What we check
Coverage grows with the tier. Everything below is read-only collection.
- DNS records and subdomain exposure
- Dangling infrastructure and subdomain takeover risk
- DNS security posture: DNSSEC status, zone transfer misconfiguration
- Domain and WHOIS hygiene (expiry, registrar lock, privacy)
- TLS certificates and expiry
- TLS/SSL configuration quality (weak ciphers, outdated protocols)
- Certificate Transparency log review for rogue certificates
- Open ports and reachable services (optional full 1–65,535 port range)
- IPv6 service exposure
- WAF/CDN detection and origin exposure
- CORS configuration
- HTTP methods exposed (PUT/DELETE/TRACE)
- Directory listing
- Default and verbose error pages
- Remote access and VPN endpoints
- Exposed cloud storage tied to your domain (S3, Azure, GCS)
- Exposed admin/dev panels discoverable by banner
- Email authentication: SPF, DKIM, DMARC
- Mail server security posture (STARTTLS, open-relay check)
- IP and mail server reputation/blacklist status
- Breached-credential exposure for your domain
- HTTP security headers (HSTS, CSP, X-Frame-Options)
- Cookie security attributes (Secure, HttpOnly, SameSite)
- Exposed source-control artefacts (.git, .env, backups) on web servers
- API documentation and endpoint exposure (Swagger, GraphQL introspection)
- CMS/framework fingerprinting against known CVEs
- End-of-life software and appliances
- Public secret and credential exposure (redacted in your report)
- Website compromise and malicious content indicators
- Known exploited vulnerabilities — cross-referenced against CISA KEV
All checks above are read-only and non-destructive — no exploitation, password guessing or denial of service, ever. Plus further public-surface checks as new techniques and threats emerge — the list above isn't the ceiling.
- Patch level and unsupported operating systems
- Local administrator sprawl
- Password and lockout policy
- SMB and RDP exposure on the LAN
- Endpoint protection status
- Backup presence and last successful run
- Full-disk encryption status (BitLocker/FileVault)
- Local firewall configuration and status
- Software inventory: outdated, unlicensed or end-of-life applications
- Stale or dormant local accounts, enabled guest accounts
- Network share permission audit (overly open shares)
- Legacy or vulnerable service exposure (e.g. print spooler)
- EDR/antivirus coverage gaps across machines
- Wi-Fi security posture (encryption type, shared credentials)
- Network segmentation sanity check (flat network detection)
Plus further endpoint and identity checks as new techniques and threats emerge — the list above isn't the ceiling.
- Active Directory: privilege, delegation, stale objects
- Active Directory: Kerberoasting exposure (weak-password SPNs, detection only)
- Active Directory: unconstrained delegation and privileged group membership
- Microsoft 365/Entra ID: MFA enforcement coverage, legacy auth protocols
- Exchange: mail flow, permissions, transport rules
- Exchange/M365: mailbox auto-forwarding rules and external sharing settings
- SQL Server: authentication, roles, encryption
- SQL Server: exposed instances and excess sysadmin membership
- VMware: host and cluster configuration
- Firewalls: rule base, any-any rules, logging
- Firewalls: unused/shadowed rule cleanup and VPN configuration
- Backup infrastructure: encryption, immutability, restore-testing evidence
- Cloud infrastructure (AWS/Azure/GCP): IAM policy and storage permissions, where in scope
- Alignment against Cyber Essentials controls
Plus further estate-system checks as new techniques and threats emerge — the list above isn't the ceiling.
At Full Enterprise tier each system type has a collection template: a declared list of queries, the read-only permissions they need, and the data they return. You review and approve the template before the run, and the report states which template version was used.