Free external security check
See your company the way an attacker does.
Attack Surface Scanner checks what anyone on the internet can see about your domain and gives you a graded report, A to F, with a plain-English fix for each finding.
- ✓ Free, with no paid plan and no upgrade.
- ✓ Sign up with your work email and we scan your company domain straight away.
- ✓ Light-touch: roughly what a single browser visit sends, unless you verify.
No catch, but to be upfront: the scanner is made by Assertive Infosec, the company behind Braintruder, and we may contact you about your results.
example-company.co.uk
Overall score 71 / 100 · Passive scan
- highDMARC policy is set to “none”, so spoofed email isn’t blocked
- mediumNo Content-Security-Policy on www.example-company.co.uk
- lowNo CAA record restricting who can issue certificates
What it checks
Email security
SPF, DKIM, DMARC, MTA-STS and BIMI: can someone send email that looks like it came from you?
TLS / HTTPS
Certificate expiry and trust, old protocol versions and weak settings on your main sites.
Web security
HTTPS redirects, security headers, cookie flags and software versions you might be giving away.
DNS hygiene
Name server resilience, CAA, DNSSEC and dangling records that could be taken over.
Exposed attack surface
Subdomains from public certificate logs, and (once you verify the domain) open ports and exposed services.
Known vulnerabilities
Software versions we can see, matched against known and actively exploited vulnerabilities.
How it works
1. Sign up
Use your work email. Your company’s domain becomes the first of three domains you can scan.
2. Get your grade
A passive scan runs straight away. Each finding explains what it means and how to fix it.
3. Go deeper (optional)
Prove you own the domain with a DNS record to unlock port and exposure checks across your subdomains.
It’s free. Really.
There are no paid plans. We run this scanner because some people who use it will want to go further than a scan can. A scanner flags; Braintruder, our AI-driven penetration tester, investigates. You’ll see a few clearly labelled Braintruder adverts next to your results, and that’s it.
Scan my domain