©Answers you cantake away with you.

The nine everyday tasks the government's 2026 research found most UK businesses lack confidence in — firewalls, malware, backups, updates, accounts and more — each in plain English with what to do, mapped to Cyber Essentials, plus a one-page checklist to print.

Twenty questions in five themes, each with what a good answer looks like, a scoring scheme and the answers that should worry you. Take it into the procurement meeting.

All eight of the tools below run together against one domain and read as a single report: can your email be forged, what does your DNS give away, how do your website's encryption, headers and cookies hold up, what do the certificate logs remember, can researchers reach you, and what do the threat feeds say about your name. One grade, the fixes in order, and a PDF for the board — free for a name and a work email.

Search any vulnerability and see CVSS severity, EPSS exploitation probability and CISA Known Exploited Vulnerabilities status side by side, refreshed daily, with a plain-English verdict on what to do. Companions: a CVE Watchlist for just your products (page, RSS feed and email digest), a rolling “This week in CVEs” digest, the CISA KEV deadline calendar with an .ics feed, and an EPSS trend chart on every CVE.

Enter a domain and get a plain-English report on weak, insecure and leaking DNS records: private RFC 1918 addresses in public DNS, open zone transfers, SPF, DKIM and DMARC, CAA, DNSSEC, dangling CNAMEs and the host names an attacker would try first.

Can someone send email as you? Enter a domain and get SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE and BIMI read together: the SPF include tree and lookup count, DKIM key sizes, the DMARC policy and reporting, a plain answer on whether the domain is spoofable, and the exact records to publish next.

Two graded checks of a site's front door: the A+ to F security-headers grade (HSTS, CSP, X-Frame-Options, cookie flags, the headers that leak your stack) with the line that fixes each, and an SSL Labs-style TLS test — certificate chain, protocols, every cipher suite, forward secrecy, OCSP stapling. PDF reports for both.

What the public certificate logs say about you — every host name ever issued a certificate, which still resolve, which point at private addresses — and what your site does before anyone clicks accept: cookies, trackers and third-party scripts loaded before consent, with a supply-chain inventory. PDF reports for both.

An IP address from a firewall log or a domain from a link you are not sure about, checked against nine public threat feeds, four mail blocklists, the URLhaus and ThreatFox host lists, the registry's record, reverse DNS, domain age and the shapes lookalike names take. A verdict in plain English; every listing linked to its source. PDF and JSON.

Paste an email's headers and find out whether it is really from who it says: SPF, DKIM and DMARC as your mail server saw them, whether From, Reply-To and Return-Path line up, the sending server's reputation, the sender domain's age, and where the links go. Likely legitimate, suspicious, or very likely phishing. Nothing you paste is stored.

When someone finds a hole in your systems, can they tell you? Check a site's security.txt against RFC 9116 — location, contact, expiry, canonical URL, encryption key, signature — then write a compliant one in a minute with the Apache and nginx lines to serve it.

The public editions of the threat-intelligence reports our SOC writes every week — which groups are active, which techniques are working, what to check in your own estate — sorted by sector with the regulators and schemes that apply, plus profiles of the ransomware and nation-state groups: how they get in and what their victims had in common.

One email every two weeks: what changed, what to patch, what it means for a UK organisation. Double opt-in, one-click unsubscribe, and an RSS feed if you would rather not give us an address.