Resource · Sample Security Score report
Most "free scans" are sales funnels with a TLS check bolted on. Ours isn't. You get an executive summary, every finding documented with the underlying evidence, and a remediation list ranked by what to fix first. Here is the actual report we send back, anonymized.
One field. No password. No login. The scan starts inside your browser and queries only public data sources.
A composed report lands in your inbox: executive summary, findings by severity, evidence, and the recommended next step per finding.
Fix in-house, hand to your existing IT vendor, or book a 30-minute call to map findings to a service tier. No sales pressure either way.
Every check is a passive query against public records — DNS, certificate transparency logs, mail-authentication TXT records, HTTP response headers, published reputation feeds. We never log into anything you own and we never run intrusive tests.
These four findings are representative — anonymized from a real mid-market engagement. Every finding in the live report includes the underlying evidence (DNS record, header value, certificate fingerprint) so your team can verify.
Your domain advertises DMARC monitoring but does not reject failures. External attackers can spoof your domain in phishing attacks against your customers and partners. Recommended next action: move to `p=quarantine` after a 30-day reporting window, then to `p=reject`.
Legacy TLS versions are deprecated and break PCI-DSS / SOC 2 evidence. Recommended next action: update server / CDN configuration to TLS 1.2 minimum, ideally TLS 1.3. PCI-DSS requires this; most cyber-insurance questionnaires now ask for it.
Your primary domain serves no CSP header. This means in-page script-injection attacks have no browser-level mitigation. Recommended next action: add a `Content-Security-Policy` header in report-only mode, observe for two weeks, then enforce.
Public certificate transparency logs reveal 14 hostnames under your domain. None are flagged as actively vulnerable in this scan, but a quarterly review of which subdomains are still in service is recommended.
Free · 60 seconds · Read-only public DNS, mail, and TLS data. We never touch your network.
Related work
Run the actual scan on your domain. 60 seconds, no signup, graded report.
OpenWhen the scan flags email auth gaps — the step-by-step rollout to p=reject.
OpenTenant hardening list addressing the identity and email findings most scans surface.
OpenWhen the free scan surfaces enough red to warrant a real engagement.
OpenExternal posture is only half the story — what monitoring covers everything else.
OpenTalk to a senior engineer about what the scan found and what to fix first.
OpenRun a passive scan against your own domain in 60 seconds.
OpenManaged services that operationalize findings from the report.
Open24/7 SOC for organizations whose scan reveals coverage gaps.
OpenNamed operator who owns remediation of scan findings.
OpenUse scan findings as the renewal evidence pack.
OpenBook a 20-minute call to walk through findings together.
Open