Intruder

Intruder is a cloud-based vulnerability management platform built around continuous scanning of an organisation's internet-facing estate. Rather than selling a testing engagement, it sells ongoing visibility: you add targets — domains, IP addresses, web applications, APIs and cloud accounts — and the platform keeps scanning them, tells you what changed, and prioritises what actually matters. Its natural buyer is an engineering or DevOps team that has to own security without a dedicated security department behind it.

What Intruder actually is

It helps to separate the three things Intruder documents, because buyers frequently collapse them into "a scanner":

• Continuous vulnerability scanning: recurring authenticated and unauthenticated scanning of infrastructure, web applications and APIs, with results presented as prioritised issues rather than a raw scanner dump.
• External attack surface management: discovery of the internet-facing assets attached to your domains and cloud accounts — including subdomains and services you may not have known were exposed — so scanning covers what exists rather than what someone remembered to add.
• Emerging threat response: when a significant new vulnerability becomes public, Intruder documents proactively scanning customer targets for it rather than waiting for the next scheduled cycle.

That combination is the product's actual argument. A scanner tells you about the assets you point it at; attack-surface discovery tells you which assets you forgot. Most real-world exposure sits in the second category.

Key capabilities

• Continuous scanning of external infrastructure, with internal and authenticated scanning options documented.
• Web application and API scanning alongside network-layer checks.
• Attack-surface discovery and monitoring for newly exposed services and subdomains.
• Cloud connectors for major providers so new infrastructure is picked up as it appears.
• Issue prioritisation with remediation guidance, rather than an unranked CVE list.
• Downloadable reports intended for auditors, customers and internal stakeholders.
• Integrations documented for developer and alerting workflows — including Slack, Microsoft Teams, Jira and webhooks — plus an API for custom pipelines.
• Higher tiers documented as adding human-led testing support on top of automated scanning.

Deployment model and typical business size

Intruder is a SaaS platform: you sign in to a hosted portal, add targets, and scanning runs from Intruder's infrastructure. Internal scanning is documented as available via an agent or scanning appliance model, so on-premise-only deployment is not the shape of this product. Self-serve signup means a small team can be scanning the same day, which is a meaningful difference from platforms that require a sales cycle first.

In practice the sweet spot is a company with somewhere between a handful and a few hundred external assets: large enough that manual tracking has broken down, small enough that a full enterprise exposure-management programme would be over-buying.

Compliance support

Intruder's documentation positions its reporting as evidence for compliance programmes — SOC 2 and ISO 27001 are the frameworks most commonly cited by its own material, alongside customer security questionnaires. Read that the way we read every vendor's compliance page: the platform produces evidence supporting a control, it does not certify you against a framework. Your auditor decides whether the artefact satisfies your scope.

Pricing

Intruder publishes tiered plans with pricing that scales by the number of targets and applications in scope, with higher tiers unlocking additional scanning depth and human-led testing support. We deliberately do not reproduce figures here: per-target pricing changes, varies by scope and by tier, and a stale number in a review is worse than no number. Confirm the current position on Intruder's own pricing page, and price the number of assets you actually expect to have in twelve months rather than today.

Support

Support is documented as in-product and email-based, with the higher plans adding closer access to Intruder's security team and human-led testing input. We have not tested response times and do not publish a claim about them.

Strengths

• Continuous scanning plus attack-surface discovery in one subscription.
• Self-serve onboarding — a technical team can be scanning without a sales process.
• Findings arrive prioritised with remediation guidance rather than as raw scanner output.
• Emerging-threat scanning closes the window between disclosure and the next scheduled scan.
• Integrations and an API make findings actionable inside existing engineering workflows.
• Reporting is aimed at the audit and questionnaire use case, not just at engineers.

Limitations

• Automated scanning with human review is not the same as a deeply scoped manual engagement.
• Per-target pricing means cost tracks estate growth — model it before committing.
• No endpoint protection, dark web monitoring or awareness training: this is one layer, not a suite.
• Internal network validation is not the product's centre of gravity.
• Not a managed service — someone on your side still has to remediate.

Ideal customer

A twenty-to-three-hundred-person technology business with a cloud estate, no dedicated security hire, an engineering team willing to act on findings, and at least one external party — auditor, enterprise customer or insurer — asking for evidence that vulnerabilities are being found and fixed.

The Tool Money Lab verdict

Alternatives to Intruder

These are the platforms buyers most often shortlist alongside Intruder. Cards activate automatically once the relevant TTML review is published.

Where Intruder fits in our wider coverage

Intruder sits in the assurance layer of a business security stack, not the endpoint layer. If you are assembling that stack, start with our best business security software guide, then cover devices with the best antivirus software shortlist and credentials with best password managers. Network-layer options sit in best VPN tools, the full catalogue under privacy & security, and the software glossary defines the vulnerability-management and compliance terms used above. For a direct head-to-head, read CyberSuite vs Intruder.