Free external exposure check
Before attacking, criminals look at what your company exposes on the internet. I run the same passive checks, then walk you through what matters in a 2-page report and a 20-minute call.
What I check
- Email security. SPF, DKIM, DMARC, MTA-STS: can someone send email in your name, and would your mail server notice?
- Domains and subdomains. Your DNS, the subdomains visible in public certificate logs, forgotten test sites and look-alike domains.
- Exposed services. What internet-wide scanning services already know about your IP addresses, including your office connection if you give me its address: open ports, remote access, outdated software.
- Website and TLS. Certificates, HTTPS configuration and security headers of your main sites.
- Leaked credentials. Whether addresses on your domain appear in known data breaches, once you have verified the domain.
How it works
- 01
Request
Fill in the form below with your work email on the domain to check.
- 02
Ownership check
I confirm you represent the organisation and that the IP addresses you gave are really yours. For some checks, I may ask you to add a short DNS record.
- 03
Passive analysis
Public sources only: no scanning, no login attempts, nothing that touches your systems beyond a normal visit to your website.
- 04
Report and call
Within 5 business days, a 2-page report with your top risks and quick wins, then a 20-minute call to go through it.
Frequently asked questions
Is it really free?
Yes. One check per organisation, with no obligation. If you want help fixing what I find, I'll send you a quote, and you decide.
Is it a penetration test?
No. A penetration test actively attacks your systems with your written agreement. This check only reads what is already public. It is a good first step to decide whether a penetration test makes sense.
Who can request it?
Belgian businesses and organisations, for domains they own, using a work email address on that domain. You must be authorised to request it on behalf of the organisation, for example as manager, IT lead or external IT provider with its agreement.
What happens to the results?
The report is sent only to you. The working data is deleted after 12 months unless we work together. See the privacy policy.
Request your check
I reply within one business day to confirm the request.