Skip to main content

Free Cybersecurity Snapshot

Free. Passive checks only. Your report in 48 hours.

Get my free snapshot →See a sample report
10 free slots in launch week

What you get

A clear report, and someone to talk it through

  • The report

    A short, plain-English report on what an outsider can see: what we found, why it matters and how to fix it, in order of risk.

  • A 30-minute walkthrough

    A call with one of our engineers to go through the findings and answer your questions. No slides.

What the snapshot covers

  • Forgotten subdomains and staging sites

    Old test, staging and campaign sites that are still reachable from the internet.

  • Email spoofing protection

    Whether SPF, DKIM and DMARC are in place, so criminals can't send email that appears to come from you.

  • Login pages and remote access

    Admin panels, VPNs and remote desktop portals that are open to the internet.

  • Software versions on show

    Servers and applications announcing versions that attackers can match to known flaws.

  • Certificate problems

    Expired, expiring, mismatched or weak certificates on your public sites.

How it works

Three steps, two days

  1. 1

    You request and consent

    Fill in the short form and confirm you're authorised for the domain. That is your written consent, and we email you a copy.

  2. 2

    We run the checks

    An engineer runs outside-in, passive checks on the domain you named. Nothing is installed and nobody logs in.

  3. 3

    You get the report

    Within 48 hours your report arrives by email. Then we walk you through it on a 30-minute call.

What we do and don't do

Passive, outside-in, and only with your consent

We look at your business the way a stranger on the internet can, and no further.

What we do

  • Look only at what is already visible from the internet.
  • Use public records, such as DNS and certificate logs, and what your public sites and servers show to any visitor.
  • Check only the domain you name, after you've given written consent.
  • Send the report to you alone, and keep it confidential.

What we never do

  • Log in, guess passwords or try to get past a login page.
  • Exploit a weakness to prove it's real.
  • Put load on your systems or run anything that could slow them down.
  • Run anything without written consent from someone authorised to give it.

What a snapshot is not

It is not a penetration test, an internal vulnerability scan or a certification. It shows what an outsider can see on the day we look. It won't find everything, and a clean snapshot doesn't mean you're secure.

Sample report

See the report before you ask for one

Your report covers your own domain, in exactly this format.

Cybersecurity Snapshot

Example Company Ltd

example.co.uk

Checked 12 October 2026

Passive, outside-in checks

findings
5findings
high
2high
medium
2medium
low
1low

  1. 01High

    Email can be spoofed

    example.co.uk

    What we saw
    SPF is published, but there is no DMARC record.
    Why it matters
    Anyone can send email that appears to come from your domain, such as fake invoices to your customers.
    How to fix it
    Publish a DMARC record in monitoring mode, review the reports, then move to reject.

  2. 02High

    Remote access portal exposed

    vpn.example.co.uk

    What we saw
    A VPN sign-in page is public and shows its product and version: ████████ 9.1.
    Why it matters
    Remote access portals are among the first things attackers look for, and the version points to missing updates.
    How to fix it
    Apply the vendor's updates, require multi-factor authentication and limit who can reach the page.

  3. 03Medium

    Forgotten staging site

    staging.example.co.uk

    What we saw
    A staging copy of your site is live with a public login page. Its certificate was last renewed in 2023.
    Why it matters
    Staging sites are rarely patched or monitored, and often hold copies of real data.
    How to fix it
    Take it offline, or restrict it to your office and VPN.

  4. 04Medium

    Certificate about to expire

    shop.example.co.uk

    What we saw
    The certificate expires in 6 days.
    Why it matters
    Customers will see a security warning and most will leave.
    How to fix it
    Renew it now, and switch on automatic renewal.

  5. 05Low

    Software version on show

    www.example.co.uk

    What we saw
    The web server announces its exact version in every response.
    Why it matters
    It tells attackers which known flaws to try.
    How to fix it
    Hide the version header and keep the server updated.
No logins were attempted, nothing was exploited and no load was placed on any system.

Who it's for

For teams without a full‑time security person

Request your snapshot

Tell us the domain. We'll do the rest.

Five short fields. No phone number, no sales call.

10

of 10 free slots availableIn launch week. First come, first served.

What happens next

  1. Straight away: We email you a copy of your request and the consent you gave.

  2. Within 48 hours: Your report arrives at your work email.

  3. After that: A 30-minute walkthrough call, at a time that suits you.

If your email address isn't at the domain you ask us to check, we'll contact you first to confirm you're authorised. The 48 hours start once that's done.

All fields are required

One domain. We look at it and the subdomains that appear in public records.

Your authorisation and consent

We use your details only to deliver your snapshot, and never for marketing. See how we handle your data.

Common questions

Before you ask

Is it really free? What's the catch?

Yes, it's free, and there's no obligation to buy anything. We're offering a limited number of snapshots in our launch week because it's the simplest way to show how we work. The only limit is the number of slots.

Will it affect our systems?

No. The checks are passive and outside-in. We look at public records and at what your public sites and servers already show to any visitor. We don't log in, exploit anything or run anything that puts load on your systems.

What do you do with the data, and how long do you keep it?

We use your details only to deliver your snapshot. The findings are confidential and go only to you. We delete the findings and the report 12 months after we deliver it, or sooner if you ask. We keep the record of your consent for 6 years, as evidence that the checks were authorised. The Snapshot terms and our privacy policy have the detail.

What happens after the report?

We walk you through it on a 30-minute call. What you do next is up to you: fix things yourselves, hand the report to your IT provider, or ask us to help.

Do you sell to us afterwards?

If we think we could help, we'll say so on the walkthrough call, and then leave it with you. We won't chase you, and we won't add you to a mailing list.

Do we need to give you access or install anything?

No. We don't need passwords, accounts or software on your systems. We only need the domain name and your consent.

Can you check a domain we don't own?

No. We only check a domain when someone authorised by its owner asks us to. If your email address isn't at the domain, we'll confirm your authority before we start.

See what the internet sees about your business.

Free. Passive checks only. Your report in 48 hours.

Get my free snapshot →Read the Snapshot terms