Migrating from Invicti to middleBrick

Begin by exporting findings and configuration from Invicti. Use the built-in reports to generate CSV or PDF files for historical scans. Export scan summaries, risk ratings, and individual vulnerability entries. Keep the export timestamps and scanner version to support later cross-reference during migration.

middleBrick does not ingest Invicti scan files. Instead, re-run scans against the same API endpoints to rebuild history. For each environment, run a scan with the same parameters (authentication, headers, depth) and schedule at comparable cadence. Record scan IDs and timestamps in an inventory sheet to map findings over time. Use the CLI in scripts to automate this and preserve repeatable commands for audit trails.

To avoid CI breaks, transition checks gradually. Add the middleBrick GitHub Action in parallel but set it to warn without failing the build. Use the same severity thresholds initially, then tighten them once baseline alignment is confirmed. Keep the legacy Invictit step active until the new action produces stable, expected results across multiple branches.

npx middlebrick scan https://api.example.com --threshold B --output json

You will lose direct integration with Invicti’s on-prem console and passive-only authenticated crawls. middleBrick does not perform active exploit attempts such as SQL injection or command injection, and it does not crawl JavaScript-heavy SPAs automatically. In return, you gain a cloud-agnostic scanner with a consistent interface across languages and frameworks, sub-minute scan times, and clear mappings to OWASP API Top 10. The tool emphasizes read-only checks and does not modify any endpoint, reducing test risk in production-like environments.

Coordinate with security and DevOps to schedule a freeze window for re-authentication setup. Verify domain ownership for credentialed scans via DNS TXT or well-known challenge files. Assign owners for each API inventory entry to map Invicti asset IDs to middleBrick scan targets. Run a pilot on a low-risk API, compare outputs, and finalize reporting templates and alerting rules before full rollout.