Intruder

Intruder is a cloud-based continuous vulnerability scanner that monitors your external attack surface for security weaknesses. It runs 140,000+ checks against web applications, APIs, cloud infrastructure, and network services.

Founded in 2015 and selected for the GCHQ Cyber Accelerator, Intruder now serves 3,000+ customers. It has a 4.8/5 rating on G2 from 154 reviews.

What is Intruder?

Intruder scans internet-facing systems for vulnerabilities on a continuous basis. When your infrastructure changes or a new threat emerges, it triggers scans automatically.

No manual scheduling required.

The Verizon 2024 Data Breach Investigations Report found that vulnerability exploitation as an initial access vector grew significantly year over year, reinforcing the need for continuous scanning of internet-facing assets.

The platform differs from traditional DAST tools in scope. Where most DAST scanners focus on web application logic (XSS, SQLi, authentication flaws), Intruder covers the broader attack surface: exposed ports, misconfigured services, outdated software, and cloud misconfigurations alongside web application vulnerabilities.

What are Intruder’s key features?

How much does Intruder cost?

Intruder offers four tiers, all with 5 infrastructure licenses included:

• Essential — 1 scheduled scan, unlimited ad hoc scans, enhanced risk data, unlimited users
• Cloud — Unlimited scheduled scans, emerging threat scans, GregAI analyst, up to 3 cloud accounts, advanced analytics, role-based access, 15+ integrations
• Pro — Internal target scanning, up to 10 cloud accounts, mass deployment options
• Enterprise — Unlimited cloud accounts, 1000+ checks, attack surface visibility, advanced access control

Pricing is based on a base fee plus a per-target fee, calculated dynamically on Intruder’s pricing page .

All plans include a 14-day free trial with Cloud plan features.

What you actually pay scales with two variables: the number of infrastructure licenses (each license covers one target IP, hostname, or URL) and the plan tier. Vanguard, the highest tier, layers managed pentesting on top of automated scanning — useful when you want hybrid coverage without staffing an internal pentest team.

Web application scanning is included on Cloud and above, but the depth is shallower than dedicated DAST tools like Acunetix or Invicti . I treat Intruder as an attack-surface and continuous-vulnerability scanner first, with web application scanning as a bonus layer rather than the primary capability — pair it with a dedicated DAST when you need authenticated SPA testing or business-logic coverage.

What does Intruder integrate with?

Cloud Providers

AWS

Azure

Google Cloud

DevOps & Communication

GitHub

GitLab

Azure DevOps

CircleCI

Slack

Microsoft Teams

Jira

PagerDuty

Identity & Security

Okta

Auth0

Cloudflare

How do I get started with Intruder?

API Access

The Intruder API lets you manage targets, trigger scans, and retrieve results programmatically. Available on Pro, Premium, and Vanguard plans.

# Trigger a scan via the Intruder API
curl -X POST "https://api.intruder.io/v1/scans" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target_id": "target_123"}'

When to Use Intruder

Intruder works well for small to mid-sized organizations that need continuous attack surface monitoring without a dedicated security team. The cloud connectors and automated scanning mean less manual work for teams with cloud-native infrastructure.

It covers the gap between traditional vulnerability management (Qualys, Nessus) and application-specific DAST tools. If your primary concern is “what’s exposed on the internet and is it vulnerable,” Intruder answers that question.

For deep web application security testing of complex SPAs, authenticated workflows, or API business logic, you will need a complementary tool like Acunetix or Invicti .

Intruder itself acknowledges this positioning: it scans your perimeter, not the inner workings of your applications. For help choosing the right approach, see the what is DAST guide.

What are alternatives to Intruder?

If Intruder’s external-attack-surface focus or pricing model does not fit, these are the alternatives I’d weigh in the DAST tools landscape :

• Detectify — Closest peer in the crowdsourced-DAST + EASM space. 1,765+ vulnerability modules from 400+ ethical hackers, plus External Attack Surface Management. Better fit when crowdsourced research depth matters more than continuous infra scanning.
• Probely — Now part of Snyk DAST , Probely is developer-focused DAST with strong API coverage and OpenAPI support. Worth evaluating when you want DAST tied to existing Snyk SAST/SCA workflows rather than a standalone scanner.
• Acunetix — Standalone DAST scanner with proof-based verification, 7,000+ vulnerability checks, and IAST sensor support for .NET, Java, PHP, and Node.js. Stronger choice when web application depth matters more than ASM coverage.
• Pentest-Tools.com — On-demand vulnerability scanning with a published per-scan and subscription pricing page. Better when you want pay-as-you-go pentest tooling rather than continuous monitoring.
• Qualys WAS — Enterprise web app scanning from a vendor your operations team likely already uses for vulnerability management. Lower friction when Qualys is the incumbent platform.

Frequently Asked Questions