true-positives.com

What It Is

True Positives positions itself as a provider of application security testing solutions. The page explicitly states that its offering is powered by Invicti DAST and promotes the message “Stronger AppSec. Smarter Spending.” Based on the captured page content, this is not a general-purpose cybersecurity platform, but a solution focused on Application Security Testing, especially Dynamic Application Security Testing (DAST) scenarios.

Core Capabilities and Deployment Model

Its core offering appears to follow two paths: first, a fully managed service, suited to organizations that want expert-led coverage without taking on the operational overhead of running security testing in-house; and second, direct platform licensing, intended for customers with existing security teams who want to use the Invicti platform themselves. The page does not disclose specific details about scanning capabilities, asset management, vulnerability validation, reporting, alerts, permissions, CI/CD integrations, or API capabilities, so these areas cannot be further verified.

Pricing and Compliance

The page only conveys the idea of “Smarter Spending” and notes the two purchasing paths of managed service and platform licensing. It does not publish pricing, billing units, plans, trials, or contract terms. No compliance certifications such as SOC 2, ISO 27001, GDPR, or HIPAA are mentioned either. Before procurement, buyers should confirm the vendor’s service delivery model, data handling practices, and compliance boundaries.

Pros and Cons

The main advantage is that its technical foundation is clearly tied to Invicti DAST, making it relevant for dynamic security testing of web applications and related interfaces. It also offers both managed and licensed models, covering both customers that lack internal AppSec staffing and those with established security teams. The downside is that public information is very limited, making it difficult to assess deployment options, false-positive management, alert remediation workflows, integration ecosystem, service SLAs, support scope, or the actual total cost of ownership.

Who It’s For and Access from China

It is best suited to small, mid-sized, and larger organizations that need application security testing capabilities and want flexibility between self-operated and outsourced managed approaches. The page does not disclose information about access from mainland China, payment methods, or local service availability, so these should be treated as unknown. If access, compliance, or procurement processes are constrained, buyers may want to compare it with Invicti, Burp Suite Enterprise, Acunetix, Checkmarx, Veracode, as well as domestic application security testing vendors in China.