Fix vulnerabilities faster with Invicti’s 2-way Jira integration
Building vulnerability management into your development pipeline is a must when doing security testing in agile workflows. Ideally, developers should get security-related tickets directly into their existing issue tracker, resolve them, and get on with their work. Invicti’s bidirectional integration with Jira helps you cut down on communication overhead and streamline issue resolution.
Your Information will be kept private.
Stay up to date on web security trends
Your Information will be kept private.

The need to integrate security testing into the SDLC
Agile methodologies have become the norm in software development, allowing developers to release continuous incremental updates every 2–3 weeks. Unlike traditional waterfall models, this development process is a continuous cycle of planning, designing, developing, testing, and deployment. This leaves little to no time to order separate security testing, wait for the results, fix vulnerabilities, and retest. Trying to combine agile development with a waterfall approach to security testing makes application security a major bottleneck. When vulnerabilities are identified, the entire streamlined process has to stop and wait until developers fix the issues. This halt causes delays in releasing new features and products, often costing the company money. The inefficiencies of bolt-on security testing can lead to security being regarded as a burden and extra cost rather than a critical asset. Nevertheless, with data breaches and other cyberattacks now acknowledged as a major business risk, turning a blind eye to vulnerabilities is no longer a viable option. A critical vulnerability may let attackers siphon millions of dollars from a company, and such an attack can also lead to a legal investigation and result in loss of confidence among customers. As recent events have shown, cyberattacks can even have widespread economic and political consequences.Approaches to building security into development
While code-level security testing based on static analysis (SAST) typically provides feedback directly in the developer’s IDE, delivering vulnerability reports from dynamic testing (DAST) is a bit more complicated. Developers organize their work using issue trackers, so any vulnerability that needs fixing must be turned into an actionable ticket in their existing system. If this is done manually by security engineers, managing vulnerability tickets (creating, assigning, monitoring, verifying fixes, reopening, closing, etc.) adds a lot of extra work for everyone. If tickets are created automatically, for example by a vulnerability scanner, you need two things: accurate results (so your developers are fixing real issues) and a way to integrate the scanner with the issue tracker. For Invicti, this means integrating with a vast array of development and collaboration platforms out of the box and using Proof-Based Scanning to deliver accurate, detailed, automatically verified reports for the majority of direct-impact vulnerabilities. In the case of Jira, Invicti provides bidirectional (two-way) integration, meaning that it can both send vulnerability data to the tracker and receive developer feedback about the fixing process. This includes the option to automatically test fixes before closing a ticket and releasing code to staging or production. With minimal setup, you can embed vulnerability scanning into your Jira-based development pipeline to ensure that security issues are reported and fixed without delay.Setting up Jira integration in Invicti Enterprise
Bidirectional integration lets your developers work on vulnerabilities reported by Invicti without leaving their familiar Jira environment. Setting this up consists of 3 simple steps:- Integrate Invicti Enterprise with Jira
- Automate vulnerability export to Jira
- Register a webhook to synchronize the whole issue resolution process
Jira integration in action
To illustrate the process of reporting and remediating vulnerabilities, we set up Jira integration and ran a vulnerability scan onphp.testsparker.com
– one of Invicti’s vulnerable test sites. Among other issues found during the scan, Invicti identified a programming error message vulnerability and automatically exported a Jira ticket for it. Here is the vulnerability as seen in Jira:
Once all the reported vulnerabilities have been triaged, the issue will be assigned to a specific developer, who can start fixing it. (Note that, depending on your workflow, it is also possible to automatically assign issues to specific users.) After fixing the vulnerability, the developer changes the ticket status to Done:
Thanks to bidirectional integration, Invicti Enterprise will be notified about the fix and will schedule an automatic rescan to test if the fix works:
If the vulnerability is still present after the rescan, the Jira ticket status will be changed to Reopen instead To Do or In Progress. If the vulnerability is not identified again, the Done status will remain.
For retesting, Invicti Enterprise will not run all security checks, just the security check needed to see whether the same vulnerability can be identified in the same place.