Kit vs Intigriti: Researcher services and VDP tools
Intigriti provides a researcher community and validates findings before your team sees them. Kit gives your team the intake, deadlines and bounty paperwork to handle reports itself.
Which fits your team?
Kit fits teams that need:
- A record of their disclosure process
- Published monthly billing
- Deadlines for whoever answers reports on top of their job
- Response and resolution metrics
- Bounty records and tax form collection
Intigriti fits teams that need:
- Outside researchers testing their assets
- Validated vulnerability findings
- Managed triage
- A contracted testing service
- Pentesting or live hacking services
- Vendor ISO 27001 certification
What Intigriti does well
Researchers, a documented API and vendor certifications.
Researchers and validated findings
Intigriti reports more than 150,000 vetted researchers. Managed triage validates findings before forwarding them to your team.
In practice: Kit provides neither researcher recruitment nor validation services.
A company REST API
Intigriti's API exposes proof of concept, impact, proposed fixes, attachments and CVSS vectors. It also documents write operations and signed webhooks.
In practice: Your team can export report details or connect them to internal systems.
Vendor certifications
Intigriti is based in Belgium and advertises ISO 27001 and SOC 2 certification.
In practice: Its vendor reports may satisfy procurement requirements that Kit cannot meet today.
What Kit includes
Each report gets a deadline and a reminder, so none sits unanswered while you ship. Kit brings no researchers or managed triage.
Researchers see missing payout paperwork
The report page shows whether an agreement, tax form or payout details are missing. Researchers accept the recorded agreement by clicking a button. Rejected tax forms include a reason.
Researchers can complete the missing step from their own report page.
Bounty records and masked payout details
Kit requests payout details after a bounty is approved and masks the saved details for staff. Each award enters a ledger that prevents edits to existing entries.
You can trace the award and its paperwork. Your team still sends the payment.
The next action on each report
Kit highlights the current step: Assignment, Assessment, Decision or Bounty. Moving a report backward requires a comment. Idle reports trigger reminders, then an escalation to admins.
The report shows what needs doing, and its owner cannot mute the final escalation.
Published monthly pricing
The Security workflow is included in every Kit seat.
You can calculate the subscription cost before contacting sales.
What Kit doesn't have
Check these limits before choosing Kit.
A researcher crowd and managed triage
Intigriti reports more than 150,000 vetted researchers and offers validation of findings. Kit recruits no researchers and provides no managed triage.
Will we add it? No. Kit will not recruit researchers or run a triage service.
Researcher accounts and reputation
Intigriti researchers create accounts and build a reputation across programs. Kit identifies researchers from their first report and gives them access by email link.
Will we add it? Kit has karma scores and an optional Hall of Fame. Researcher self-signup and SSO are not planned.
A security REST API
Intigriti's company API returns report bodies, proof of concept, CVSS vectors and attachments. Kit's security queue uses MCP and webhooks, with no REST API.
Will we add it? A security REST API is under consideration, but not scheduled.
Vendor certifications
Intigriti advertises ISO 27001 and SOC 2 certification. Kit holds neither and hosts its application on one server in Nuremberg.
Will we add it? SOC 2 is on Kit's roadmap. Do not choose Kit if procurement requires it today.
How each works
The difference in day-to-day use.
Tools for incoming reports
Every $8 Kit seat includes the Security workflow: intake, triage, SLAs, bounty records, and exports. Your team validates findings and handles any payouts.
Research and validation services
Intigriti brings researchers to a defined scope and validates their findings. The service is scoped with sales and suits teams buying outside testing and triage.
Plans and costs
Kit
$8/seat/month
Security workflow included in the $8/seat/month Kit subscription
- Security workflow included in every seat
- Triage board, ledger, bounties and custom domain included
- Anonymous submissions and an embeddable intake form
- 72-hour acknowledgment clock and response-time reporting
- Monthly billing, no annual commitment, cancel self-serve
Intigriti
Request pricing (all three tiers)
Intigriti publishes no prices for its tiers
- Core, Premium and Enterprise require a quote
- Priced by sales; Intigriti says you pay only for findings its triage team validates
- REST API and integrations included in each package
Plans and costs
Kit publishes its $8/seat/month price and includes the Security workflow. Your team handles triage and any bounty payments.
Switching from Intigriti?
Consider Kit for:
- Evidence of your disclosure process
- Published monthly pricing
- A security.txt, policy page and intake form
- Triage handled by your own engineers
- Bounty records and researcher paperwork
Stay with Intigriti if:
- Want its researchers testing your scope
- Need validated findings before engineering review
- Require vendor ISO 27001 certification
- Need full report access over REST
Data portability: Intigriti's API provides report details and history. Its batch CSV omits proof of concept, impact, messages and attachments. Plan the export before leaving.
$8€6,9929,99 zł£5.99 per seat, per month
Get started free