Vornin connects attack-surface monitoring, scanning, fix tracking, reporting and compliance evidence in one EU-hosted vulnerability management platform. Detection runs on its own first-party engines alongside proven open-source ones, with Vornin's own rules and correlation on top.
Vornin vs Intruder
Intruder scans infrastructure, web apps and cloud accounts for exposures. Vornin runs the whole vulnerability lifecycle, from scan to verified fix, with evidence for technical security controls. Intruder offers endpoint agents on higher plans, plus a free plan with more scan targets.
Vornin as an Intruder alternative, at a glance
Both offer self-serve network, web application, API, container and cloud configuration scanning with public pricing. Vornin also scans code, dependencies, Kubernetes and internal networks in an EU-hosted platform.
| Criterion |  |
Intruder |
|---|---|---|
| Data residency | EU-hosted | UK-hosted |
| Built-in scanning coverage |
|
|
| Compliance support |
|
|
| Remediation and evidence |
|
|
| Internal scanning |
|
|
| Web app pricing | Each web app counts as one target, like a host | Each web app is a separate licence on top of infrastructure targets |
| Comparable monthly cost | €139/month | €387/month |
Prices cover five hosts and two web apps on monthly billing, excluding tax: Vornin Team and Intruder Cloud. Included features differ.
How each platform handles vulnerability management
Intruder
Intruder combines infrastructure, web app and cloud scanning with attack-surface monitoring, emerging threat scans, AI issue triage and team integrations. It describes itself as always-on exposure management.
- Scan Vornin: Network, web, code and cloud Intruder: Network, web, API and cloud
- Prioritise Vornin: CVSS, EPSS, CISA KEV Intruder: CVSS, EPSS, CISA KEV
- Assign Vornin: Finding owners Intruder: Ticket integrations (partial)
- Deadlines Vornin: SLA with escalation Intruder: Overdue status, no escalation (partial)
- Verify fix Vornin: Rescans verify fixes Intruder: Remediation scans
- Evidence Vornin: Mapped to compliance controls Intruder: Scan reports, Drata and Vanta upload (partial)
What five hosts and two web apps cost to scan
Five hosts and two web apps, with authenticated web app scans: €139/month with Vornin Team or €387/month with Intruder Cloud.
| Platform | Monthly price | Included in this comparison |
|---|---|---|
|
€139 |
|
| Intruder | €387 |
|
Monthly list prices, excluding tax. Internal scanning on Intruder needs its Pro plan, from €434/month, and uses an endpoint agent on each device. Intruder's AI pentests are a separate product, priced from €3,000 per test, and not part of the plans compared here.
Each web app is a separate licence on Intruder Cloud. At five hosts, its price rises from €260/month with no web apps to €865 with 10 and €1,310 with 20. Vornin counts each web app as one target: €129, €179 and €229/month for the same mixes on Team.
| Web apps | Vornin Team | Intruder Cloud |
|---|---|---|
| 0 | €129 | €260 |
| 1 | €134 | €324 |
| 2 | €139 | €387 |
| 3 | €144 | €451 |
| 5 | €154 | €578 |
| 10 | €179 | €865 |
| 20 | €229 | €1,310 |
- External scanning
- Internal network
- Code
- Dependencies
- Secrets in code
- Containers
- Kubernetes
- Cloud configuration
- Endpoint agents (not included)
Intruder
- External scanning
- Containers
- Cloud configuration
- Endpoint agents on Pro and above
Surfaces that need another tool with Intruder Not included
- Internal network
- Code
- Dependencies
- Secrets in code
- Kubernetes
Web apps and pricing as you grow
Intruder Cloud adds €63.66/month for each of the first five web apps, then less per app. Vornin Team adds €5/month per target from the sixth to the fiftieth, whether it is a host or a web app.
Reporting and audit evidence
Both provide PDF reports and CSV exports. Intruder sends scan reports to Drata or Vanta as evidence. Vornin maps each finding to compliance controls and keeps a tamper-evident finding history.
Stack coverage
Vornin includes code, dependency, container, Kubernetes and cloud scanning in the price shown. With Intruder Cloud, factor in the tools for code, dependencies, Kubernetes and internal networks.
Choose for your scanning and compliance needs
Choose if
- You need evidence for your IT audit and ISMS: findings mapped to compliance controls, with tamper-evident history.
- You need a European vendor and EU data residency.
- You want code, dependency, Kubernetes and internal network findings alongside network, web and cloud findings, without a second scanning tool.
- You need a persistent finding record from discovery to verified fix, with owners, deadlines and decisions kept together.
- You scan several web apps. Vornin counts each one as a single target.
Choose Intruder if
- You want free scheduled external scanning. Intruder's Free plan covers five infrastructure targets with one scheduled scan a month.
- You need endpoint agents for Windows, Linux and macOS devices and do not already run one. Intruder includes them on Pro and above; Vornin has no endpoint agent.
- Your compliance evidence already lives in Drata or Vanta. Intruder uploads scan reports to both.
- You want AI pentests of your web apps alongside scanning. Intruder sells them per test.
Scan coverage and workflow
- Attack-surface monitoring
- Network and ports
- Web apps and APIs
- SSL/TLS
- DNS and email
- Subdomains
- Source code
- Dependencies
- Secrets in code
- Infrastructure as code
- Containers
- Kubernetes
- Cloud configuration
- Internal network
- Endpoints (not included)
Intruder
- Attack-surface monitoring
- Network and ports
- Web apps and APIs
- SSL/TLS
- DNS and email (not included)
- Subdomains (partial)
- Source code (partial)
- Dependencies (not included)
- Secrets in code (not included)
- Infrastructure as code (not included)
- Containers
- Kubernetes (not included)
- Cloud configuration
- Internal network (not included)
- Endpoints
| Capability | |
Intruder |
|---|---|---|
| Scanning | ||
| Attack-surface monitoring | Yes | Yes; unknown-asset discovery on Enterprise |
| Network and port scanning | Yes | Yes |
| Web app and API scanning | Yes, including authenticated scans | Yes, including authenticated scans; licensed per web app |
| SSL/TLS | Yes | Yes |
| DNS and email security | Yes | No |
| Subdomain discovery and takeover | Yes | Subdomain discovery on Enterprise only |
| Source code (SAST) | Yes | Only inside AI pentests, priced per test |
| Dependencies (SCA) | Yes | No; vulnerable packages found only in container images and on agent hosts |
| Secrets in code | Yes | No; detects secrets exposed on live web apps and infrastructure |
| Infrastructure as code | Yes | No standalone scanning |
| Container images | Yes | Yes, from connected registries |
| Kubernetes | Yes | No |
| Cloud configuration | Yes, AWS, Azure and Google Cloud | Yes, AWS, Azure and Google Cloud |
| Internal network scanning | Yes, through an on-premise agent | No network-position scanner |
| Endpoint agents | No | Yes, on Pro and above |
| Prioritisation and remediation | ||
| Risk-based prioritisation | CVSS, EPSS, CISA KEV (known exploited vulnerabilities) and dependency reachability | CVSS, EPSS and CISA KEV; cyber hygiene score |
| Ownership and risk decisions | Finding owners; risk acceptance with approval and review dates | Snooze as accepted risk, false positive or mitigated; no finding owners |
| Findings deduplicated across scanners | Yes | No |
| SLA deadlines and escalation | Yes, with automatic escalation | Remediation windows with an overdue status; no escalation |
| Engineering integrations | Issue creation in Jira Cloud, GitHub, GitLab and Azure DevOps; API and webhooks | Jira, ServiceNow, Azure DevOps, Linear, Zapier and API on paid plans |
| Reporting and compliance evidence | ||
| Custom reports, PDF reports and CSV exports | Yes; executive, technical, auditor and scan-comparison reports | PDF reports filtered by target or date; CSV issue exports |
| Findings mapped to compliance controls | Yes, nine frameworks, including SOC 2, ISO 27001, GDPR, NIS2 and DORA | No |
| Tamper-evident finding history | Yes | No |
| Auditor evidence pack | Yes, evidence packs scoped to an audit period | No audit-trail evidence pack; scan reports upload to Drata and Vanta |
| Data residency | ||
| Hosting | EU | UK |
IncludedNot includedPartial
A capability Intruder publishes nothing about is marked No. Feature access varies by subscription.
Compare audit evidence, data residency and fix tracking
Evidence you can hand an auditor
- Custom reports, PDF reports and CSV exports; executive, technical, auditor and scan-comparison views
- Custom reports scoped to selected assets or groups, with white-label options
- Finding history mapped to nine compliance frameworks, with tamper-evident records
- Audit-readiness checks, manual attestations and period-scoped evidence packs
Intruder
- PDF reports and CSV issue exports; Intruder says its reports are not tailored to specific compliance standards
- Scan reports sent to Drata or Vanta as vulnerability-scan evidence, using your Drata or Vanta account
- No finding-to-control mapping or tamper-evident history
- No audit-trail evidence pack
If your evidence already lives in Drata or Vanta, Intruder fits that workflow. If an auditor asks what was found, fixed and accepted for each control, compare the records each platform keeps.
EU jurisdiction and data residency
- European company with no US office or parent, outside US CLOUD Act jurisdiction
- Scan results, findings and audit evidence stored in the EU under EU law
Intruder
- UK company hosting its service on Google Cloud in London
- EU personal data can flow to the UK under the EU's UK adequacy decision, renewed in December 2025 until December 2031
Tip: Check both data location and legal jurisdiction against procurement requirements.
Coverage across attack vectors
- Attack surface, network, web application, API and cloud configuration scanning
- Built-in scanning for source code, dependencies, secrets, infrastructure as code, containers and Kubernetes
- Internal network scanning through a customer agent; no endpoint agents
Intruder
- Attack surface, network, web application, API and cloud configuration scanning, plus container images
- No code, dependency, infrastructure-as-code or Kubernetes scanning in its plans
- Endpoint agents on Pro and above; no network-position internal scanner
Vornin includes code, dependency, Kubernetes and internal network scanning in one platform. Intruder adds endpoint agents.
From finding to verified fix
- Keep a persistent finding record across scans, with owners, deadlines and risk decisions
- Track deadlines and escalate overdue work
- Successful rescans verify fixes; manual closures and accepted risks remain distinct
- Create issues in Jira Cloud, GitHub, GitLab and Azure DevOps
Intruder
- Track issues as current, snoozed or fixed, with first-detected and fixed dates
- Remediation windows by severity with an overdue status; no escalation (partial)
- Remediation scans recheck one issue on demand; snoozes record accepted risk, false positives or mitigations
- Send issues to Jira, ServiceNow, Azure DevOps or Linear
Compare how work is assigned, how deadlines are enforced and what remains as proof after a fix.
Intruder comparison FAQ
Is Vornin an Intruder alternative?
Yes. Vornin offers self-serve vulnerability management with EU hosting, compliance mapping and code and cloud scanning. Intruder is stronger when you need endpoint agents or a free plan with more scan targets.
What is the main difference between Vornin and Intruder?
Vornin is a vulnerability management platform; Intruder centres on exposure scanning across infrastructure, web apps and cloud. Vornin adds code, dependency, Kubernetes and internal network scanning, tracks remediation against SLA deadlines with escalation, verifies fixes and maps findings to compliance controls, all EU-hosted. It also counts each web app as one target, where Intruder charges a separate licence per web app. Intruder offers endpoint agents on higher plans, plus a free plan with more scan targets.
When is Intruder better than Vornin?
Intruder fits better when you need:
- Endpoint agents for Windows, Linux and macOS devices, on Pro and above
- AI pentests of your web apps, priced per test
- Free scheduled external scanning for five infrastructure targets
- Scan reports sent straight to Drata or Vanta
Is Intruder free, and how does it compare to Vornin Free?
Intruder has a free plan with more scan targets than Vornin Free. It covers five external infrastructure targets with one scheduled scan a month, but no web app or API targets, and its reports are watermarked. Intruder describes them as SOC 2-compatible proof that your external infrastructure has been scanned, also useful for ISO 27001 work. Vornin Free covers three targets with on-demand web and network scans, AI triage, tamper-evident finding history and a preview of one compliance framework.
Comparison details
Sources: Intruder's homepage, pricing page and plan guide. Last verified .
Comparison based on public documentation, not hands-on testing. Vornin is not affiliated with Intruder.
Vulnerability management with audit evidence
Start with a free scan. Paid plans use public, target-based pricing.
Read-only access Working scan data deleted after each scan EU-hosted