Invicti ASPM combines Invicti’s proof-based DAST with Kondukto’s security orchestration.

Unlike typical ASPM tools that struggle with false positives, Invicti ASPM uses proof-based scanning to safely validate exploitability before flagging issues—delivering 99.98% accuracy.

Key Capabilities

Feature	Description
Proof-Based Scanning	DAST engine validates exploitability before flagging issues, eliminating false positives
Deduplication	Normalizes and deduplicates findings across all tools with suppression rules
SBOM Radar	Tracks component vulnerabilities, license risks, and alerts for newly vulnerable dependencies
Fix Rescanning	Auto-verifies fixes: rescan → close ticket if fixed, reopen if not
Developer Training	SecureCodeWarrior videos embedded in findings for in-context learning

CLI Tool (KDT)

Install via curl or download from GitHub:

curl -sSL https://cli.kondukto.io | sh
export INVICTI_ASPM_HOST=https://your-instance.invicti.com
export INVICTI_ASPM_TOKEN=your_api_token

Command	Description
`kdt scan -p Project -t semgrep -b main`	Trigger scan
`kdt scan ... --threshold-crit 0 --threshold-high 5`	With thresholds
`kdt scan ... -f results.json`	Import results from file
`kdt scan ... --async`	Non-blocking scan
`kdt scan ... --image myapp:latest`	Container scan
`kdt release -p Project -b main --sast --sca`	Check release criteria
`kdt sbom import -f sbom.json -p Project -b main`	Import SBOM

GitHub Actions Example

- name: Security Scan
  env:
    INVICTI_ASPM_HOST: ${{ secrets.INVICTI_ASPM_HOST }}
    INVICTI_ASPM_TOKEN: ${{ secrets.INVICTI_ASPM_TOKEN }}
  run: |
    curl -sSL https://cli.kondukto.io | sh
    kdt scan -p ${{ github.repository }} -t semgrep -b ${{ github.ref_name }} --threshold-crit 0

Exit codes: 0 success, 1 error, 100 unauthorized, 255 threshold exceeded.

Deployment

Option	Specs
Cloud (SaaS)	Fully managed, no infrastructure
On-Premise (PoC)	4 cores, 16GB RAM, 90GB disk
On-Premise (Prod)	8 cores, 64GB RAM, 250GB disk
Distributed	App: 4c/64GB, DB: 8c/64GB (MongoDB 5+)

When to Choose

Best For	Consider Alternatives If
Multiple tools with duplicate findings	Only need basic aggregation (DefectDojo)
Teams frustrated by DAST false positives	Budget requires open-source
Proof of exploitability for compliance	Single scanner, no orchestration needs
DevSecOps automation & SBOM tracking

History

Invicti acquired Kondukto in August 2025, combining Invicti’s 15+ years in proof-based DAST with Kondukto’s ASPM orchestration expertise.

The platform represents their vision: 100% signal, 0% noise.

Note: Formed from Invicti's acquisition of Kondukto in August 2025. Combines Invicti's proof-based DAST with Kondukto's ASPM orchestration.