License: Acunetix

"Exactly. Acunetix changed their EULA last year. You just can't exceed the concurrent scan limit. Stored targets are fine."

Mark logged into the Acunetix portal. He stared at the dashboard: Active License: 25 Targets.

Twenty-five. He now had forty-three public-facing apps, plus internal dev tools. acunetix license

He clicked through the licensing tiers. Acunetix didn’t charge by user or by scan—it charged by Target . A "Target" was a single domain, IP, or OpenAPI definition. If a single web app had three subdomains (api, admin, shop), that was three targets.

The next morning, Mark discovered that the critical PCI-DSS scan for their payment gateway had never run. The compliance report was due in 48 hours. "Exactly

He also discovered a hidden feature in their Enterprise license— Scan Pooling . By reconfiguring, he could share licenses across two on-premises engines, effectively giving him 50 concurrent scans for the price of 25, as long as the total active didn't exceed the cap.

Panic set in.

For three years, he had relied on Acunetix (now part of Invicti) to scan their sprawling web applications. The automated crawler was a beast—it found SQLi vulnerabilities in legacy code that other scanners missed. But the licensing model was a labyrinth.