A web application scanner can only test a web page or API endpoint for vulnerabilities if it can access the asset. Legacy vulnerability scanners that were originally designed to test public-facing and mostly static pages will return very limited results for business-critical applications and websites that require authentication – and nothing at all for API endpoints. Automatic authentication is a critical capability for advanced scanning solutions such as Invicti that are able to access and thoroughly test modern web apps and APIs.
Read more about the importance of authenticated vulnerability scanning