Intruder discovers assets and scans deployed environments, then prioritizes the findings and routes remediation work. Its infrastructure coverage extends from internet-facing systems to cloud resources.
Application licenses add web and API scanning, while agents cover supported internal endpoints. The selected plan determines the available depth.
That runtime coverage starts after software is available to test. CodeAnt’s code-security layer works earlier by analyzing source code and dependencies.
It also finds committed secrets and unsafe infrastructure as code. Software bills of materials identify shipped components.
Continuous vulnerability scanning repeats checks against deployed assets, while a penetration test investigates exploitable chains inside an authorized scope. The guide to continuous versus annual pentesting shows how those cadences complement each other.
TL;DR
Intruder feature area | What it does | Buying constraint to check |
|---|---|---|
External vulnerability scanning | Tests exposed hosts and services for known vulnerabilities, configuration weaknesses, leakage, and unsafe exposure | Scan cadence and monitored ports vary by plan |
Attack-surface management | Discovers assets and tracks ports, services, certificates, and perimeter changes | Automated unknown-asset discovery is an Enterprise feature |
Cloud security | Syncs cloud assets, checks configurations, and scans container images | Cloud-account limits and check frequency vary by plan |
Web app and API security | Runs authenticated or unauthenticated DAST; accepts OpenAPI/Swagger schemas for APIs | Application licenses are separate from infrastructure targets |
Internal scanning | Uses endpoint agents for private servers and employee devices | Pro or Enterprise; not a network-device scanner |
Prioritization and AI | Combines severity and threat signals, remediation guidance, and GregAI investigation/actions | AI investigation credits vary by plan |
Workflow and reporting | Sends findings to collaboration/ticketing tools and produces audit-supporting reports | A scan report supports an audit; it is not an audit or pentest report |
Intruder features at a glance
As of July 31, 2026, Intruder connects exposure visibility with security testing. It discovers internet-facing and cloud assets, then records changes in their exposed services.
Those asset records become scan targets for vulnerability and configuration checks.
The resulting findings move through triage and remediation before they appear in technical or audit-supporting reports. Intruder can filter noise and add threat context, then send work into ticketing systems without claiming to inspect source code before release.
SAST and DAST solve different problems: SAST analyzes source without executing the application, whereas DAST probes a running target. The SAST and DAST tool guide maps those methods to the development and deployment stages they cover.
What features does Intruder actually include?
External infrastructure vulnerability scanning
Intruder begins an external scan by finding open ports and services, then fingerprints the software it sees so it can apply relevant checks. Those checks cover missing patches and configuration weaknesses.
The scanner also looks for exposed information and remotely vulnerable software. Separate checks flag weak encryption settings.
The scanning stack combines an open-source vulnerability engine with Nuclei templates. Intruder’s security team adds custom checks for cases not covered by those sources.
The plan determines how frequently those checks run and how much of each host’s port range is monitored. As of July 31, 2026, Free provides weekly external scans for ports 80 and 443, while Cloud adds Emerging Threat Scans and custom schedules across the top 10 ports.
Pro expands monitoring to the top 50 ports, and Enterprise covers all ports. A buyer should therefore document the required assets and scan triggers before using a host count to choose a tier.
If the same team also owns application delivery, map this runtime scanner to the CI/CD controls needed for continuous pentesting and the security gates that can block an unsafe change. This prevents a deployed-host scan from becoming the first control that sees a code-level defect.
The overview of automated pentesting in 2026 explains how validation and attack chaining extend beyond vulnerability discovery. It also defines the evidence and retesting a pentest deliverable should provide.
Attack-surface discovery and change monitoring
Intruder’s discovery layer searches for subdomains and related domains, then records login pages and APIs alongside exposed services. Cloud connections bring corresponding IP addresses and hostnames into the same asset inventory.
The official asset-discovery page says cloud connections are checked for new IP addresses and hostnames every two hours, while subdomain discovery runs weekly. Intruder can add newly discovered cloud assets as targets and scan them automatically.
The Attack Surface view separates active targets from unresponsive ones and highlights changes since the previous scan. Each target can show certificate expiry and exposed ports.
Opening a target reveals the detected service and protocol. A captured screenshot provides visual context.
Filters let an operator isolate a service such as OpenSSH rather than reviewing the entire inventory.
*Intruder’s public Attack Surface documentation shows the target filters and service inventory available in the product. Screenshot published by Intruder and retrieved July 31, 2026.*
All plans get an Attack Surface view, but the pricing page reserves automated shadow-IT and unknown-asset discovery for Enterprise. During a trial, test known-asset synchronization separately from unknown-asset discovery.
An asset list does not show how findings combine into an exploitable route. Compare inventory data with attack-path analysis and the examples in our guide to cloud exploit chains.
Emerging-threat scanning and Rapid Response
Scheduled scanning records what was detectable when the scan ran. Intruder’s Emerging Threat Scans add an event-driven path: when its team identifies a newly disclosed critical threat that could affect customer systems, the platform launches targeted checks instead of waiting for the next schedule.
Rapid Response adds human review when an automated check is unavailable or human detection is more suitable. Intruder says its team checks prominent critical weaknesses and notifies potentially affected customers.
The notification includes guidance, but the service does not promise a test for every new CVE.
FIRST’s EPSS estimates the probability that a published CVE will be exploited in the next 30 days. The CISA Known Exploited Vulnerabilities catalog records evidence of exploitation in the wild.
Intruder says its prioritization combines CVSS and EPSS with known-exploit information and customer context. During a pilot, verify how each signal changes the queue and how the platform records exceptions.
CodeAnt exposes EPSS-based vulnerability prioritization for code-security findings. An analyst can compare that probability with the criticality of the affected asset.
Reachable attack paths show whether the vulnerable component can contribute to an exploit chain. Evidence of active exploitation provides a separate reason to accelerate the fix.
Cloud security posture and container-image scanning
Intruder connects to AWS and Microsoft Azure for asset synchronization and posture checks, with Google Cloud available through the same cloud workflow. Cloudflare supports DNS-based target discovery.
The cloud view joins exposed assets and services with access findings. It can show overly broad permissions or public resources alongside vulnerabilities in deployed infrastructure and container images.
The cloud attack-surface page documents automatic container discovery in AWS ECR and Azure ACR. Google Cloud Artifact Registry is also supported.
Intruder scans a container when a new image version is pushed. Results appear with configuration and infrastructure findings.
As of July 31, 2026, Free lists weekly cloud checks for one connected account and two container images. Cloud increases the allowance to three accounts and runs daily checks, while Pro lists 10 accounts and Enterprise lists unlimited accounts.
The pricing matrix does not replace a written licensing interpretation for a multi-cloud estate. Ask which cloud object becomes a billable account in the quote.
An organization or subscription may count instead of an individual project. That definition can change the required tier.
For development teams, the corresponding preventive controls are cloud-configuration scanning and infrastructure-as-code analysis. Our multi-cloud AI pentesting field guide turns those controls into a cloud test scope.
Web application and API scanning
Intruder’s DAST scans running multi-page and single-page applications together with their underlying infrastructure. It supports both unauthenticated and authenticated tests.
Documented authentication methods include session cookies and form credentials, with HTTP authentication or headers available for other login designs. Recorded login flows and OAuth 2.0 cover applications that need a browser-led or delegated authentication path.
For APIs, Intruder accepts an OpenAPI or Swagger schema and maps tests to the described endpoints. A schema can expose valid endpoints that an ordinary crawler would miss.
Intruder says its application scanning covers the OWASP Top 10 and vulnerable components. The same material names APIs and more than 75 application checks within the product’s scope.
Its DAST page also says an automated scanner cannot check every OWASP vulnerability. Authorization logic may need deeper investigation, especially when a flaw depends on chained business abuse or application-specific context.
Application scanning uses application licenses across Intruder’s plans. Do not infer that an infrastructure target automatically gives you authenticated DAST for the application it hosts; model those target types separately in the quote.
Our AI pentesting versus traditional DAST comparison explains how a scanner reports matching behavior while a pentest investigates whether separate weaknesses form a working attack. The AI web-app pentest tool guide defines evidence requirements beyond a scanner alert.
For cloud-hosted applications, the cloud pentest checklist begins with provider authorization and identity boundaries. It then extends the scope to storage exposure and lateral movement.
Internal endpoint scanning
Intruder’s internal-scanning agent supports Windows and Linux as well as macOS. It reports findings into the same platform used for external targets, which lets a team include employee devices and private servers that cannot be reached from the internet.
Each agent scans its host instead of sweeping the surrounding private network. Intruder excludes routers and switches from this agent-based coverage.
Printers need a separate scanning or management control.
Internal scanning is available on Pro and Enterprise.
If the requirement is “scan the corporate LAN,” split it into endpoint and network-device inventories. Intruder may cover the first while a credentialed network scanner or device-management control covers the second.
Internal scan findings can also point back to vulnerable third-party packages. Software-composition analysis and an SBOM inventory answer which shipped component introduced the exposure; the endpoint scan answers where that component is currently visible.
Risk prioritization and GregAI
Intruder filters findings it classifies as noise and supplies remediation guidance. An operator can snooze an occurrence after recording it as a false positive or accepted risk, or after documenting a mitigating control.
The Cyber Hygiene Score provides a portfolio-level signal, while issue details support remediation on a target.
GregAI adds a conversational investigation and action layer. Its April 23, 2026 help article says the assistant can inspect vulnerability findings and scan history.
An investigation can then move into scan schedules or affected targets. GregAI can inspect tags and exposed ports before checking certificate expirations.
For prioritization, GregAI uses CVSS and EPSS alongside known-exploit data and compliance requirements. The assistant can start a scan or cancel one after confirmation.
It can also change an issue’s snooze state. Separate confirmed actions manage targets and tags.
Intruder says those actions require a direct user request and confirmation. A pilot should verify permission boundaries and approval visibility, then inspect the action log and the evidence retained after an AI-assisted change.
CodeAnt’s code-security dashboard lets security leads inspect findings across repositories and controls. Our guide to the benefits of AI pentesting separates documented automation from unsupported claims of autonomous coverage.
*CodeAnt’s public code-security page shows its vulnerability-triage indicators. Product image retrieved July 31, 2026.*
Integrations, API, and remediation workflows
As of July 31, 2026, Intruder can send notifications to Slack or Microsoft Teams and export findings to GitHub or GitLab. Ticketing routes include Jira and Azure DevOps, with ServiceNow and Linear available for other remediation workflows.
The integration catalog also connects scan evidence to Drata and Vanta, while Microsoft Sentinel accepts security data exports. Okta handles SSO and Zapier supports workflow automation.
The API exposes target management and issue results. It can trigger a scan without opening the interface.
GitHub export is limited to private repositories. The Jira integration requires specific fields and did not support scoped API tokens on the observation date.
An integration pilot should begin with direction and permissions before testing the issue fields it creates. Create the same finding twice to observe deduplication, then close it to test status synchronization.
A failed delivery should produce a notification that the integration owner can find and act on.
For findings created before release, integrating SAST into CI/CD keeps the issue near the change that caused it. Requiring steps of reproduction for SAST findings also gives developers a testable path instead of a severity label with no proof.
Reporting and compliance evidence
Intruder’s report begins with the targets scanned and the issue totals by severity. An exposure-over-time graph draws on the last 12 assessments.
The remaining sections provide the issue inventory and descriptions, followed by remediation advice and a summary of the checks run. PDF and CSV exports support technical review and the transfer of audit evidence.
Intruder explicitly says it does not conduct the audit and recommends confirming that its report satisfies the auditor’s requirement. Drata and Vanta integrations reduce evidence-transfer work, but a vulnerability scan is not an attestation.
The linked SAST compliance-evidence guide explains how static-analysis evidence can support a control, but an auditor still evaluates its design and operation. CodeAnt’s PDF reporting feature supplies a development-side artifact.
A penetration-test deliverable needs to define scope and show evidence for each result. It should also explain impact and remediation before documenting retesting, as mapped in the AI pentesting compliance guide.
Where Intruder’s feature set is strongest
Intruder’s strongest workflow connects an asset change to a scan action. Cloud sync can discover a new public target, which adaptive monitoring can then watch for service changes.
If a scan turns that change into a finding, prioritization determines where it appears in the queue. An integration can send the result to the engineer who owns the system.
The Cloud tier brings emerging-threat scanning and daily cloud checks into that flow, together with application testing and the integration catalog. GregAI adds investigation and confirmed actions, while Pro adds internal agents and broader port monitoring.
The documented boundaries remain important when selecting a tier. Automated DAST does not find every application weakness, and internal agents do not scan nearby network devices.
A scan report can support an audit without replacing the audit itself.
Our automated pentesting FAQ defines questions for testing these boundaries. The automated-pentest mistakes guide identifies claims that require validation.
Intruder limits to check before buying
The first limit is coverage by plan. Scan frequency and port monitoring change across the four tiers, as do cloud-account allowances and access to internal agents.
Enterprise reserves unknown-asset discovery and custom checks, while GregAI investigation credits also vary. Map each requirement to the plan matrix instead of treating the tier names as coverage definitions.
The second limit is target licensing. Intruder meters infrastructure targets separately from application targets.
Internal devices use another unit, while containers have their own allowance. Cloud accounts add another constraint.
Ask Intruder to map the current inventory to those billable units in writing. The mapping should explain how ephemeral assets and systems that disappear during a billing window are counted.
When comparing the development-security layer, use CodeAnt’s current pricing to map contributor or product units separately; combining unlike licensing meters into one “per asset” estimate hides the actual cost driver.
The third limit is testing depth. Intruder provides repeatable vulnerability and configuration scanning plus human-assisted response services, but that scope does not replace static analysis.
Manual business-logic testing and exploit-chain validation remain separate jobs. Runtime scans also cannot stop unsafe code before deployment.
What SAST analyzes explains that preventive layer. Secret scanning covers valid credentials committed to a repository, which are not runtime vulnerability signatures.
If consolidation is part of the business case, use the SAST tool-consolidation framework to identify overlapping scanners and rules. Then compare the workflows and evidence exports that would remain after a tool is removed.
Intruder vs CodeAnt AI by use case
Intruder and CodeAnt overlap in cloud posture and deployed-application security. Both can prioritize findings and route remediation work.
Each product can also produce reports, but their primary use cases begin at different points in the software lifecycle.
Buyer job | Intruder fit | CodeAnt AI fit |
|---|---|---|
Continuously inventory and scan internet-facing infrastructure | Strong: this is core Intruder territory | Evaluate its attack-surface/pentest scope for the exact asset set |
Monitor cloud configurations and container exposure | Cloud sync, CSPM, container scanning, and deployed-asset monitoring | Code and cloud security can connect IaC and configuration findings to development work |
Find vulnerabilities before code merges | DAST tests a running target, not source before execution | CodeAnt SAST is the closer fit |
Validate exploitable paths with code context | Automated scanning plus separate pentesting services | CodeAnt’s agentic penetration testing documents black-box, white-box, and gray-box/code-memory testing |
Route recurring scan findings to IT/security workflows | Strong integration and reporting set | Stronger fit when findings should land inside PR, IDE, CLI, and engineering security gates |
Who should choose Intruder—and who should not?
Choose Intruder when the team needs a current view of external and cloud exposure, followed by continuous scans of deployed assets. Its managed scanner and integrations can route infrastructure findings without requiring the team to operate the underlying scanning engines.
Choose CodeAnt when the work begins in the software-development lifecycle. Source and pull-request review place the first controls before merge.
Dependency and secret scanning extend that review to consumed or exposed material. Infrastructure-as-code analysis and SBOM generation cover delivery artifacts, while code-aware pentesting adds exploit validation.
Some teams need both layers because pre-merge prevention and post-deployment observation catch different failure modes.
CodeAnt can deliver findings through pull-request review before a change is merged. The same feedback can appear in the developer’s IDE or a local and CI-friendly CLI, keeping the result close to the remediation owner.
For exploit validation, begin with each provider’s documented methodology and inspect the reproducible evidence it returns. The guides to choosing an AI pentesting provider and evaluating pentesting vendors explain how retesting policy changes the value of that evidence.
Intruder feature evaluation checklist
Before buying, run a pilot against a representative slice of the estate:
Create separate inventories for infrastructure targets, application targets, internal devices, containers, and cloud accounts.
Confirm the required scan cadence and port coverage against the proposed plan.
Test cloud-asset lifecycle behavior and record how new or retired assets affect the billable inventory.
Scan an authenticated web workflow, then scan a schema-defined API with an expired credential and an endpoint absent from navigation.
Review findings across severity and disposition states, checking the evidence and remediation instructions attached to each one.
Change a finding’s status and confirm that the audit history records it.
Send a finding through the production ticketing integration and verify closure synchronization.
Export the report an auditor or customer will receive, then ask that stakeholder to confirm it answers the evidence request.
Document where SAST, software-composition analysis, and secret scanning sit outside the Intruder workflow.
Record the separate owners for manual logic testing and exploit validation.
If the pilot includes active testing, use an automated pentesting checklist to define authorization and scope before execution. The same record should state the evidence and retesting requirements together with stop conditions.
The code review versus penetration testing guide defines the handoff between reviewer and tester. CodeAnt’s sample pentest report shows its evidence format.
