TruffleHog vs Invicti

Free tier available

Quote on request

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Enterprise licensing by number of target sites or applications.

Open-source CLI is free and fully functional including verification.

Demo and trial on request.

Widely used

Truffle Security · since 2016

Established

Invicti Security · since 2009

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Proof-based scanning eliminates most false-positive triage, which is the main cost of DAST.
• Handles authenticated scanning of modern JavaScript applications well.
• Good asset discovery for organisations that do not know all their own sites.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

• Expensive relative to free DAST alternatives.
• Scans take time and are not suited to per-commit feedback.
• Dynamic testing alone cannot find everything a code review would.

Teams that want free, high-signal secret scanning in the pipeline today.

Organisations with many web applications and no capacity to triage scanner noise.