Intruder

Scans cloud resource configurations and container image CVEs alongside traditional OS and application vulnerabilities in a unified risk view.

Enforces remediation deadlines by severity, reports on SLA compliance, and escalates overdue findings through configured approval chains.

Continuously discovers external-facing assets (domains, IPs, cloud services, APIs, certificates) including assets deployed outside the official inventory.

Recommends the minimum patch set that eliminates the highest-risk exposure (accounting for shared libraries and patch co-dependencies), rather than presenting a ranked CVE list.

Creates tickets, assigns owners, and tracks remediation progress in ITSM platforms (ServiceNow, Jira), closing the loop between finding and fix rather than producing a static report.

Cross-references the vulnerability inventory against live threat feeds tracking CVEs under active exploitation in the wild, surfacing vulnerabilities with confirmed attacker activity.

Aggregates and deduplicates findings from network scanners, endpoint agents, cloud scanners, and third-party tools into one normalized record for cross-estate risk ranking.

Assigns likelihood-of-exploitation scores using threat intelligence, vulnerability characteristics, and active exploit availability, independent of CVSS, which measures severity rather than exploitability.

Incorporates asset metadata (network exposure, business criticality, data classification) into vulnerability prioritization so that a critical CVE on an isolated internal test system ranks lower than a medium CVE on an internet-facing payment server.

Aggregates posture findings and policy enforcement across multiple cloud accounts, subscriptions, and projects from a single control plane, critical for organizations with 10+ cloud accounts.

Audits cloud service configurations across AWS, Azure, and GCP against security best practices and benchmarks, flagging misconfigurations such as public storage, permissive network rules, and disabled logging. Coverage breadth and per-service depth vary significantly across products.

Continuously discovers and inventories cloud resources across accounts, subscriptions, and projects so posture assessment runs against a current, complete picture of the environment rather than a stale or partial asset list. Coverage of newer and less common resource types varies across products.

Manages asset scope definitions, scope change approvals, rules of engagement, and testing windows through a persistent platform interface rather than per-engagement documentation.

Delivers findings through a live client portal as testers discover them, with status, severity, and evidence, instead of a single static PDF at the end of the engagement.

Initiates penetration testing engagements through a platform interface without requiring a new statement of work for each test, enabling testing at the cadence of development releases.

Delivers findings directly into developer ticketing systems (Jira, GitHub Issues, Azure DevOps) alongside standard pentest reports, enabling developer remediation tracking within existing workflows.

Ranks discovered exposures by combining exploitability signals, asset business context, and active threat intelligence to produce an actionable remediation queue.

Identifies software stacks, versions, and components running on discovered assets through passive banner analysis and active probing, mapping CVE exposure without authenticated scanning.

Continuously enumerates internet-exposed assets (domains, IPs, subdomains, certificates, cloud storage, APIs) using passive DNS, certificate transparency logs, and active probing, including assets outside the official inventory.

Identifies cloud resources, SaaS applications, and exposed services deployed by business units without IT or security team visibility or approval.

Tracks SSL/TLS certificate expirations, newly registered lookalike domains, and subdomain takeover opportunities (dangling DNS records pointing to deprovisioned cloud services).