internal scanner was generating excessive request volume.
  • Resolved an issue where LSR scans with restrictions and imported files failed to complete successfully.

2025

This section summarizes all Invicti Platform on-premises releases, including new features, improvements, and fixes as they’re added.

Release 25.322.251118145546

Release date: 20 November 2025

This is the first release of the Invicti Platform on-premises edition. This release provides a self-hosted deployment option that allows organizations to run Invicti Platform within their own infrastructure using Helm charts on Kubernetes.

To install Invicti Platform on-premises, follow the comprehensive on-premises documentation, which covers:

  • Architecture overview and system requirements
  • Prerequisites and Kubernetes cluster configuration
  • Step-by-step installation instructions
  • Post-installation setup and configuration
  • Troubleshooting guidance