- Autonomous AI agents actively identify application security flaws and search for weaknesses across web applications via source code integration
- Built and trained by CREST-certified pentesters, AI agents reason through applications and adapt as they go, mirroring the approach of the best human testers and distilling it into an automated solution organizations can run on every release
- On-demand web app pentesting launches in minutes and completes in hours at 25% or less of the cost of a traditional manual engagement
LONDON — Intruder, a leader in exposure management, today announced the launch of AI Pentesting for web applications, providing on-demand penetration testing. Following its initial release of issue-level investigations last quarter, the platform now allows organizations to securely connect their codebases via GitHub or GitLab to automatically scope and launch penetration tests in minutes, with results and audit-ready reporting in hours.
Mythos and Daybreak have proven that AI is extremely adept at finding security vulnerabilities. At the same time, AI is accelerating attacker capability. Annual pentests do not offer organizations the same level of protection they once did, and are misaligned to the way businesses are shipping code today. Major deployments are happening weekly, and without more frequent pentesting, security and engineering risk falling dangerously out of step.
Stretched Teams, Faster Engineering
According to Intruder’s latest survey, The Security Middle Child Report, 49% of security leaders cite AI and automation as their top investment priority for 2026. Meanwhile, AI-assisted “vibe coding” is shipping insecure code faster. Engineering teams moving quickly with AI coding assistants are introducing new application vulnerabilities at pace, without sufficient security review, creating a growing need for continuous app testing.
AI-enabled security solutions are now essential for security teams. Embracing autonomous capabilities is the only viable path toward a truly continuous approach to security. This shift is critical in a world where the average time-to-exploit has collapsed to a single day, a window that is projected to drop further in the coming months.
“Our mission at Intruder has always been to make robust cybersecurity accessible to everyone,” said Andy Hornegold, Chief Security Technologist at Intruder. “Providing web application testing marks an exciting step on that journey. By delivering the depth of a pentest on demand and at a fraction of the price, we’re helping businesses keep up with an accelerating threat environment.”
On-Demand Pentesting
Intruder’s web application penetration testing is powered by autonomous AI agents that actively discover weaknesses across application ecosystems. Intruder’s AI Pentesting brings the strategic depth and creative problem-solving of a manual, human-led engagement into an automated framework that organizations can run on every release.
Designed to transform how modern engineering and security teams manage software risk, the framework delivers critical capabilities out of the box:
- White-box pentests: Pentesting agents have full awareness of the system they are testing by ingesting the codebase.
- Built by CREST-certified pentesters: Our pentests are run by AI built and trained by CREST-certified pentesters to operate and think like the best human pentesters.
- Tests in minutes: Pentests run in minutes to hours, depending on the complexity of the web application being tested. No scoping or scheduling.
- Audit-level reporting: A full pentest report is provided that can be used as evidence for SOC 2, ISO 27001 and other compliance frameworks.
- Affordable accessibility: Automated web application pentest costs 25% or less than a traditional manual engagement with results available in hours instead of weeks to months.
“Historically, the cost of a pentest has been very high and has taken a long time,” said Chris Wallis, CEO and founder at Intruder. “In today’s accelerated threat environment, that timeline and cost don’t hold up. We’re ensuring that resource-constrained small and medium-sized businesses aren’t excluded from good security purely based on budget.”
“Securing a global AI platform requires continuous defense,” said Zach Rattner, CTO and co-founder at Yembo. “While Yembo continues to leverage human pentesters, annual assessments alone leave dangerous windows of exposure. Intruder’s AI pentesting bridges that gap by delivering human-grade depth at machine speed to keep our platform permanently hardened.”
Full-Scale Web App Pentests Now Available
Prices start from $3,500 per test and Intruder is offering discounted introductory pricing for early adopters. Existing Intruder customers can receive web app pentest findings directly alongside their attack surface, cloud, and vulnerability data.
Pentests are now available to new and existing customers. Existing Intruder platform customers can buy pentests within their Intruder account by navigating to the “Pentests” tab. New customers can scope and run a pentest via the Free plan.
Security, IT, and developer teams interested in learning more about the Intruder platform and its latest offerings can book an introductory call here.
About Intruder
Intruder’s continuous exposure management platform helps security, IT, and engineering teams stop breaches before they start. By unifying AI penetration testing, attack surface monitoring, cloud security, and vulnerability management in one intuitive platform, Intruder gives stretched teams an always-on security source of truth. Our approach focuses on continuous automated scanning using expertise and agentic solutions to ensure that the findings we deliver are accurate, prioritized by real-world risk, and ready to act on.
Founded in 2015 by Chris Wallis, a former ethical hacker turned corporate blue teamer, Intruder is now protecting over 3,000 companies worldwide. Intruder has been awarded multiple accolades, was selected for GCHQ’s Cyber Accelerator, included on Deloitte’s Tech Fast 50 2023 list as the fastest-growing cybersecurity company in the UK and was named in G2’s 2026 Best Software Awards. Learn more at https://intruder.io and get real-time threat intelligence at https://cvemon.intruder.io
FAQs
Why is AI pentesting necessary to deal with today’s threat landscape?
According to Intruder’s Security Middle Child Report, 42% of midmarket security leaders describe their teams as stretched, overwhelmed, or consistently behind, while attackers are accelerating. Major deployments are happening weekly, and without more frequent pentesting security and engineering risk falling dangerously out of step. Intruder’s pentesting agents close that gap by delivering the depth of a manual pentest on-demand.
What is the difference between issue-level investigations and full-scale AI Pentesting?
Intruder’s initial AI release focused on issue-level investigations—using autonomous agents to validate individual scanner findings to eliminate false positives. This new release introduces full-scale, white-box web application pentests. By analyzing your entire codebase via GitHub or GitLab, the agents simulate a comprehensive, end-to-end human pentest and actively discover new vulnerabilities rather than just verifying old ones.
What is the best automated pentesting platform for midmarket security teams?
Intruder’s AI Pentesting gives stretched security teams access to manual-pentest depth without the cost or scheduling overhead of traditional engagements. The platform unifies attack surface management, vulnerability scanning, and now AI-driven discovery in a single interface. These full-scale web application pentests provide rigorous reporting usable as compliance and audit evidence for frameworks including SOC 2, ISO 27001, and other compliance frameworks.
