ConnectSecure, Intruder, Qualys and Rapid7

About Intruder

Intruder sells a single platform for continuous scanning across infrastructure, apps and cloud environments. Intruder was founded in 2015 by Chris Wallis to help solve the information overload crisis in vulnerability management. Intruder Systems Ltd completed the AICPA Service Organization Control (SOC) 2 Type 2 audit. The Intruder portal runs as a SaaS environment with logical data separation between clients' datasets.^[5]

Intruder runs emerging threat scans within hours of new critical vulnerabilities going public. Intruder checks systems for 170,000+ infrastructure weaknesses, 75+ web-layer security issues and other misconfigurations. Intruder emerging threat scans check systems for newly discovered vulnerabilities automatically, as soon as a check is available. Intruder is powered by scanners including Tenable, Nuclei, OpenVas, and ZAP. Intruder offers internal target scanning only on the Pro and Enterprise plans.^[6][7]

Intruder describes attack surface management as the continuous process of discovering, assessing, and reducing every digital asset an attacker can reach, including systems that are unknown or unmanaged. Port scans run daily in Intruder to track what is exposed. New service scans trigger in Intruder when something in the environment changes, and emerging threat scans run when a major new vulnerability is disclosed. The Intruder attack surface view shows every monitored port, the service running on it, and the version behind it, with a screenshot of each web service. Users of the Intruder attack surface view can search or filter by port, service, product, host status, or certificate expiry.^[1][8]

Intruder cloud security needs no agents and connects to AWS, Azure, and Google Cloud accounts. Intruder connects to cloud accounts using read-only access, and nothing is deployed into the infrastructure. Intruder scans container images at the registry level. Intruder shows cloud misconfigurations, exposed secrets, insecure permissions, CVEs, and attack surface issues in one place.^[8][9]

A ZAP-powered scanner in Intruder runs over 75 application checks for injection flaws, misconfigurations and zero-days. The same Intruder scanner integrates with CI/CD pipelines through GitHub, GitLab, Jira and Azure DevOps, and prioritizes results with remediation advice.

Intruder takes a white-box approach, working from source code. Intruder's agents are built and trained by CREST-certified pentesters and validate every finding against the application. Intruder delivers AI pentest results in a report containing an executive summary, full technical details, and remediation guidance. Intruder formats the AI pentest report to serve as compliance evidence for frameworks like SOC 2, ISO 27001, PCI DSS, and Cyber Essentials. Intruder also connects to a Bitbucket code repo to run a pentest on demand.^[10][11]

Intruder integrates with Jira, GitHub, GitLab, Azure DevOps, and ServiceNow for issue tracking, Slack and Microsoft Teams for alerts, Drata and Vanta for compliance, and Microsoft Sentinel for SIEM. Intruder syncs container images from Docker Hub accounts for scanning. Intruder syncs targets from a Cloudflare environment and scans them for vulnerabilities. Intruder supports Okta SSO for authenticating users. Intruder prices the Cloud and Pro plans as a base fee plus a fee-per-target. Intruder quotes Enterprise pricing separately, because it depends on requirements and the size and complexity of the customer's systems. Customers can choose either a monthly rolling plan, which can be cancelled at any time, or an annual plan.^[7][9][11]

Ravelin uses Intruder for continuous vulnerability scanning of its payment systems. Brainlabs relies on Intruder to find unknowns as new acquisitions reshape its attack surface. Hill & Smith uses Intruder to uncover hidden assets and expand visibility of its attack surface. Litmus uses Intruder to automate security and protect customer data. Surveil partnered with Intruder to gain attack surface visibility.^{[1][7][8][9][10]}

About Qualys

Qualys provides the Enterprise TruRisk Platform, an end-to-end solution for all aspects of IT, security and compliance. The Enterprise TruRisk Platform is a suite of apps integrated into a single platform. Enterprise TruRisk Platform apps natively share the data they collect, so the financial impact of a security posture can be expressed in real time. Qualys is a SaaS security company with 25 years of history.^[2]

Qualys states that frontier AI weaponizes vulnerabilities in hours while patch cycles run in weeks. Qualys proposes an operating model of AI-Speed Detection, Hyper-Prioritization and Zero-Day Remediation. Qualys builds AI agents into Enterprise TruRisk Management for prioritizing, remediating and eliminating risks.^[2]

TruRisk Eliminate 2.0 is the Autonomous RemOps platform from Qualys. TruRisk Eliminate 2.0 runs on TruConfidence, a Remediation Intelligence and Orchestration Engine. TruRisk Eliminate 2.0 decides on and executes remediation paths across the attack surface. InstaScan matches each disclosed CVE against a live inventory in real time to show exposure.^[2]

Qualys addresses AI that an organisation does not know about, assessing what that AI can expose, access and do.^[2]

Policy Audit uses improved control statements that describe the intent of each control. Some control statements include the technology name. Control checks apply to Windows services, Linux files, Oracle parameters and network device configurations. Control statements appear in the control library and control details. Control statements appear in posture results and evaluation output. Integrations can reference controls by CID, and those integrations are not affected by the statement change. Improved control statements are the first step in an effort to change how Policy Audit controls are described, rated and organised. Upcoming releases are planned to add consistent, formula-based criticality ratings.

Improved control statements apply to subscriptions on the Shared Cloud Platform (SCP), while Private Cloud Platform (PCP) subscriptions follow a separate release cycle. The improved control statements setting applies at the subscription level, and once it is enabled all users in the subscription see the updated statements. Until April 2027, a Manager or POC Manager can switch back to the previous control statements.

Qualys offers a FedRAMP High Authorized platform for VMDR and CNAPP that is aimed at NIST 800-53 requirements.^[2]

About Rapid7

Rapid7 sells the Command Platform, which runs cloud security, SIEM, application security, vulnerability management, automation and attack surface management solutions, along with managed services offerings built on these solutions. Rapid7 provides Managed Vulnerability Management, Managed Threat Complete and Managed Detection & Response. Rapid7 offers 24x7 XDR monitoring, remediation and DFIR from experts who extend a customer's team. Rapid7 Insight products can be used individually or together for a tailored security solution.^[1][3][4][5]

Rapid7 exposure management provides continuous assessment of an attack surface to validate vulnerabilities and policy gaps. Rapid7 attack surface management gives a unified view of assets across a digital estate, with native and third-party enrichment. Rapid7 attack surface management discovers unknown internet-facing and internal assets and uncovers shadow IT and coverage gaps. Rapid7 uses that asset context in Exposure Command to prioritize what attackers can reach. Rapid7 attack surface management includes external scans that detect and validate exposures while highlighting high-risk areas. Rapid7 continuous monitoring and discovery cover internal and external asset inventories. Rapid7 offers multi-cloud and container security for AWS, Azure, GCP and K8s. Rapid7 offers application and API security testing covering DAST, API and LLM.^[4][6]

Rapid7 vulnerability management uses agent-based and network scanning across hybrid environments. Rapid7 cloud security addresses multi-cloud environments and provides cloud risk monitoring and detection. Rapid7 threat intelligence includes mapping capabilities for discovering and remediating external threats. Rapid7 Intelligence curates emergent threat response, proprietary intelligence, research and adversary insights that are deployed across Rapid7 solutions and services.^[4][6]

Threat Command monitors the clear, deep, and dark web to identify risks before they become attacks. Rapid7 provides proactive clear, deep and dark web monitoring for threats to an organization, its employees and its customers. Rapid7 offers a dynamic asset mapping framework that tracks a customer's evolving digital footprint and identifies new potential attack vectors. Threat Command takes on takedown management for organizations. A dedicated Rapid7 team gathers prerequisites, accelerates requests and streamlines workflows with a customer's legal team.^[7]

Rapid7 offers technology and service add-ons that extend MDR capabilities. Rapid7 offers expert threat detection coverage to identify early threat signals across the clear, deep and dark web. Rapid7 MDR pricing is based on the number of endpoints, servers and networks protected, and not on data volume ingested into its SIEM or the number of incidents requiring response.^[8]

Rapid7 penetration testing services simulate real-world attacks to assess, evaluate and identify security weaknesses in an organization's people, processes and technology. Rapid7 testers inspect networks, applications, devices and/or people to demonstrate the security level of key systems and infrastructure. Rapid7 penetration testing engagements identify flaws that may violate compliance provisions or regulations. Rapid7 penetration testers contribute directly to the Metasploit Project. Rapid7 consultants spend up to 20% of bench time focused on attacker research and skill development. Rapid7 offers continuous red team operations to validate external attack surface exposures and test defenses. Metasploit validates vulnerabilities and enables phishing and broader social engineering. Rapid7 typically publishes advisories on newly discovered vulnerabilities approximately 60 days after its initial attempts at private disclosure.^[9][10][11]

Rapid7 is a publicly traded company and undergoes SOX audits annually. Rapid7 undergoes a SOC 2 Type II audit annually to ensure the effectiveness of controls relevant to security. Rapid7's ISMS is ISO 27001 certified and was audited by Schellman. Rapid7's AIMS is ISO/IEC 42001 certified in the role of an AI provider. Rapid7 has completed an Information Security Registered Assessors Program (IRAP) assessment to PROTECTED Level for several Insight Platform solutions. Rapid7 undergoes an annual, independent technical assessment by an accredited assessor to hold Cyber Essentials Plus certification. Rapid7 hosts its Insight cloud infrastructure in AWS. Rapid7 participates in and has certified compliance with the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, and UK Extension to the EU-U.S. Data Privacy Framework.^[4][8][11]