Issues explained

Within the Issues section in the navigation sidebar, you'll see the following:

Current
Triage
Snoozed
Noise
Fixed

Viewing current issues

💡 Tip: You can export your current issues as a CSV by clicking 'Export' as shown here:

Filtering the current issues page

You can filter the list of current issues by:

Tag
Target
Hygiene status (Overdue, Not overdue)
Severity rating (Critical, High, Medium, Low)
Exploit likelihood (Known to Rare)
CVSS (0.0–10.0)
EPSS (0–100%)
Category (Attack surface reduction, Compromise, Cryptographic weaknesses, Information disclosure, Misconfiguration and common mistakes, Vulnerable software)
Target type (External, Internal)

These filters are great if you're under a time crunch and need to prioritize, as demonstrated in this video:

Viewing current issues at the 'issue level'

Should you click on an issue, you'll see plenty more information. On the left of the screen, you'll find a list of the affected targets/occurrences (including ports and services):

On the right-hand side, you'll see:

	Explanation
Intruder rating	CVSS provides the basis for our severity rating, but our Security team can amend this score to better reflect threat intelligence data.
Highest CVSS score	Common Vulnerability Scoring System (CVSS) FIRST's open framework for communicating the characteristics and severity of software vulnerabilities.
Exploit likelihood	We use publicly available data to determine the likelihood that a vulnerability has ever been used by threat actors to exploit an individual or organization.
CVEs	Common Vulnerabilities and Exposures. A publicly disclosed security vulnerability listed in the CVE system, each identified by a unique ID (e.g., CVE-2026-23870).
Description	An explanation of the issue detected.
Remediation	Intruder-curated advice/guidance to help with resolving the vulnerability.
Comments	Notes to help your team share context and stay aligned throughout the remediation process.

You may also notice an Action button at the top, which allows you to snooze the issue (by accepting risk, marking as a false positive, or adding mitigating controls); Rescan (which limits the scan scope to this specific issue), as well as the option to send the issue to any of your integrated tools:

Viewing 'current' issues by occurrence

When you click a specific occurrence, you'll see even more information:

	Explanation
Raw scanner output	This comes directly from the scanner and is available for download as a .txt file.
Check	Clicking this will take you to the checks detail page
Occurrence	Including the affected target, reported plugin, reported version, date it was first detected by Intruder, and target tags
Severity	Intruder rating Highest CVSS Attack vector: the level of access required for an attacker to exploit the vulnerability Attack complexity: the level of conditions beyond the attacker's control needed for a successful exploit Privileges required: the level of privileges or access an attacker needs for a successful exploit User interaction: whether a user, other than the attacker, is needed to do anything in order to exploit the vulnerability
Exploit likelihood	Categorized as either Rare, Unlikely, Likely, Very likely, or Known, supplemented by a probability % over the next 30 days. You may notice that some occurrences are marked with an 'Exploit known' icon while others are not: This is because we 'fingerprint' the services running on each target to ensure we only run relevant checks. If a relevant check corresponds to a CVE on the Known Exploited Vulnerabilities (KEV) list, the 'Exploit known' icon will appear for that specific occurrence, helping you prioritize your remediation efforts.
CVEs	The CVE ID, which links to cvemon.intruder.io.
Overview	Including description and remediation

Issue labels explained

Label	Explanation	Plan
Attack surface:	An exposed issue is not necessary for functionality, but it increases the attack surface of the target.	All Plans
Rapid response:	Indicates an issue detected by our team, either because our core scanners don't have a check for it yet or because it's better detected by a person. (More on that, here)	Enterprise Vanguard
Bug hunting:	Indicates an issue detected via manual investigation, whereby efforts are focused on the discovery of high-impact attack chains that could have a significant impact if left unresolved. (More on that, here.)	Enterprise bolt-on Vanguard
Manual investigation:	Indicates the finding has been reviewed by a member of our Security team for enhanced insights and more bespoke reporting.	Vanguard

Triaging issues

Triage lets you investigate issue occurrences using an AI agent. For each investigation, the agent produces a summary, detailed findings, and a full transcript of every step it took, including the exact requests sent, responses received, and the reasoning behind each conclusion. View our Issue Triage & Investigation article to learn more.

Viewing fixed issues

Here, you can find a list of your fixed issues, with all the same information as you can find in the Current section, with the addition of a Fixed date (most recently fixed at the top):

💡 Tip: You can export your fixed issues as a CSV by clicking 'Export' as shown here:

Viewing snoozed issues

💡 Tip: You can export your snoozed issues as a CSV by clicking 'Export' as shown here:

Again, you can find the same information on this page, as you can on the other two – with the option to un-snooze occurrences or view snooze details. (More information on the specifics of snoozing can be found here).