Integrate Arachni with Vulnetix. Run Arachni scans via the CLI or web UI and export findings in JSON format for upload to Vulnetix.
How Vulnetix compares: better together
Vulnetix does not replace Arachni. Keep running it. Vulnetix sits on top of Arachni (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Arachni is strongest at its core category and also carries features in Pentest, Bug Bounty & Vulnerability Disclosure, just as Vulnetix spans categories.
| Capability | Vulnetix | Arachni |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✓ Core: crawling + active audit of web apps with headless-browser JS/DOM analysis and a broad injection/XSS/CSRF check set. |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ~ Framework positioned for vuln assessment and pen-testing workflows, but automated scanning only, no manual/bug-bounty service. |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Arachni does well
- Mature open-source Ruby DAST framework with an integrated real-browser environment (headless) to audit JavaScript/AJAX/DOM-heavy apps, not just static HTML
- Large built-in check library covering XSS (including DOM/AJAX variants), SQL/NoSQL/command injection, CSRF, path traversal, XXE and more
- Flexible operation modes: CLI, Web UI, and a REST API, plus distributed/multi-instance scanning for large targets
- Strong authentication and session handling (login scripts, cookies, custom headers) for scanning authenticated areas
Where Vulnetix adds to it: Vulnetix ingests and orchestrates Arachni's DAST findings into its cross-scanner queue, it does not run dynamic web scans itself. Arachni is effectively end-of-life (active development stopped at v1.6.1.3 in May 2022, redirected to the commercial successor Ecsypno SCNR / Spectre Scan), so Vulnetix's exploit-intel prioritisation (EPSS/KEV/LEV), reachability, versioned VEX and Safe Harbour autofix add the modern triage and remediation layer Arachni never had, and can consolidate output from a maintained DAST alongside it.
No migration, no rip-and-replace. Arachni keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Arachni results in Vulnetix
Upload Arachni JSON, XML, HTML output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.