Key Takeaways
- • Invicti reported 52 unique, verified vulnerabilities across four black-box and source-assisted assessments of Fider 0.33.0 and Photoview 2.4.0, versus 49 Doyensec-validated findings for Aikido and 31 for XBOW, per its October 24, 2026 press release.
- • Invicti's reported report-delivery times were 46 minutes for the Fider source-assisted assessment and 50 minutes for Photoview, compared with roughly eight hours for Aikido and multi-day timelines for XBOW.
- • Invicti said its hybrid DAST and agentic approach produced 25 of its 52 findings (48%) from agentic testing, with the combined approach increasing coverage by about 93% over DAST-only findings.
- • Invicti reported a combined cost of approximately $346 for the four assessments under introductory pricing through December 31, 2026, versus a directional $8,000 list-price comparison implied by Doyensec's $4,000 tiers.
- • The benchmark is self-published and directional only: Invicti's findings were auto-validated internally, while Aikido and XBOW findings were validated by Doyensec in an Aikido-sponsored study.
Summary
Invicti, an application security company focused on dynamic application security testing (DAST) and AI-powered penetration testing, has published benchmark results positioning its Agentic Pentest product as a leading agentic pentesting solution, according to a press release dated October 24, 2026. The research was conducted by the Invicti Security Research Team between September 27 and 28, 2026, using the same Fider 0.33.0 and Photoview 2.4.0 versions examined in an earlier Doyensec study of Aikido and XBOW.
Invicti reported 52 unique, verified vulnerabilities across four assessments combining black-box and source-assisted testing. This compares with 49 findings validated by Doyensec for Aikido and 31 for XBOW. In the narrower Fider source-assisted assessment, Invicti identified 24 true positives, matching XBOW's reported 24 and exceeding Aikido's 17. In a controlled two-user Photoview assessment, Invicti confirmed 18 vulnerabilities, including one Critical SQL injection and three High-severity authorization or session findings.
The company highlighted speed and evidence quality. Its Fider and Photoview source-assisted assessments produced reports in 46 and 50 minutes, respectively, while Doyensec recorded roughly eight hours and 40 minutes for Aikido's Fider assessment and under eight hours for Photoview. XBOW's timelines extended across multiple calendar days. All 42 true-positive findings in the selected source-assisted runs included HTTP request-and-response evidence, 31 included explicit reproduction steps, and 30 linked to source files. Invicti attributed 27 findings (52%) to DAST and 25 (48%) to agentic testing, stating that the combined approach increased finding coverage by about 93% over DAST-attributed findings alone.
On cost, Invicti reported approximately $346 combined for the four assessments under introductory pricing available through December 31, 2026. Doyensec's study selected $4,000 pricing tiers for both Aikido and XBOW, which implies a directional list-price comparison of $8,000 per competing vendor, though the release notes that actual charges and pricing structures were not equivalent.
The release itself cautions that differences in testing environments and validation methodologies make the comparisons directional rather than a controlled head-to-head evaluation. Invicti's findings were measured locally and auto-validated without an external reviewer, while the Aikido and XBOW results were independently validated by Doyensec in an Aikido-sponsored study. The figures should therefore be read as vendor-reported results rather than an independent uniform ranking of the three products.
Invicti reported 52 unique, verified vulnerabilities across four assessments combining black-box and source-assisted testing. This compares with 49 findings validated by Doyensec for Aikido and 31 for XBOW. In the narrower Fider source-assisted assessment, Invicti identified 24 true positives, matching XBOW's reported 24 and exceeding Aikido's 17. In a controlled two-user Photoview assessment, Invicti confirmed 18 vulnerabilities, including one Critical SQL injection and three High-severity authorization or session findings.
The company highlighted speed and evidence quality. Its Fider and Photoview source-assisted assessments produced reports in 46 and 50 minutes, respectively, while Doyensec recorded roughly eight hours and 40 minutes for Aikido's Fider assessment and under eight hours for Photoview. XBOW's timelines extended across multiple calendar days. All 42 true-positive findings in the selected source-assisted runs included HTTP request-and-response evidence, 31 included explicit reproduction steps, and 30 linked to source files. Invicti attributed 27 findings (52%) to DAST and 25 (48%) to agentic testing, stating that the combined approach increased finding coverage by about 93% over DAST-attributed findings alone.
On cost, Invicti reported approximately $346 combined for the four assessments under introductory pricing available through December 31, 2026. Doyensec's study selected $4,000 pricing tiers for both Aikido and XBOW, which implies a directional list-price comparison of $8,000 per competing vendor, though the release notes that actual charges and pricing structures were not equivalent.
The release itself cautions that differences in testing environments and validation methodologies make the comparisons directional rather than a controlled head-to-head evaluation. Invicti's findings were measured locally and auto-validated without an external reviewer, while the Aikido and XBOW results were independently validated by Doyensec in an Aikido-sponsored study. The figures should therefore be read as vendor-reported results rather than an independent uniform ranking of the three products.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.