Invicti API Security uncovers hidden and undocumented APIs
Invicti announced Invicti API Security, merging comprehensive API discovery with proactive security testing into a single solution.
The growth of service-based architectures has driven an explosion in APIs, creating yet another expanding attack surface for security teams to address. As development teams embrace the productivity benefits of AI code assistants, API creation accelerates further. But while AI code assistants are boosting developer productivity, they cannot yet generate secure application code or secure APIs consistently, propagating the risk from vulnerable APIs deployed into today’s web services.
According to ESG’s report Securing The API Attack Surface, 76% of organizations report having an average of 26 APIs per application deployed. Many of these APIs are undocumented and unmonitored, so the security challenge is now about confidently and quickly finding APIs, testing them for vulnerabilities, and performing remediation. With Invicti API Security, organizations can realize comprehensive API discovery alongside proactive API security testing.
Invicti API Security includes multiple discovery methods to enable comprehensive identification of known and undocumented APIs, including:
- Zero-configuration discovery to identify API specifications, scanning cloud environments for accessible paths
- API management system integrations to fetch and sync accurate and latest API specifications into inventory
- Network API traffic analysis to identify and reconstruct API calls into API definition files based on observed traffic
“With the Invicti Platform’s extensive API discovery capabilities, we are able to deliver a tool consolidation option, combining web application and API security into a single solution,” said Neil Roseman, CEO at Invicti. “As tool sprawl and budgetary constraints grow, CISOs can rely on the Invicti solution to address the growing API security concerns in addition to reducing their team’s tool complexity.”
For decades, Invicti has provided the advantage of web application security testing coverage, accuracy, speed, and scale. The combination of continuous automated discovery, proof-based scanning to verify critical vulnerabilities for developers, and recently added Predictive Risk Scoring to advance prioritization efforts provide customers with a unique set of benefits. These web application security benefits can be deployed together with API discovery and security testing.
“Our research shows that security leaders are increasingly concerned with API security and their ability to secure their customers’ sensitive data. This is because as developers build feature-rich applications with integrations and communications to resources, the APIs, especially unknown shadow APIs, create rapidly proliferating attack surfaces,” said Melinda Marks, Practice Director, Cybersecurity at ESG. “The Invicti approach applies a multi-layer discovery method to thoroughly identify APIs, helping organizations deliver secure applications.”
Invicti API Security is available to Invicti customers across both Acunetix and Invicti (formerly Netsparker) product lines to extend their use of the Invicti platform. New customers can purchase the product as a web application and API security combination, or a standalone API Security option.
China-linked APT17 Targets Italian Companies with 9002 RAT Malware
Navigating Insider Risks: Are your Employees Enabling External Threats?
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability
CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability
MediumDirectory Browsing
LowServer Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
InformationalVerification Request Identified
InformationalSec-Fetch-Site Header Has an Invalid Value
MediumBackup File Disclosure
InformationalCross Site Scripting (Persistent) - Spider
InformationalSplit Viewstate in Use
Free online web security scanner