Closing the visibility gap: Intruder improves automated asset discovery to help security teams tackle Shadow IT. For many organizations, Shadow IT has become the silent saboteur of security strategy. As teams innovate and deploy new systems at speed, assets are spun up - often outside the purview of IT or security. These unmonitored systems, unknown subdomains, and forgotten services expand an organization's attack surface without anyone realizing it. Attackers, however, are all too aware. Every forgotten subdomain or unsecured service represents a potential entry point. And while defenders are busy protecting the systems they know about, it's the ones they don't that often lead to compromise. Recognizing this growing visibility gap, Intruder has integrated with DomainTools to deliver enhanced attack surface discovery capabilities to help Enterprise plan customers uncover and secure the unseen corners of their external perimeter. Illuminating blind spots in your Attack Surface. Intruder's new integration with DomainTools leverages access to the FarSight database, the world's largest and most trusted repository of domain and DNS data, to power broader, deeper attack surface discovery coverage. By integrating Passive DNS (pDNS) data from FarSight directly into Intruder's Attack Surface Management (ASM) platform, Enterprise customers now benefit from the enhanced ability to automatically detect and secure subdomains that were previously invisible to their exposure management program. This upgrade adds a vital new dimension to Intruder's existing discovery methods, which previously relied primarily on certificate transparency logs. With the addition of Passive DNS, Intruder can now surface assets that have appeared historically or in less obvious corners of an organization's domain footprint. It's these assets that are often the root of Shadow IT issues. Reality check: attack surfaces are sprawling. During an initial pilot involving 60 Intruder customers, every single one saw an increase in the number of related subdomains detected. * 44% of customers discovered more than 10 additional subdomains. * 23% identified over 50 new subdomains. * For some large enterprises, the FarSight integration surfaced hundreds of thousands of related subdomains - and in one case, over a million. These results underscore a sobering truth: the digital estates of modern organizations are ever changing and far larger than most realize. Without continuous insight into their attack surface, even the best security programs can leave dangerous blind spots. Managing the Shadow IT challenge. Shadow IT refers to the systems, services, and infrastructure spun up without the knowledge, or approval, of the teams responsible for security. These assets might be created by developers testing a new idea, by marketing teams deploying a campaign site, or by external vendors integrating with production systems. Regardless of intent, the result is the same: unknown systems that can be discovered and exploited by attackers. Even minor misconfigurations or unpatched vulnerabilities on those machines can lead to serious breaches. One of the most effective ways to fight Shadow IT is by monitoring subdomain creation. New web services nearly always require a subdomain, making them a reliable signal for the existence of new assets. By continuously enumerating and analyzing subdomains, organizations can identify unauthorized systems early and bring them under management, before they become a liability. A more complete picture of risk. By integrating with DomainTools' FarSight database, Intruder now offers its Enterprise customers a best-in-class view of their external attack surface. The enhanced coverage allows organizations to: * Automatically discover unknown subdomains in their estates * Identify and secure Shadow IT assets before attackers do * Maintain continuous visibility across dynamic, distributed environments * Streamline security workflows with a unified exposure management platform For lean security teams trying to stay ahead of threats, this combination delivers the confidence that comes from knowing you've got eyes across your full perimeter. Uncover Shadow IT in your estate with Intruder. Intruder's enhanced asset discovery represents a major step toward closing the visibility gap caused by Shadow IT. To explore how Intruder's Attack Surface Management capabilities can help protect your organization, book an introductory call with one of its experts. Get its free. Ultimate guide to vulnerability scanning. Learn everything you need to get started with vulnerability scanning and how to get the most out of your chosen product with its free PDF guide.

Intruder partners with DomainTools to deliver best-in-class Attack Surface discovery and close the visibility gap on organizations' full external perimeters. * Intruder has partnered with DomainTools to get access to the FarSight database (the world's largest and most trusted domain database) and deliver substantially broader attack surface discovery coverage. * In the initial pilot program of 60 Intruder customers, 100 percent saw an increase in the number of related subdomains detected by Intruder. * Customers on the Enterprise plan will have much better visibility of their extended networks with automatic discovery and securing of new and unknown assets to combat threats created via Shadow IT. LONDON-(BUSINESS WIRE)-Intruder, a leader in exposure management, today announced a partnership with DomainTools, the global leader in domain and DNS threat intelligence, to utilize its FarSight database and upgrade the Intruder Attack Surface Management (ASM) platform to illuminate customers' entire attack surface with the best database available for attack surface discovery. Enterprise plan customers are now equipped to automatically detect related subdomains that are not being monitored within an existing exposure management program. Intruder's ASM now integrates Passive DNS (pDNS) data to provide broader coverage and visibility on top of their existing capabilities focused on certificate transparency and active domain name system (DNS) data. Security and IT teams can now automatically discover and secure assets that are not already integrated into their exposure management program - and in doing so help combat the threats emanating from the misconfiguration and accidental exposure of Shadow IT. In the initial pilot program of 60 Intruder customers, 100 percent saw an increase in the number of related subdomains detected by Intruder. 44 percent saw more than 10 additional subdomains detected and 23 percent saw more than 50 detected. For several of the largest estates analyzed in the pilot, access to the FarSight database enumerated hundreds of thousands of related subdomains (and in one case over a million). This shows the breadth of the enterprise attack surface that defenders have to deal with, and underpins the essential need for tools like this. "Incorporating FarSight into Intruder's offering is more than just a new advantage for our customers to secure their external perimeters with confidence but an important step in our company's philosophy," said Andy Hornegold, vice president of product at Intruder. "Building platforms that handle multiple relevant functions and equip teams to quickly close their vulnerability gaps is far more effective than manual processes or integrations between disparate point solutions. The platformization of security represents a crucial step forward for IT teams to manage increasingly complex infrastructures and fight off increasingly sophisticated attackers." Shadow IT refers to systems developed within an organization which are unknown to the team responsible for security. Though there may be policies to prevent them from being created, there are always ways in which systems slip through the gaps. Unfortunately, these hosts are still discoverable to attackers and even simple weaknesses on those machines will leave organizations both exposed and completely in the dark. One important element of the battle against Shadow IT is to have tools in place which can enumerate subdomains that are in use by an organization. Developers may be able to create new systems and servers at will, but to make web services accessible and secure, they'll need a subdomain for the host. Once these subdomains are identified, vulnerability scans help defenders detect weaknesses before attackers do. More information about the partnership with DomainTools can be found on Intruder's company blog. Security and IT teams interested in learning more about Intruder Attack Surface Management can book an introductory call here. About DomainTools DomainTools is the global leader for Internet intelligence and the first place security practitioners go when they need to know. The world's most advanced security teams use our solutions to identify external risks, investigate threats, and proactively protect their organizations in a constantly evolving threat landscape. For more information, visit https://www.domaintools.com. About Intruder Intruder's exposure management platform helps lean security teams stop breaches before they start by proactively discovering attack surface weaknesses. By unifying attack surface management, cloud security and continuous vulnerability management in one intuitive platform, Intruder makes it easy to stay secure by cutting through the noise and complexity. Founded in 2015 by Chris Wallis, a former ethical hacker turned corporate blue teamer, Intruder is now protecting over 3,000 companies worldwide. Learn more at https://intruder.io. Q&A: Intruder's Asset Discovery Upgrades Explained Q: What is the partnership between Intruder and DomainTools? Intruder has partnered with DomainTools to get access to the FarSight database (the world's largest and most trusted domain database) and deliver substantially broader attack surface discovery coverage. Customers on the Enterprise plan will have much better visibility of their extended networks with automatic discovery and securing of new and unknown assets to combat threats created via Shadow IT. Q: What cybersecurity issue does this partnership resolve? The proliferation of Shadow IT across organizations has created a crisis of misconfigurations and accidental exposures that can be easily exploited to damage businesses. Intruder's ASM now integrates Passive DNS (pDNS) data to provide broader coverage and visibility on top of their existing capabilities focused on certificate transparency and active domain name system (DNS) data. Security and IT teams can now automatically discover and secure assets that are not already integrated into their exposure management program - and in doing so help combat the threats emanating from misconfigurations and accidental exposures caused by Shadow IT. More information about the partnership with DomainTools can be found on Intruder's company blog. Security teams interested in learning more about Intruder Attack Surface Management can book an introductory call here. Press Contact Treble Jim Cameron [email protected] More News From Intruder LONDON-( BUSINESS WIRE )-Intruder, a leader in exposure management, today announced it has been recognized as a Cloud Security Innovator in the 2025 Cloud Security Report by James Berthoty of Latio. Intruder was particularly recognized as an ideal platform in the Continuous Threat Exposure Management (CTEM) category for hybrid cloud environments and midmarket organizations. The 2025 Cloud Security Report offers insights into the evolution of cloud security, tracing the shift from posture-focuse... LONDON-( BUSINESS WIRE )-Intruder, a leader in exposure management, today announced the release of its 2025 Exposure Management Index, tracking the most critical vulnerabilities facing small and midsize businesses (SMBs) and how those organizations' responses are evolving over time. The Index equips SMBs with security insights that have historically been gated behind massive enterprise budgets and external consultants. "For small and mid cap organizations, cybersecurity is a structural challeng... LONDON-( BUSINESS WIRE )-Intruder, a leader in exposure management, today announced that it has been selected as winner of the "External Attack Surface Management Platform of the Year" award in the 9th annual CyberSecurity Breakthrough Awards program. Conducted by CyberSecurity Breakthrough, an independent market intelligence organization, the annual program recognizes the most innovative companies, products, and technologies driving progress in the global information security industry. Intrude... Press Contact Treble Jim Cameron [email protected]

DomainTools' analysis on newly observed domains in 2024 provides actionable insights into threat actor infrastructures.SEATTLE, April 24, 2025 /PRNewswire/ -- DomainTools, a leader in Domain and DNS intelligence, is proud to share DomainTools Investigations inaugural domain intelligence year-in-review report.In the cybersecurity community, it is generally accepted that the threat landscape is fast paced and ever-evolving. It turns out however that there are a few constants that rarely change: Domains and DNS are on top of that list. The purpose of this report is to illuminate Domain patterns and DNS infrastructure created by cybercriminals in order to collectively improve the community's defenses."As defenders, we tend to focus our limited resources on what happens after an attack has occurred - Did we get phished or brute-forced, was it ransomware, who might have done it etc.," said Daniel Schwalbe, chief information security officer and head of investigations at DomainTools. "But there is actually quite a bit that can be done before an attack occurs, just as the saying goes 'An ounce of prevention is worth a pound of cure.'"In 2024, over 106 million newly observed domains were seen - approximately 289,000 daily.These domains are created for a multitude of reasons, some nefarious ones include:Hosting websites to deliver malware and credential harvestingServe as Command and Control (C2) servers to manage compromised systemsOperate as part of botnets for large-scale attacksPhishing campaigns to deceive usersAnd moreKey Findings from the DomainTools Year In Review Domain Intelligence ReportNot every Domain created serves a sole purpose. There are patterns and connections that can be ascertained from observing this data. In DomainTools' report, findings included:Risk Scoring Detection Techniques : the likelihood of a Domain's proximity to malware, phishing, spam, etc