How to Integrate Acunetix with CI/CD Pipelines for DevSecOps

Why Shift Security Left with Acunetix

Fixing a bug in production costs 100 times more than fixing it in code review. Acunetix in CI/CD catches flaws early.

• Scans every pull request automatically.
• Fails build only on High or Critical issues.
• Posts fix suggestions directly in GitHub comments.
• Tracks vulnerability trends across sprints.

1. Prepare Your Acunetix Instance

You need a running Acunetix server: cloud or on-prem.

• Log in to dashboard.
• Go to Targets > Add Target > enter your staging URL.
• Run a manual scan once to verify connectivity.
• Note the Target ID from the URL: https://cloud.acunetix.com/target/abc123

2. Install Acunetix CLI

The CLI is a single binary. No dependencies.

• Download from Acunetix portal under Tools > CLI.
• Linux: wget https://downloads.acunetix.com/cli/linux/acunetix-cli
• Make executable: chmod +x acunetix-cli
• Test: ./acunetix-cli --version

3. API Key and Authentication

Secure your pipeline with an API key.

• Profile > API Key > Generate New Key.
• Copy the 64-character token.
• Store in CI secrets: ACUNETIX_API_KEY
• Store base URL: ACUNETIX_BASE_URL=https://cloud.acunetix.com

4. GitHub Actions Integration

Add this to .github/workflows/security.yml:

name: Acunetix Security Scan

on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Download Acunetix CLI
        run: wget -O acunetix-cli https://downloads.acunetix.com/cli/linux/acunetix-cli && chmod +x acunetix-cli

      - name: Start Scan
        env:
          ACUNETIX_API_KEY: ${{ secrets.ACUNETIX_API_KEY }}
          ACUNETIX_BASE_URL: ${{ secrets.ACUNETIX_BASE_URL }}
        run: |
          ./acunetix-cli scan start \
            --target-id abc123 \
            --profile Full \
            --scan-id-variable SCAN_ID

      - name: Wait for Completion
        run: ./acunetix-cli scan wait --scan-id $SCAN_ID

      - name: Check Results
        run: |
          ./acunetix-cli scan results --scan-id $SCAN_ID --format json > results.json
          CRITICAL=$(jq '.vulnerabilities[] | select(.severity == "Critical") | .id' results.json | wc -l)
          if [ $CRITICAL -gt 0 ]; then
            echo "Critical issues found. Failing build."
            exit 1
          fi

5. GitLab CI Pipeline

Create .gitlab-ci.yml:

stages:
  - security

acunetix_scan:
  stage: security
  image: curlimages/curl
  script:
    - curl -L -o acunetix-cli https://downloads.acunetix.com/cli/linux/acunetix-cli
    - chmod +x acunetix-cli
    - ./acunetix-cli login --api-key $ACUNETIX_API_KEY --base-url $ACUNETIX_BASE_URL
    - SCAN_ID=$(./acunetix-cli scan start --target-id abc123 --profile Full --output json | jq -r '.scan_id')
    - ./acunetix-cli scan wait --scan-id $SCAN_ID
    - ./acunetix-cli scan results --scan-id $SCAN_ID --severity High,Critical --fail
  only:
    - merge_requests

6. Jenkins Declarative Pipeline

Use this in Jenkinsfile:

pipeline {
    agent any
    stages {
        stage('Acunetix Scan') {
            steps {
                sh '''
                wget -O acunetix-cli https://downloads.acunetix.com/cli/linux/acunetix-cli
                chmod +x acunetix-cli
                ./acunetix-cli login --api-key ${ACUNETIX_API_KEY} --base-url ${ACUNETIX_BASE_URL}
                SCAN_ID=$(./acunetix-cli scan start --target-id abc123 --profile Full --output json | jq -r '.scan_id')
                ./acunetix-cli scan wait --scan-id $SCAN_ID
                ./acunetix-cli scan results --scan-id $SCAN_ID --severity Critical --fail
                '''
            }
        }
    }
}

7. Azure DevOps YAML

Add to azure-pipelines.yml:

trigger:
- main

pool:
  vmImage: 'ubuntu-latest'

steps:
- script: |
    curl -L -o acunetix-cli https://downloads.acunetix.com/cli/linux/acunetix-cli
    chmod +x acunetix-cli
    ./acunetix-cli login --api-key $(ACUNETIX_API_KEY) --base-url $(ACUNETIX_BASE_URL)
    SCAN_ID=$(./acunetix-cli scan start --target-id abc123 --profile Full --output json | jq -r '.scan_id')
    ./acunetix-cli scan wait --scan-id $SCAN_ID
    ./acunetix-cli scan results --scan-id $SCAN_ID --severity High,Critical --fail
  displayName: 'Run Acunetix Scan'

8. Fail Fast on Critical Issues

Only block the pipeline on real risks.

• Use --severity High,Critical flag.
• Exit code 1 = fail build.
• Allow Medium/Low to pass with warning comment.
• Custom thresholds per project: fintech = Critical only, marketing site = High+.

9. Auto-Post Reports to PRs

Let developers see issues without leaving GitHub.

• Generate HTML report: --format html > report.html
• Upload as artifact in pipeline.
• Use GitHub API to comment: curl -H "Authorization: token $GH_TOKEN" ...
• Include direct link to Acunetix dashboard.

10. Incremental and Full Scans

Save time in daily builds.

• Full scan: weekly on Sunday night.
• Incremental: every PR, only new/changed endpoints.
• Use --incremental flag with last scan ID.
• Cache crawl data between runs.

CI/CD Tools vs Acunetix Support

Table uses inline CSS: border: 1px solid #000; padding: 8px; on every cell + border-collapse: collapse;

Conclusion

Integrating Acunetix into your CI/CD pipeline is not a nice-to-have. It is the difference between shipping secure code and shipping regrets. Start with one repository today. Use the GitHub Actions example. Watch the first scan run. See the build fail on a real SQL injection. Fix it in five minutes. Then scale to every team in Pune. Your customers will sleep better. Your compliance team will stop nagging. And you will finally go home at 6 PM, knowing the next deploy is safe.