Find your fit
Who it is for
A small IT team can use the external target list and Attack Surface view to inventory public domains, IPs and services, then investigate unexpected exposure. Start with owned assets and compare what Intruder discovers with the existing inventory.
A cloud-heavy team can connect supported cloud accounts so external IPs and hostnames are synchronized. Confirm each account scope and the plan’s port and cloud-check coverage before assuming every cloud resource is assessed.
An application team that needs authenticated page or API testing should budget for Application licenses and configure only authorized entry points, credentials and schemas. Internal endpoint scanning is a different agent-based workflow.
The work it supports
Core capabilities
Intruder can identify exposed assets beyond a manually entered target list, including new cloud services and forgotten subdomains. Review discovered assets against ownership records so a retired or third-party address is not treated as yours to scan.
The Attack Surface view presents observed ports, services, certificates and changes. A separate recurring network scan updates service visibility; it is not the same as a vulnerability assessment, and its cadence and visible ports depend on plan.
Infrastructure scans assess internet-facing IPs and names for relevant exposed-service and software weaknesses. The exact scanning engine and checks vary from Free through Cloud, Pro and Enterprise, so compare the checks needed for your estate.
An Application license adds enhanced web-app and API scanning to infrastructure checks, including authenticated pages when correctly configured. A domain licensed only as infrastructure is not equivalent to testing custom logic behind a login.
Supported internal Windows, Linux and macOS devices use an agent for local checks on eligible plans. Devices that cannot run that agent and are not internet-facing need a different assessment path.
The Scans page separates upcoming, in-progress and completed scans and includes remediation scans to check a reported weakness after a fix. A passed or completed scan should be read as the result of that scope and time, not a claim that every weakness is absent.
Reports can summarize open, new and fixed findings over a chosen period, with filters by target or tag. Use those trends to review the remediation backlog, while checking individual findings and scope before reporting a security outcome.
Authenticated web-app and API scanning can send requests that trigger application actions or modify data when powerful credentials and endpoints are supplied. The vendor recommends test environments and limited credentials; plan a controlled authorized test before production scanning.
Understand the offer
Pricing and getting started
Current public pricing names Free, Cloud, Pro and Enterprise. The page shows a 14-day Cloud-feature trial with five licenses, which should not be confused with permanent Free-plan rights. Confirm the post-trial target count and scan coverage before relying on the free option.
Cloud and Pro pricing combines a base fee with charges per target. The static public capture left the numeric totals blank before target selection, while Enterprise is quote-led; get the actual target mix, market, term and VAT on a written quote.
Infrastructure and Application licenses cover different test scopes. A vulnerability scan can hold a license on its target for 30 days and a rescan resets that window, so rotating targets is not necessarily a way to share one license across an estate.
Plan rights change the port view, scan engines, cloud/account coverage and internal-device options. Keep authenticated app tests, internal agent devices and external infrastructure in separate rows when sizing the subscription.
Look a little closer
Before you choose
List authorized domains, public IPs, cloud accounts, web apps and internal devices before a trial. For each, choose infrastructure or application scope, verify ownership and determine who can approve a scan.
In a controlled test, compare asset discovery with known inventory, inspect the Attack Surface view, run one authorized scan, and follow a finding through remediation verification. Record what was actually scanned and what the plan could not see.
For authenticated apps or APIs, use a test environment and low-privilege account where feasible, review schema endpoints and credentials, and consider actions that a scanner request could trigger. Do not treat a security scan as a harmless read-only test.
Before purchase, ask for the number and type of targets, the 30-day license window, app/internal rights, plan-specific port and cloud coverage, and a quote that states billing term and VAT. Separate trial features from enduring Free access.
13 distinct sources behind this profile. Research observed Oct 26, 2026. Features and offers can change.
View sources and research →
