Tool profile
Intruder: cost, fit and limits
Intruder is a cloud-based exposure management and vulnerability scanning service made by Intruder Systems Ltd in the United Kingdom that monitors external attack surfaces, cloud accounts and web applications for small security and IT teams.
What to know first
Intruder sells four tiers: Free, Cloud, Pro and Enterprise. The entitlement matrix is public and shows cloud accounts, scan frequency, monitored ports, users and AI investigation credits for each tier. Paid tiers use a base fee plus a per-target fee, but the dollar amounts did not render on the page we read. The vendor offers a GregAI virtual analyst and a separate AI pentesting service priced from $3,500 per test.
Intruder at a glance
| Maker | Intruder Systems Ltd, United Kingdom |
|---|---|
| Free plan | Free trial only |
| Entry price | From $3,500 per AI pentest |
| API access | Yes |
| Category | Best AI Attack Surface Management Software in 2026, rank 3 of 10 |
| Website | intruder.io |
Who Intruder is best for
Lean security teams
Scheduled scans, emerging threat scans and a 15-plus integration list reduce manual work for a team of one or two people covering infrastructure and cloud.
Compliance-driven startups
Drata and Vanta integrations, plus a stated SOC 2 Type 2 audit of the vendor itself, help companies that must show regular vulnerability scanning to auditors.
Teams testing AI pentesting
A separate AI pentest offer starts at $3,500 per test, so a buyer can try agent-based testing without committing to an annual platform contract.
Intruder plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free | Free forever | 3 users, 1 cloud account, weekly cloud checks, monthly network scans, ports 80 and 443 monitored and 1 AI investigation credit. |
| Cloud | Base fee plus per-target fee | 3 cloud accounts, daily cloud checks, weekly network scans, top 10 ports, unlimited users, web app and API testing, GregAI and 5 AI credits. |
| Pro | Base fee plus per-target fee | 10 cloud accounts, top 50 ports, agent-based scanning for internal servers and employee devices, and 10 AI investigation credits. |
| Enterprise | Custom quote | Unlimited cloud accounts, all ports, daily network scans, shadow IT discovery, 1,000-plus attack surface checks, custom checks and 50 AI credits. |
Checked October 2026.
What Intruder does
- GregAI virtual analyst
- GregAI is described as a security analyst that takes delegated work to save team time. The pricing table lists it from the Cloud tier and meters AI investigations through credits, from 1 on Free to 50 on Enterprise.
- AI pentesting
- On-demand AI agents test for multi-step vulnerabilities. Users connect code repositories, set scope and receive a compliance-ready report. It is sold separately from the subscription, starting from $3,500 per test.
- Emerging threat scans
- The vendor says scans run within hours of critical vulnerabilities becoming public, and the Cloud tier lists Emerging Threat Scans, so new CVEs are checked before the next scheduled cycle.
- Cloud and container checks
- Connected AWS, Azure and Google Cloud accounts are checked for misconfigurations, insecure permissions and exposed secrets, and container images are scanned through connected registries. Findings arrive in the same queue as network issues.
- Web application scanning
- A ZAP-powered DAST scanner runs 75-plus application checks, including authenticated scans behind logins, for web apps, single-page apps and APIs. Results sit beside infrastructure findings in one queue.
How Intruder handles your data
The security page says Intruder Systems Ltd completed a SOC 2 Type 2 audit, and that its data centers hold ISO 27001 and PCI DSS certifications, which are the providers' certifications and not necessarily Intruder's own. Transport uses TLS, cloud volumes holding customer data are encrypted, and customer datasets are logically separated. Privileged users have individual accounts with logged access, and backups sit in a separate cloud zone with restore tests twice a year. The page does not state hosting regions or how customer data is used by AI features.
Where Intruder falls short in practice
- Paid prices not shown. The pricing page we read showed placeholders for the Cloud and Pro amounts, and described a base fee plus a per-target fee. A buyer cannot total the cost without the live calculator or a quote.
- Discovery sits at the top tier. Automated shadow IT and unknown asset discovery, plus monitoring of all ports, are listed only under Enterprise. Lower tiers watch a fixed set of ports on targets you enter.
- AI use is metered. AI investigation credits are capped at 1, 5, 10 or 50 depending on the tier, so heavy use of GregAI-style triage can run out of allowance before the billing period ends.
Works with
Alternatives to Intruder
Intruder: common questions
How long is the Intruder free trial?
The pricing page describes a 14-day trial with Cloud features and 5 free licenses. A Free plan that lasts indefinitely also exists, limited to monthly network scans and ports 80 and 443, so a trial is the way to test daily scanning.
What are AI investigation credits in Intruder?
They cap how many AI investigations an account can run per period: 1 on Free, 5 on Cloud, 10 on Pro and 50 on Enterprise. The page does not define what counts as one investigation, so ask the vendor how a typical triage task is metered.
Does Intruder scan internal servers?
Yes, from the Pro tier, which adds agent-based scanning for internal servers and employee devices. The Free and Cloud tiers focus on external infrastructure, cloud accounts and web applications. Free and Cloud users who need internal coverage would have to move up a tier or add another scanner. Ask about agent counts and supported operating systems before rollout.
Which compliance tools connect to Intruder?
The integration table names Drata and Vanta for compliance automation, plus Microsoft Sentinel for SIEM. Workflow connections include Slack, Teams, Jira, GitHub, GitLab, ServiceNow, Linear and Zapier, though the page does not map each to a tier. Check which integrations your tier includes before buying.
Is Intruder SOC 2 certified?
The security page says Intruder Systems Ltd completed an AICPA SOC 2 Type 2 audit. It names ISO 27001 and PCI DSS for its data centers only, so ask for the report and the scope under NDA if your auditors need it.