See what attackers see, before they look.
A free, non-intrusive check of everything your company exposes to the internet. A short report and a walkthrough in two to three business days.
- Price
- FreeFirst five companies
- Turnaround
- 2–3 business daysFrom signed authorisation
- You get
- Report + call30-minute walkthrough
- Impact
- NoneNo logins, no exploitation
Six things attackers look at first.
- Attack surface mapDomains, subdomains and cloud hosts, including the staging server everyone forgot.
- Exposed servicesAdmin panels, databases and dashboards reachable from the internet, checked against known exploited CVEs.
- Web and TLS hygieneCertificates, security headers, cookies and CORS on your main app and top hosts.
- Leaked secretsAPI keys and tokens in public repositories, Postman workspaces and JavaScript bundles.
- Email spoofingSPF, DKIM and DMARC: can someone send mail as you?
- Breach exposureYour domains in public breach data. Counts only; we never handle passwords.
Four steps, under a week.
Apply
Tell us your company and main domain. We reply within one business day.
Authorise
You sign a one-page authorisation listing the domains you own. Nothing starts before that.
We check
Two to three business days of light, external checks. Anything critical reaches you within 24 hours.
Walkthrough
A short written report and a 30-minute call to go through it with your team.
Before you apply.
Is it really free?
Yes, for the first five companies. No card, no contract. If we find something that needs a deeper test, we'll say so and send a fixed quote; whether you take it is up to you.
Will it affect our systems?
No. We don't log in, exploit anything or load-test. The checks are what any attacker can do from the internet, run gently and only against the domains you authorise in writing.
Who is it for?
Companies with a public web app, API or AI product, especially SaaS, fintech and AI-first teams who haven't had an outside test yet, or are about to be asked for one.
What do we need to provide?
Your main domain, a contact for urgent findings, and a signed authorisation listing the domains and IP ranges you own or control. That's it.
How is this different from a penetration test?
An Exposure Check looks only at what's visible from outside, without logging in. A penetration test goes inside: authenticated testing, business logic and safe exploitation. The check tells you whether, and where, a pen test is worth it.
What do you do with our results?
They stay confidential. We may ask whether we can describe the result anonymously; saying no changes nothing about the check.
Find out what's out there.
Apply with your company name and main domain, or email contact@thezybersecurity.com with the subject “Exposure Check”.