Intruder

Overview

Intruder is a vulnerability-scanning service for teams responsible for exposed infrastructure, applications and cloud environments. It suits security and IT teams that need ongoing coverage across several target types and help deciding which findings deserve attention. Its breadth and risk-based prioritization are compelling; the free plan is narrow, and internal scanning starts at Pro.

Key features

Continuous scanning and response

Intruder continuously scans infrastructure, web apps and APIs, then ranks issues by exploit likelihood and real-world threat intelligence. That makes the output more actionable than an undifferentiated list, particularly for teams facing a large backlog. Remediation guidance helps carry findings toward action, though prioritization does not remove the work of resolving them.

Emerging-threat scans check systems within hours of new risks appearing in the wild. This is useful for teams that need to reassess exposure as threats emerge, alongside routine scans.

Coverage across applications, cloud and devices

Authenticated dynamic testing covers customer-controlled web applications and APIs, including OWASP Top 10 checks. Cloud scans assess AWS, Microsoft Azure and Google Cloud for vulnerabilities, misconfigurations and exposures. Supported targets also include external addresses and domains, internal Windows, macOS and Linux devices, and container images. The range is a strength for teams seeking one scanning service across mixed environments, but the plan boundaries matter: internal target scanning is restricted to Pro and Enterprise.

Integrations include AWS, Azure, Google Cloud, GitHub, GitLab, Jira, Linear, ServiceNow, Slack, Microsoft Teams, Vanta and Drata. Its API can manage targets, view issues, start scans and retrieve results, giving teams options to connect scanning to existing workflows.

Security and support

Intruder says it encrypts data in transit with TLS, separates client datasets logically, and uses full-disk encryption on company devices and cloud volumes storing customer information. Intruder Systems Ltd says it completed an AICPA SOC 2 Type 2 audit. The company cites SOC 2, ISO 27001, PCI DSS, HIPAA and Cyber Essentials among supported compliance frameworks. All customers receive live chat support; Enterprise adds access to dedicated security professionals.

Pricing

Intruder is freemium, with a free plan and a 14-day trial. Paid-plan prices are custom pricing or based on a base fee plus per-target charges, so the free tier is the only stated fixed price.

PlanPrice and termsWhat it includesFreefree, billed Forever5 infrastructure targets, weekly external scans, 1 connected cloud account, 2 container images, ports 80 and 443, and 3 users. Web apps are excluded.CloudCustom pricing; billed Monthly or annually (annual saves 20%); base fee plus per-target fee3 cloud accounts, daily cloud checks, web app and API testing, top 10 ports, 5 AI investigation credits and 15+ integrations.ProCustom pricing; billed Annually; base fee plus per-target fee10 cloud accounts, agent-based internal scanning, top 50 ports and 10 AI investigation credits.EnterpriseCustom pricing; billed Quoted separatelyUnlimited cloud accounts, all ports, 1,000+ attack surface checks, 50 AI investigation credits and shadow IT discovery.Free is suited to small external-infrastructure inventories, but its five-target cap, narrow port coverage, weekly cadence and three-user ceiling limit its value for broader programs. Cloud adds application testing and more frequent cloud checks, but does not include the internal scanning explicitly offered by Pro. Pro is the relevant step for agent-based internal scanning and broader port coverage; Enterprise is aimed at organizations needing extensive attack-surface checks and unlimited cloud accounts. Live chat is available across plans, while dedicated security professionals are an Enterprise benefit.

Platforms

Intruder supports API, Linux, macOS, web and Windows. Its deployment model is hybrid, and authenticated scanning is supported.

Who it's for

Intruder is a good fit for teams that want continuous vulnerability coverage spanning infrastructure, cloud and customer-controlled applications, with threat-informed prioritization to help focus remediation. It is less suitable for a team that needs internal scanning but cannot take on Pro's custom-priced, annually billed base-fee-plus-target model, or for a small user group whose needs exceed the free tier's caps.

Pros and cons

Pro: Broad target coverage includes cloud environments, APIs, web apps, internal devices and container images, reducing the need to treat each asset type as a separate scanning problem.

Pro: Exploit-likelihood and threat-intelligence prioritization, plus remediation guidance, helps teams focus effort on more urgent findings.

Pro: Emerging-threat checks run within hours of new risks appearing, complementing continuous scanning.

Con: The free plan excludes web apps and limits users, targets, scan frequency, cloud accounts and ports, so it is a constrained evaluation option rather than broad coverage.

Con: Internal target scanning is reserved for Pro and Enterprise, and paid pricing uses custom or base-fee-plus-target terms rather than a stated flat price.

Alternatives

For a different vulnerability-management option, consider ManageEngine Vulnerability Manager Plus; its free edition and listed Professional on-premises option make it worth comparing if those licensing and deployment choices matter. OpenVAS is another freemium alternative, with a free virtual appliance, community feed and limited enterprise features, but no default support on its free plan. Choose Nmap when a free end-user-licensed tool is the priority and its redistribution restriction is acceptable; its stated scope is a network scanner rather than Intruder's continuous, prioritized service.

Qualys External Attack Surface Management is a candidate for readers who want to try a 30-day no-cost CSAM with EASM offer, rather than Intruder's permanently free but capped tier. Nuclei suits readers seeking an open-source, MIT-licensed standalone CLI. Pentest-Tools Port Scanner is a narrower port-scanning alternative, with a free tier for open ports and services discovery. Ivanti Neurons for Zero Trust Access is an alternative for readers considering named-user-licensed SaaS access software. NSAuditor AI is another freemium network vulnerability-scanning option.

Compare broader categories in Vulnerability Scanning Software, Cloud Vulnerability Scanners, Network Vulnerability Scanners and Vulnerability Management Software.

Verdict

Choose Intruder if your team needs continuous scanning across infrastructure, cloud and applications, and values threat-informed prioritization and remediation guidance. Its broad coverage is the main reason to choose it; the limited free tier and the higher-tier gate on internal scanning are the main reasons to look elsewhere.