Tools · Free to use · No sign-up
Tools we use, published for anyone.
The SOC built these for its own analysts. They run on our servers, they cost nothing to use, and nothing on this page asks for an email address to run (only the exposure report asks for one, and only for its PDF). If one of them tells you something you did not expect, that is what they are for.
Everything, onceExternal Exposure ReportWhat does the internet see when it looks at you?The eight checks below run together against one domain and read as one report: email spoofability, DNS leaks, TLS, security headers, certificate history, cookies before consent, security.txt and the reputation of the name and its addresses. One grade, every area's own grade beside it, the fixes in the order to take them, and a PDF for the board — free for a name and a work email.Eight checks · One gradeFixes in order · Area reports linkedPDF for a name and emailOpen External Exposure Report →VulnerabilitiesCVE ExplorerWhich vulnerabilities actually matter?Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA, with a plain-English verdict on whether it needs an emergency change or the normal patch cycle.390,000+ CVEsCVSS · EPSS · KEV · EPSS trendThis week · KEV calendarOpen CVE Explorer →Your products onlyCVE WatchlistOnly the CVEs that are yours.Enter the products you run, or paste a software inventory, and get a page of new CVEs, CISA KEV additions and EPSS jumps for just those, with an RSS feed and an optional daily or weekly email digest. The link is shareable with the team; there is no account.Inventory pastePage · RSS · Email digestKEV additions firstOpen CVE Watchlist →ExposureDNS AuditWhat does your DNS tell a stranger?Enter a domain and get a report on weak, insecure and leaking records: RFC 1918 addresses in public DNS, open zone transfers, SPF, DKIM and DMARC, CAA, DNSSEC, dangling CNAMEs, Active Directory service records and the host names an attacker would try first.A · CNAME · CAA · MX · NS · TXT · SRV · HTTPSRead-onlyPDF reportOpen DNS Audit →SpoofingEmail SecurityCan someone send email as you?SPF, DKIM and DMARC read together, with the SPF include tree and lookup count, DKIM key sizes under seventy selectors or your own, the DMARC policy and its reporting, MTA-STS, TLS-RPT and DANE behind them — and for every gap, the exact record to publish next, matched to your mail provider.SPF · DKIM · DMARC · MTA-STS · TLS-RPT · DANERecommended recordsPDF reportOpen Email Security →Browser protectionsSecurity HeadersIs your site telling browsers to protect its visitors?The A+ to F grade for HTTP security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus cookie flags, CSP quality, cross-origin isolation, and the headers that give away your server stack. Every mark comes with the line that fixes it.HSTS · CSP · XFO · XCTO · Referrer · PermissionsCookies · COOP/COEP/CORPPDF reportOpen Security Headers →HTTPS configurationTLS CheckerHow well does your server do HTTPS?Certificate chain and trust, SSL 2/3 and TLS 1.0 to 1.3, every cipher suite the server will negotiate, forward secrecy, key exchange strength, OCSP stapling, secure renegotiation, compression and HSTS — scored and capped the way SSL Labs does it, so the grade means what people expect it to mean.Certificate · Protocols · Cipher suites · Key exchangeSSL Labs-style gradePDF reportOpen TLS Checker →Attack surfaceCertificate TransparencyWhat do the certificate logs say about you?Every publicly trusted certificate is logged before a browser will accept it, which makes the logs a complete history of every host name your organisation has ever put behind HTTPS. Search them for a domain: which names still resolve, which point at private addresses, which certificates expire soon, which authorities issued them and whether CAA agrees, and what was issued in the last thirty days.Host names · Issuers · CAA · ExpiryPrivate addresses · Recent issuancePDF reportOpen Certificate Transparency →PECR and third partiesCookies & ConsentWhat does your site do before anyone clicks accept?A first visit in a real browser with nothing clicked: every cookie set, tracker fired and third-party script loaded before consent, which consent platform is in use and whether the tags wait for it, plus an inventory of every outside host on the page with Subresource Integrity and Content-Security-Policy coverage. The privacy notice and the supply-chain review, from one page load.Cookies · Trackers · Consent platformThird-party inventory · SRI · CSPPDF reportOpen Cookies & Consent →Threat intelligenceReputation LookupIs this address, or this domain, known to be bad?An IP from a firewall log or a domain from a link, checked against nine public threat feeds held locally (botnet C2, Spamhaus DROP, compromised hosts, attackers, Tor exits), four mail blocklists, the URLhaus and ThreatFox host lists, the origin AS and the registry's RDAP record, reverse DNS, domain age and registrar, and the shapes lookalike names take. A verdict in plain English, and every listing linked to its source.Threat feeds · Mail blocklists · ASN · RDAPDomain age · Lookalikes · PunycodePDF and JSONOpen Reputation Lookup →PhishingHeader AnalyserIs this email really from who it says?Paste the headers (or the whole message source) and get what your mail server verified — SPF, DKIM, DMARC, ARC — whether the From lines up with the Return-Path, the signature and any Reply-To, the delivery chain with the first external server looked up, the sender domain's age and lookalike patterns, and every link and attachment name read for the usual tells. Likely legitimate, suspicious, or very likely phishing, with the signals that decided it. Nothing you paste is stored.SPF · DKIM · DMARC · AlignmentSender reputation · Links · AttachmentsNothing stored · PDF reportOpen Header Analyser →Vulnerability disclosuresecurity.txtWhen someone finds a hole, who do they tell?Checks a site's security.txt against RFC 9116: whether it is at /.well-known/security.txt, has a Contact and a current Expires, a Canonical URL, an encryption key that is actually reachable, a PGP signature, and is served as text/plain over HTTPS. Then a generator that writes a compliant file from a contact address and a date, with the Apache and nginx lines to serve it.Contact · Expires · Canonical · EncryptionSignature · Content-Type · GeneratorPDF reportOpen security.txt →