Nothing is scanned until you authorize it in writing
We scan your internet-facing addresses from the public internet and report on what is visible, what is known to be vulnerable, and what is reachable that probably should not be.
You decide what gets scanned, and when
Before any traffic is sent, you sign an agreement. It sets the limits, and the scan enforces them.
- Every address in scope is named. The scan refuses to run against anything not on that list.
- The source is named. The agreement gives the single IP address the scan comes from, so your own monitoring can identify it.
- The time window is agreed. The scan refuses to run outside it.
- The rate limit is stated. The scan will not exceed it.
- Every run is recorded. We keep a record of what was scanned, when, and against which signed document.
How it works
Authorization signed
You sign an agreement naming every address in scope.
Scan runs in the agreed window
From one named IP address, at the agreed rate limit.
Report delivered
A PDF report and an Excel workbook.
Re-scan confirms the fix
One re-scan within 30 days is included.
What the scan looks at
Open ports and software
Every open port on each authorized address, the software behind it, and its version where that is visible.
Known vulnerabilities
Roughly 7,000 vulnerability checks at medium severity and above.
Actively exploited flaws
Identified software versions are matched against the US National Vulnerability Database. We flag the ones CISA lists as actively exploited, meaning in use rather than theoretical, ordered by exploitation probability.
Software past end of support
Whether the software is still supported by its vendor at all. This is often the most useful finding: software past its end-of-support date receives no security patches, so nothing found in it can be fixed by patching.
Certificates and encryption
TLS certificates and protocol configuration.
Services that are reachable
Services reachable from the internet that would normally be restricted: databases, hosting control panels, file transfer and unencrypted mailbox ports. We keep these separate from vulnerabilities, because nothing is broken about them. Being reachable is the thing worth a decision.
We also build an asset inventory that carries forward between assessments, so your second report says what changed.
A report you can read and a workbook you can work from
A branded PDF report and an Excel workbook with seven sheets:
- Summary
- Per-service findings
- Vulnerabilities
- A remediation plan, grouped by fix rather than by finding
- Exposure observations
- The asset inventory
- Scan details for your auditors
What this assessment does not do
- It stays outside. We connect to services already offered to the public internet and read what they advertise. We do not log in to anything, change anything, or attempt to exploit anything we find.
- It does not try to break in, and it does not grade your security overall. It tells you what your addresses show the internet, and nothing beyond that.
- Some checks are left out on purpose. Anything that changes state on a system, anything that works by making a service stop responding, password guessing, and trying factory default credentials. Each either risks disrupting something you depend on or amounts to attacking it.
- It collects medium-severity findings and above only. The absence of low-severity findings in a report does not mean there are none.
- Anything behind a login is not tested. We can say a login page is reachable and what software serves it. We cannot say anything about what is behind it.
- No finding does not mean secure. The absence of a finding is not evidence that a system is secure.
Find your band by number of addresses
Pricing is per usable address, counting every address inside a range. A single /29 on your list is six addresses, not one.
| Internet-facing addresses | One-time | Quarterly | Monthly | Monitoring |
|---|---|---|---|---|
| 1–5Starter | $695 | $1,195/year | $275/month | $95/month |
| 6–20Standard | $1,495 | $2,495/year | $595/month | $145/month |
| 21–35Extended | $2,995 | $4,995/year | $1,195/month | $245/month |
| 36–50Extended Plus | $3,795 | $6,295/year | $1,495/month | $345/month |
| 51 or moreLarger | Quote | Quote | Quote | Quote |
One-time
One full assessment, plus one re-scan within 30 days so you can confirm a fix actually landed. The re-scan is included.
Starter's report is delivered by email, with a walk-through call available at our hourly rate. Standard, Extended and Extended Plus each include a walk-through call. Larger is scoped per engagement.
Quarterly
Four full assessments a year, each reporting what changed since the last.
Monthly
Twelve full assessments a year. Worth it if your internet-facing systems change often. Most businesses' don't.
Monitoring
No traffic is sent to your systems at all. This is not an assessment. It is a monthly check of third-party internet scan data for your addresses, to notice a service appearing that wasn't there before. Sold on its own or alongside any plan above.
For most small businesses, quarterly plus monitoring is the sensible shape. Internet-facing systems at most companies barely change from month to month.
Start with a short note
Choose External Exposure Assessment on our contact form. Not sure how many addresses you have? Say so in your message and we'll work it out with you.