Where this offering fits
DAST evaluates a running application through the access and test scope provided. Invicti’s DAST offering should be compared against your web and API estate, authentication and safe testing requirements. A reachable homepage does not establish coverage of authenticated or less frequent business workflows.
Architecture and rollout decisions
Agree targets, test accounts and exclusions in writing. Pilot representative authenticated functions using approved data. Review findings with developers and preserve the path needed to reproduce them safely. Production scanning requires authorised rates, timing and stop conditions; testing rights do not extend automatically to third-party systems linked from the application.
An evaluation scenario for this offering
Use a staged application with synthetic users at two permission levels and a short list of approved authenticated journeys. Give the DAST evaluation the supported access required for that scope. Include a session-expiry case and a function that is intentionally excluded from testing. Review which paths were actually exercised and whether the resulting finding can be understood by its developer. After an approved correction, repeat the relevant assessment. Acceptance should retain the authentication context, exclusions and retest evidence. A successful scan of the login page should not be treated as coverage of the workflows available after login.
Evidence to request for this scope
- Confirm authentication and API coverage requirements.
- Validate a known finding and its retest.
- Record excluded paths and operational constraints.