FREEDOM251

Freedom251 › Interactive Application Security Testing Software

Acunetix

Free trial APILinuxSelf-hostedWebWindows

Visit Acunetix Alternatives Pricing

Acunetix's own site

What Acunetix is

Acunetix, now Invicti Web + API, scans live web applications and APIs to find vulnerabilities that could be exploited. Its proof based validation can safely check findings and provide evidence of exploitability, helping teams judge false positives. The product says it identifies more than 7,000 issues, including OWASP Top 10 and OWASP API Top 10 risks and business logic flaws. It can scan single page and JavaScript heavy applications, REST, GraphQL, and SOAP APIs, including authenticated user flows. Before a scan, risk scoring uses more than 200 signals to estimate risk. Results can connect to Jira, Microsoft TFS (Azure DevOps), GitHub, GitLab, Bugzilla, or Mantis; Acunetix Premium also supports Jenkins. The company describes the tool as designed for small and mid-size organizations managing web security. Deployment is hybrid, with cloud hosting listed for Web + API and on-premises marked as coming soon. Web + API has unlimited coverage and is priced by quote. Agentic Pentest costs $500, paid once for a single application and its API suite, with audit-ready PDF reports and delivery within 24 hours. A Proof of Concept license lets an organization try the complete solution before committing.

Who it suits

Acunetix suits small and mid-size organizations that need to scan web applications and APIs, including authenticated user flows. Teams that route findings through supported issue trackers or use Jenkins with Acunetix Premium may also find its integrations relevant.

What it does well

  • Validates vulnerabilities with evidence of exploitability.
  • Identifies more than 7,000 issues, including business logic flaws.
  • Scans REST, GraphQL, and SOAP APIs.
  • Supports authenticated user flows.
  • Risk scoring uses more than 200 signals.
  • Offers a Proof of Concept license for the complete solution.

What to know first

  • There is no free plan.
  • Web + API pricing is available by quote.
  • On-premises Web + API deployment is marked as coming soon.
  • Acunetix is not FIPS certified or verified.

Limits

Web + API is described as having unlimited coverage. Agentic Pentest covers a single application and its API suite; Web + API on-premises deployment is marked as coming soon.

Plans

PlanBilled and limitsPrice
Agentic Pentest$500 max per pentest · single application and its API suite · audit-ready PDF reports · delivery within 24 hours$500, paid once
Web + APIStart a quote · Unlimited coverage · cloud hosting · on-premises marked “coming soon”On request

As acunetix.com lists them, read 29 Sept 2026. The maker's own page has the final word.

Getting started

  1. Visit the Acunetix website.
  2. Request a Proof of Concept license to try the complete solution in your organization's environment.
  3. Choose Web + API pricing by quote or the Agentic Pentest option at $500, paid once.
  4. Install on Microsoft Windows or a supported Linux distribution if using the desktop installation route.
  5. Set targets, counting subdomains and ports as separate targets.

Verdict

Choose Acunetix if your organization needs dynamic scanning across web applications and APIs, with evidence to assess findings and integrations for issue tracking. Look elsewhere if a free plan, published Web + API pricing, or FIPS certification is a requirement.

Questions

Does Acunetix have a free plan?

No. A no-risk Proof of Concept license is offered to try the complete solution before commitment.

How much does Acunetix cost?

Web + API pricing is available by quote. Agentic Pentest costs $500, paid once.

Which platforms does it support?

The listed platforms are API, Linux, self-hosted, web, and Windows. Its desktop installation guide covers Windows and several Linux distributions.

What can Acunetix scan?

It scans running web applications and APIs, including single page and JavaScript heavy applications, REST, GraphQL, and SOAP APIs, and authenticated user flows.

Which integrations are listed?

Issue tracker integrations include Jira, Microsoft TFS (Azure DevOps), GitHub, GitLab, Bugzilla, and Mantis. Acunetix Premium also has Jenkins integration.

Does Acunetix have FIPS certification?

The product is compatible with systems using FIPS policy, but it does not have FIPS certification or verification.

Facts from Acunetix's own pages

Application coverage
It supports scanning single page applications, JavaScript heavy applications, REST, GraphQL, and SOAP APIs, including authenticated user flows. · acunetix.com, 29 Sept 2026
Desktop platforms
The installation guide supports Microsoft Windows and several Linux distributions, including Ubuntu, SUSE, Kali, CentOS, Red Hat, and Oracle Linux. · acunetix.com, 29 Sept 2026
FIPS limitation
Acunetix says it is compatible with systems using FIPS policy but does not have FIPS certification or verification. · acunetix.com, 29 Sept 2026
Founded
2005 · acunetix.com, 28 Sept 2026
Headquarters
Austin, Texas, United States · acunetix.com, 28 Sept 2026
Integrations
Listed issue tracker integrations include Jira, Microsoft TFS (Azure DevOps), GitHub, GitLab, Bugzilla, and Mantis; Acunetix Premium also has Jenkins integration. · acunetix.com, 29 Sept 2026
Product identity
Acunetix is now Invicti Web + API, a dynamic application security testing product for web applications and APIs. · acunetix.com, 29 Sept 2026
Proof based validation
Proof based scanning can safely validate vulnerabilities and provide evidence of exploitability to help reduce false positives. · acunetix.com, 29 Sept 2026
Risk scoring
Its AI driven risk scoring uses more than 200 signals to predict risk before scanning begins. · acunetix.com, 29 Sept 2026
Security
Acunetix 360 On-Demand says data transfers, stored data, and backups use TLS 1.2, SSL certificates, and 256-bit AES encryption. · acunetix.com, 29 Sept 2026
Support
The pricing page says all subscriptions include standard support with rapid response times. · acunetix.com, 29 Sept 2026
Target limits
A target is defined as a fully qualified domain name, and subdomains and ports count as different targets. · acunetix.com, 29 Sept 2026
Trial access
The pricing page offers no-risk Proof of Concept licenses to try the complete solution in an organization's environment before commitment. · acunetix.com, 29 Sept 2026
Vulnerability coverage
The product says it identifies more than 7,000 issues, including OWASP Top 10, OWASP API Top 10, and business logic flaws. · acunetix.com, 29 Sept 2026
What it does
The product scans running web applications and APIs to identify exploitable vulnerabilities. · acunetix.com, 29 Sept 2026
Who it is for
The company describes its application security testing tool as built to help small and mid-size organizations manage web security. · acunetix.com, 29 Sept 2026

Where Acunetix stands on Freedom251

Look at these too