Intruder and Bastion get shortlisted together because both promise to watch your external perimeter and both market to teams smaller than an enterprise SOC. But they answer different questions: Intruder asks "do your systems have known vulnerabilities?"; Bastion asks "what does the internet see of you, and did it change?" This comparison comes from the Bastion team — we have kept the Intruder facts general and fair; confirm specifics with them.
What each product is
Intruder (London) runs authenticated and unauthenticated vulnerability scans against your external and internal targets, using established scanning engines under a much friendlier interface than raw Nessus. It adds continuous network monitoring, emerging-threat scans when new CVEs land, and attack surface discovery. Reports map cleanly onto compliance frameworks (SOC 2, ISO 27001), which is a big part of its appeal.
Bastion performs passive external checks only: HTTP security headers, TLS and certificate health, DNS and email authentication (SPF/DMARC/CAA), subdomain discovery from certificate transparency logs, lookalike-domain registrations, registration expiry, and TCP connect checks of common ports. Everything is scored, evidenced, and — most importantly — diffed over time, with alerts when the surface changes.
Head to head
| Bastion | Intruder | |
|---|---|---|
| Primary job | External posture + change detection | Vulnerability scanning (CVE-class findings) |
| Method | Passive observation only | Active probing, optionally authenticated |
| Emerging CVE response | Not applicable — no CVE scanning | Proactive scans when new threats emerge |
| Certificate / DNS / email-auth drift | Core focus, alerted on change | Covered partially via checks |
| Compliance evidence | Posture PDF + evidence pack | Strong SOC 2 / ISO 27001 reporting story |
| Setup | Add domain, publish one TXT record | Add targets; agents/integrations optional |
| Pricing (as of this writing) | From $25/month | Roughly $100+/month depending on targets and plan |
Choose Intruder if…
- A customer, auditor or framework explicitly requires vulnerability scanning with CVE coverage. Passive monitoring does not satisfy that requirement.
- You run your own servers or VMs whose patch level you must verify from the outside (and inside, with agents).
- You want emerging-threat scans — when the next big CVE drops, Intruder checks whether you are exposed.
Choose Bastion if…
- Your infrastructure is mostly managed platforms (Vercel, AWS managed services, shared hosting, SaaS) where OS-level CVEs are the provider's problem, but DNS, certificates, headers and email authentication are still yours.
- You care most about drift: the subdomain someone added, the SPF record that got broader, the port that opened overnight.
- You want something a non-security engineer reads in two minutes — one score, what changed, and the exact fix per finding.
- You are watching multiple client domains and want per-domain PDF reports at agency-friendly pricing.
The honest bottom line
These tools overlap less than their marketing suggests. Intruder is a better vulnerability scanner than Bastion will ever be, because Bastion is not one. Bastion is a sharper, cheaper external drift monitor than a scanner-first platform, because that is all it does. Decide based on which failure you are more likely to actually have: an unpatched CVE on a machine you administer, or a quiet configuration change nobody noticed.
Frequently asked questions
Does Bastion scan for CVEs like Intruder does?
No. Bastion performs no active vulnerability probing and does not test for CVEs. It monitors what your domains expose — TLS, certificates, DNS, email authentication, HTTP security headers and answering ports — and alerts on changes. If you need CVE scanning for compliance, use a vulnerability scanner such as Intruder alongside or instead of Bastion.
Is Intruder overkill for a small SaaS on managed hosting?
Often, yes. If your provider patches the operating system and you have no self-administered servers, most CVE findings are not actionable by you — but expiring certificates, weak SPF and DMARC, missing security headers and surprise subdomains still are. That configuration layer is exactly what passive monitoring covers.
Can Bastion and Intruder be used together?
Yes, and the combination is coherent: Intruder for scheduled vulnerability scanning of the assets you administer, Bastion for continuous passive monitoring and change alerts across every domain you own. They answer different questions and do not duplicate spend.