Invicti AppSec Core release notes

Track new features, improvements, and fixed issues across Invicti AppSec Core releases. Each entry describes what changed and what you can do as a result.

2026​

This section covers all releases for 2026, updated as new releases ship.

Release 20261008​

Release date: 8 October 2026

New features​

• Shared saved filters: You can now share your saved filters with other users in your organization, so teams can work from the same views without recreating them.
• Trend Matrix for Projects and Targets: The AppSec Platform now includes a Trend Matrix for Projects and Targets, with filters applied, so you can track how your security posture changes over time.
• Retest for DAST vulnerabilities: You can now retest DAST vulnerabilities directly from Core and confirm whether a fix worked. Retest analysis applies only to the relevant DAST scan.
• Improved vulnerability triage and workflow: Vulnerability statuses now better match how teams review, prioritize, and resolve findings, so triage is faster and easier to follow.
• VEX configuration in General Settings: VEX settings are now available in General Settings. They show scanner display names and honor disabled VEX ingestion.

Resolved issues​

• Repository errors not displayed: Repository sync errors now appear instead of an empty list with 0 projects, so you can see why a repository failed to sync.
• DAST scans not linking to reports: DAST scans now carry the correct session ID, so scans on ASPM pages link to their reports.
• Template and pentest CSV import failing silently on DAST targets: Importing to Invicti DAST targets now works correctly. Previously, the upload reported success but the scan ended in Failed with "failed to get scan report status of scanner invictidast".
• Large repository scans failing: Repository-based scans on large repositories no longer fail because of a clone timeout.
• Scan report severity counts not filtering: Clicking a severity count in the scan report now applies the matching filter.
• Scan report findings drawer: The findings drawer now opens the current vulnerability detail view instead of the legacy one.
• Automations menu disappearing: The menu in Automations no longer disappears when you switch tabs.

Agentic Pentesting: Release 20261001​

Release date: 1 October 2026

New features​

• Credit transaction ledger: You can now review every credit addition and deduction, along with your current available balance, in the new AI Credit Usage section under the Pentests nav item. When you start an assessment, Invicti reserves its credits right away and shows them as pending until the assessment finishes, so you always know how much of your balance is committed.
• Credit usage in the Summary tab: The Summary tab now shows how many credits each assessment has used, updating in real time while the assessment runs. Failed assessments don't use any credits, and canceled assessments show only the credits used up to the point of cancellation.
• HTML report download: You can now download assessment reports in HTML format, ready to open in any browser or share with stakeholders.
• Scanner logs and agent traces download: You can now download the scanner logs and raw agent traces for an assessment as a single compressed archive, making it easier to investigate results in detail or share them with Invicti Support.
• Select a repository for source code: In the source code step of the pentest wizard, you can now select a repository that's already connected to Invicti AppSec Core instead of uploading an archive. Uploading a source code archive is still available. Repository integration isn't available in the Invicti Application Security Platform.

Improvements​

• Sitemap coverage for scan-wide agents: Findings from scan-wide agents now appear on the sitemap path that the agent covered, instead of at the root, so you can see exactly where each agent tested your application.
• Agents in the CSV sitemap: The CSV sitemap export now lists the agents that tested each endpoint.
• Excluded paths respected during reconnaissance: The Recon agent now respects your excluded paths, so agents don't discover or probe paths you've excluded from the assessment.
• Reference documents inside source code archives: The Recon agent now also uses documentation and diagrams found inside your uploaded source code archive, such as README files and architecture diagrams, to discover more of your application's attack surface.
• Scope enforcement for agent requests: Octo now blocks attack agent requests that fall outside your target's configuration and scope settings, keeping testing within the boundaries you've defined.
• Automatic false positive marking for DAST findings: Octo now automatically marks DAST findings as false positives when its agentic analysis confirms they're false positives, so you have fewer findings to triage manually.
• More reliable finding validation: Finding validation is now stricter, reducing the number of weak findings that get confirmed, genuine findings that get rejected, and findings reported under the wrong vulnerability class.
• More accurate time-based vulnerability confirmation: Octo now confirms time-based findings over multiple rounds with varied delay values, which reduces false positives caused by network latency or server load. The finding evidence includes the timing results for each round.
• Prioritized testing of high-value inputs: Attack agents now test the most relevant inputs first, so the most promising attack paths are covered within your assessment's time and credit limits.
• Faster agent start: Attack agents now start as soon as the initial DAST scan finishes, instead of after a fixed waiting period, so assessments reach the agentic testing phase sooner.
• Expanded detection coverage: Attack agents now detect more vulnerability variants, including Ruby deserialization vulnerabilities, additional JWT authentication bypass techniques, and path traversal that bypasses simple blocklist filters. The credential brute-force agent also now identifies login fields more accurately.
• Whole-number credit values: Invicti now uses whole numbers for credit values instead of decimal values.
• Credit expiration at term end: Unused credits now expire at the end of your subscription term.
• AI Services Addendum in the assessment confirmation: The assessment confirmation dialog now references the AI Services Addendum, which forms part of your governing agreement with Invicti.

Resolved issues​

• Included Agents field empty at assessment start: The Included Agents field now shows the agents you configured as soon as an assessment starts.

Release 20260902​

Release date: 2 September 2026

New features​

• AI Bill of Materials (AI-BOM) detection and inventory: Invicti AppSec Core now detects and inventories the AI components your applications include or consume - AI/ML frameworks and agentic libraries. Identified components are available in an AI inventory view and exportable in CycloneDX 1.6 format, in line with the OWASP AIBOM standard and EU AI Act Article 53 requirements.
• Bulk target import: Import multiple targets at once from the Targets page. Enter URLs manually or upload a CSV file containing target details such as name, URL, description, credentials, and team assignment. Imported targets appear in the Targets list with Not Scanned status and have the Invicti DAST Scanner assigned automatically. A sample CSV file is available to download from the import page.
• VEX support for SCA scans: SCA scans now produce VEX (Vulnerability Exploitability eXchange) statements alongside results. Use them to tell apart exploitable vulnerabilities from findings that don't apply to your environment, prioritize remediation, and demonstrate compliance to auditors.

Improvements​

• Severity ordering in Vulnerability Group View: Vulnerability groups sorted by Severity now appear in rank order (Critical, High, Medium, Low) by default. You can also select Severity from the Sort dropdown to control group ordering explicitly.
• Sorting restored for vulnerability count columns: Vulnerability count columns are sortable again. A tooltip shows the sort direction for the next click.
• Item counts on Scans screens: Total scan counts now appear in the Scans sidebar and pagination for each tab (All, Queued, Completed, Failed), giving you an at-a-glance count without paging through results.

Resolved issues​

• Automation Rule "Apply To" settings not saving: Team and Label selections in Automation Rules now save and display correctly after editing. Rule copies also retain the original team scope.
• Automation rules not firing after scans: Automation rules now trigger correctly when a scan finishes.
• Large repository scans failing: SAST, SCA, Secrets, and IaC scans on large repositories complete the clone phase successfully.
• Product pages returning 403 for Viewer role: Viewer-role users can now access Product pages without encountering a 403 error.
• "Failed to get vulnerabilities" error in grouped view: Selecting a project name in the Scanner + Projects group view now loads its vulnerability table correctly.
• Scans table layout: The Scans table no longer displays extra whitespace or an inner scrollbar.
• Edit Collection help links: Help links on the Edit Collection page now point to the correct documentation.
• Background scan processing reliability: Background scan workers no longer stall unexpectedly, improving overall processing reliability.

Agentic Pentesting: Release 20260831​

Release date: 31 August 2026

New features​

• Agentic Pentests in Invicti AppSec Core: You can now manage Agentic Pentests directly from the UI, with findings flowing into the same pipeline as standard DAST scans for unified visibility and triage.
• DAST technology fingerprinting for Attack Agents: Technologies and framework stacks detected by DAST scans are now automatically shared with Attack Agents, so exploit payloads are tailored to your target's actual technology stack.
• Sitemap agent coverage visualization: The sitemap now shows path-level and input-level coverage, so you can see exactly which endpoints were analyzed by scan-wide and input-specific agents.
• Vulnerability Chaining Agent: A new attack agent in the assessment engine can correlate individual findings to execute multi-step vulnerability chains, uncovering complex attack paths that single-step analysis might miss.
• Markdown and JSON report exports: You can now download assessment reports in Markdown (.md) and raw JSON formats, making it easier to import results into automated pipelines or external tools.
• Multimodal reference document imports: The Recon agent can now import architectural diagrams and documentation files (PDF, DOCX, MD) that you upload, enabling it to discover non-crawlable attack surfaces that standard crawling can't reach.

Improvements​

• Sitemap path and parameter exclusions: You can now exclude URL paths and parameters in the Octo sitemap, bringing it in line with DAST scan exclusion capabilities.
• DAST Engine in Agent view: The DAST Engine now appears as a distinct entry under Attack Agents, so total vulnerability counts align across AI agents and traditional DAST scans.
• Agent attack prioritization and budgeting: Assessment Profiles now support input caps and other prioritization limits, and execution quotas have transitioned to credit spend limits for more granular control over agent resource use.

Resolved issues​

• Assessment completion status on budget limits: Assessments that reach a time or credit limit are now correctly marked as "Completed" instead of "Cancelled" or "Failed."
• API spec and DAST config startup crashes: Assessments no longer crash at startup when importing DAST configurations or pulling linked API specifications from APIHub.
• Authentication state and finding severity: Session timeouts during an assessment no longer cause agents to evaluate endpoints as unauthenticated, which was incorrectly inflating finding severities.