Our Essential plan continuously monitors your external system via an automated vulnerability scanner, checking for thousands of known vulnerabilities, including:
Common mistakes & configuration weaknesses
Attack surface reduction
Web-layer security problems (such as SQL injection and cross-site scripting)
Each plan is designed to cater to a different audience and those most suited to our Essential plan would be early-stage start-ups or SMEs with a limited internet footprint as well as those that rely mostly on open-source software and devices.
Users of this plan are entitled to one editable scheduled scan per month, an unlimited number of ad-hoc scans, two users and Smart Recon (which tells you exactly how many of your systems are active and require a license to scan them – this means you only pay to scan targets that are actually exposed to the internet).
Our Pro plan also uses an automated vulnerability scanner to offer continuous monitoring, but with greater coverage than Essential. Catering to a slightly different audience, this plan is suitable to those that host their own servers; run enterprise solutions (Exchange, VPN endpoints etc); or need to cover internal systems that aren’t exposed to the internet.
This plan also comes with a suite of additional features – most notably unlimited scheduled and on-demand scanning; internal vulnerability scanning (via an agent) and smart functionality such as Emerging Threat Scans and Network view (to help you keep track of what's exposed to the internet).
Furthermore, users have access to cloud integrations (for discovering your cloud assets); ticketing system integrations (to ship your vulnerabilities to your ticketing system); and messaging service integration (to provide alerts via your favourite messaging apps).
Beyond that, with a Pro subscription you are permitted an unlimited number of users, which is perfect for larger teams.
This plan is a hybrid vulnerability management solution with our continuous penetration testing capability.
It includes all the same checks you'd get with the Pro plan, but appeals to those that would benefit from a team of security professionals dedicated to proactively identifying weaknesses in their assets. Our highly skilled security professionals have a knack for discerning minor vulnerabilities in scan reports which in combination are greater than the sum of their parts. These include:
The chaining of vulnerabilities (where appropriate)
Investigation of false positives and their removal from scan results
Impact review: if the scanner flags something that looks interesting, the team will manually investigate further to see if it can be exploited
Contextualisation of issues as they relate to your business
Vanguard advisories (when applicable): emails that inform you of any additional weaknesses that the team have uncovered during their investigations
Option to add free-form bug hunting
For indicative pricing, or more details please reach out to a member of the team via our chatbot.
Users have the option to add Authentication licenses to any of the plans mentioned above. This feature expands the scanning capabilities and would be especially valuable to:
Anyone managing a web-app with a login page – the functionality available to authenticated users is often much more sensitive and would pose a greater risk if exploited by a malicious authenticated user.
Developers/managers that are seeking reassurance that any updates they’re releasing are free of vulnerabilities.
Anyone needing to satisfy a client or compliance requirement for authenticated web-app scanning.
For more information, have a read of our Authenticated Web app scanning article.
Manual penetration testing
Our manual pen-test service can include the automated checks mentioned above, but its value is owed to the professional conducting the test. Not only are they able to expose weaknesses that could go otherwise undetected by a machine, they are responsible for exploiting them as a way to gauge the threat they pose.
Some of the differences that a pen-test can provide:
Identification of publicly accessible files that may contain sensitive company information (only decipherable by the human eye)
Identification of multiple lower risk vulnerabilities that, in the context of the organisation, could be dangerous if combined
Exploitation of credentials (dictionary attacks; breached credential stuffing; authenticated scanning and brute-force)
The service also includes a re-test so that customers have the opportunity to execute any recommended remediation before they are issued a final bill of health.
Given that this assessment is bespoke, penetration tests are scoped on a case by case basis. If you would like further information or to enquire about pricing, then please reach out via the chatbot.
So what should I choose?
If you're still unsure as to what service you need then perhaps it would be worth hitting the button below. It will take you through to a blog post we wrote, outlining the differences between vulnerability scanning and penetration testing. Hopefully by the end of it, you'll have a clearer idea of what solution would work best for you and how Intruder can help you achieve your cyber security goals.
If you would like to discuss anything mentioned above, or have any further questions, please feel free to reach out to a member of the team via our chatbot.