What we believe Invicti’s IDC MarketScape recognition says about the future of DAST

The report states: “IDC does not limit the evaluation to a single DAST architecture or testing approach. The defining criterion is the solution's core function: detecting vulnerabilities by analyzing the behavior of a running application. Solutions may accomplish this through traditional external black box scanning, instrumentation within the application runtime, AI agents that adapt testing based on application responses, or a combination of these methods.”

For Invicti, that view of DAST is significant because it closely tracks a product direction we have pursued for years. Our DAST-first strategy has never meant treating dynamic testing as the only AppSec technique – it means using evidence from the running application as a foundation for connecting security testing, validation, prioritization, and remediation.

DAST has grown beyond the vulnerability scanner

Conventional DAST is easy to visualize: crawl a running web application, submit attack payloads, analyze the responses, and identify known vulnerability patterns. Those fundamentals still matter, and getting them right is still important, since repeatable automated testing is what allows organizations to assess hundreds or thousands of applications in a continuous process. But starting from that core, modern DAST has expanded.

Increasingly, the defining question for DAST is less about how a scanner is implemented and more about what security teams can learn by exercising an application in its running state.

For Invicti, this reinforces the long-standing strategic premise that DAST can and should be more than another scanner feeding another collection of alerts. Runtime behavior can provide evidence about how assembled applications actually behave, and that evidence can help security teams make better decisions across AppSec.

AI-generated software makes runtime evidence more valuable

The timing of this industry shift is no accident.

According to the IDC MarketScape report, “IDC research finds that 90% are piloting or have adopted AI coding tools and nearly three-quarters agree that these tools raise the risk that developers merge code they do not fully understand, even when scans pass (source: IDC’s DevSecOps and Software Supply Chain Security Survey, July 2026). Further, this same survey found that 48% of organizations using AI coding tools reported either a moderate or a significant increase in security issues reaching production. As security issues increasingly reach production, DAST provides an essential backstop by testing applications as they run and exposing weaknesses and behaviors that may escape manual review and earlier-stage scanning.” As IDC MarketScape puts it:

“Code is moving into production faster and with less scrutiny, and applications themselves are becoming more nondeterministic, making runtime testing more critical than it has been in the past.”
– Katie Norton, Research Director, Cloud Security, IDC; IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment

Testing at earlier stages still remains essential. Static application security testing (SAST), software composition analysis (SCA), secrets scanning, and other pre-runtime controls complement dynamic testing, each bringing strengths suited to different types of analysis and stages of development. Finding issues earlier also gives development teams the opportunity to remediate them faster and at lower cost, before they reach a running application.

But as the speed and volume of software creation increase, there is growing value in runtime checks that answer the question that matters most for security in production: What does the assembled application actually do when exercised?

The report notes: “As security issues increasingly reach production, DAST provides an essential backstop by testing applications as they run and exposing weaknesses and behaviors that may escape manual review and earlier-stage scanning.”

Runtime evidence makes findings more useful

Flagging a potential vulnerability and demonstrating that it can be exploited in a running application provide different levels of security evidence. Exploitability confirmation can give teams greater confidence to prioritize and act without first reproducing the issue manually.

Invicti was recognized for the following strengths in the IDC MarketScape report:

• Exploitability validation through proof-based scanning: Rather than reporting a candidate vulnerability, Invicti’s engine executes a nondestructive follow-on payload to retrieve verifiable evidence, such as a database version or system output, and tags confirmed findings distinctly from unconfirmed ones. This feature provides teams with a basis for prioritizing remediation without routing every finding to a security team for manual confirmation.
• AI-assisted business logic and abuse case testing without predefined scripts: AI-driven login agent handles authentication, and an AI-assisted form filler supplies contextually valid data, and stateful API scanning infers parameter relationships to catch workflow manipulation and business rule bypass, extending coverage beyond signature-based detection without scripted test cases.
• End-to-end API discovery and testing: Invicti combines multilayer API discovery across scanning, source code, traffic, and eBPF analysis to build an API inventory. AI-enriched schemas add source code context to improve testing depth, while native CI/CD integration automates API security testing throughout the SDLC

The operational effect of evidence reaches far beyond scanner accuracy. Confidence in a finding affects whether security needs to investigate it manually, how urgently it is prioritized, and how readily a development team can act on it.

According to the report, “Customers describe Invicti’s output as trustworthy and largely free of false positives, requiring limited additional triage before a finding reaches a developer. They also cite the platform’s configuration flexibility, such as the ability to scope scans to a specific technology stack, as a strength. They also value the vendor relationship itself, citing direct access to engineering staff, rather than sales contacts, and a responsive technical account team.” 

At an enterprise scale, reducing uncertainty at all levels is a key part of making security testing scalable.

Runtime testing has to follow where applications have gone

The changing architecture of applications is another reason DAST has expanded beyond conventional web scanning.

Important application behavior increasingly spans APIs, authentication states, multistep workflows, and distributed services. Security testing has to follow that behavior rather than stopping at the browser interface. But before testing starts, the test targets need to be defined, which is where Invicti’s multi-layered API discovery helps to connect inventory to security.

These capabilities reflect a broader change in runtime testing. Crawling pages and submitting generic payloads remains a useful capability, but it cannot tell the whole story when the application itself is increasingly a collection of interconnected services, APIs, identities, and workflows.

Modern DAST needs to be API-aware, with enough visibility into application architecture and context to exercise meaningful behavior during testing.

DAST can become the connective tissue of AppSec

No single testing technique can see every type of application risk, which is why a modern AppSec toolkit combines multiple methods. SAST can see vulnerable code before an application runs. SCA identifies risk in third-party and open-source dependencies. Other techniques cover secrets, infrastructure definitions, containers, APIs, and additional parts of the software lifecycle and attack surface.

The challenge for security leaders is turning all those signals into coherent risk-based decisions rather than accumulating another stack of disconnected findings. There are many roads to AppSec consolidation, but we believe Invicti’s DAST-first strategy can provide the shortest and most practical path:

DAST-first does not mean DAST-only. It means grounding a broader AppSec program in evidence about what applications actually do when they run.

The wider Invicti Platform can bring runtime evidence together with signals from source code, dependencies, APIs, infrastructure, and other parts of the software lifecycle. Correlation, reachability, exploitability, business context, and threat intelligence can help turn those signals into risk decisions rather than another collection of scanner outputs.

For example, Invicti’s DAST-to-SAST correlation can connect compatible dynamic findings with relevant source-code paths, bringing runtime evidence and code context together. Application security posture management (ASPM) can help aggregate and deduplicate findings, apply policies, automate workflows, track remediation, and provide a wider view of application risk.

The IDC MarketScape states: “Invicti is well suited to organizations that want a vendor combining an established DAST engine with visible, active investment in where the technology is heading next, and that view this purchase as an early step toward potential broader application security consolidation.”

IDC isn’t the only independent analyst seeing this connection between DAST depth and the broader platform direction. The Latio 2026 Application Security Market Report recognized Invicti as both an Application Security Testing Leader and DAST Innovator, highlighting its DAST-first foundation alongside the wider platform capabilities built around it. 

This approach is where runtime intelligence becomes the connective tissue. Dynamic testing supplies evidence from the running application, while other testing approaches contribute perspectives that DAST alone cannot provide. Bringing those signals together gives security teams a stronger basis for deciding what to investigate, prioritize, and fix.

Agentic pentesting extends the runtime foundation

The next step in this industry evolution is already taking shape as the boundary between automated DAST and autonomous pentesting begins to narrow.

Automated DAST provides the repeatability and scale needed for continuous testing. Agentic systems can add reasoning, which includes responding to what they discover, changing tactics, exploring application state, and pursuing relationships between weaknesses.

The IDC MarketScape describes that relationship directly:

“DAST can provide the foundation for broad coverage and validated evidence, while agentic reasoning enables tools to adapt their techniques and pursue connected attack paths.”
– IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment

That closely matches how we think about agentic pentesting at Invicti. Autonomous reasoning builds on the runtime foundation rather than discarding it. An agent may decide what to try next, but effective testing still depends on the ability to navigate applications, maintain state, exercise inputs, identify weaknesses, and validate what happens.

What we believe it means to be a DAST Leader at a turning point for DAST

The IDC MarketScape evaluates both current capabilities and future strategy. We believe Invicti’s placement in the Leaders Category is important recognition of what we’ve built, including proof-based scanning, AI-assisted business logic testing, and end-to-end API discovery and testing.

For security leaders, finding counts alone are not the goal – they need to understand application risk with enough confidence and context to act on it. That’s the opportunity we see in the next generation of DAST: not as an isolated scanner, but as the runtime foundation for a more connected and increasingly adaptive approach to application security.

To learn more about IDC MarketScape’s evaluation and Invicti’s position in the Leaders Category, read IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Excerpt for Invicti).