Our agents · Outside only

Agents that work your firm from outside, stage by stage.

Every paid assessment is human-verified before release. Agent against agent: attackers point AI at firms, and our agents read yours first. This page says what each agent does, what it can never do, what waits for your approval, and where you can read its work.

Our agents work from outside only. They never log in, never install anything, and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.

Check my firm How it works

Outside onlyNo log-insNothing installedHuman-verified

Works from: Outside only
Log-ins: None
Changes: Only when you approve
Release: Human-verified
Its work: Dated, on your dashboard

01 · What each agent does

Discover, Validate, Close, Monitor.

DiscoverThe Discover agent reads what your firm shows the public internet: your email records, your website, your host names, look-alike domains, and firm addresses in monitored breach databases. It records each finding with the evidence it relied on and the date it was read.

ValidateEvery finding is kept with the record that proves it and a check you can run yourself. A finding with no evidence is not released. Then a person reads the assessment: every paid assessment is human-verified before release. Validate is a person's step. We do not call it an agent.

CloseThe Close agent gives you the fix for each finding, step by step. When you mark a fix done, it re-checks from outside and records the finding closed only when a fresh read shows it, with the date and the evidence. On monitoring, a finding that is gone from the daily re-check is recorded closed only after a fresh read from outside agrees. The closure is dated on your dashboard, with its evidence.

MonitorOn monitoring, the Monitor agent re-checks your email settings, look-alike domains and new host names every hour, and everything else in full every day. It alerts you when something changes. On monitoring, each look-alike domain worth a second look is followed from found to gone: it is re-checked twice a day in public records, and if you tell us it is not yours, the request to its registrar is drafted for you to send.

Your security agentAsk it a question in plain English and it answers from your own firm's findings, and names the finding it used. It drafts the note to your IT provider, for you to send. It proposes a re-check and runs it only when you approve. When it cannot answer, a person replies.

How oftenThe Discover agent runs before your outside reading is written. The Close agent's re-check queue runs every 30 minutes for a finding you have marked fixed. The Monitor agent runs every hour and every day while you are on monitoring, and the first month of monitoring comes with the assessment.

02 · What they can never do

Outside only means outside only.

They never log in to anything of yours, never install anything, and never touch your internal systems. They send nothing in your name: the note to your IT provider and the request about a look-alike domain are drafted for you to send. They change nothing on their own.

Every limit is written down in the scanning policy.

Log in to anything of yours
Install anything
Touch your internal systems
Send anything in your name: notes and requests are drafted for you to send
Change anything on their own
Release an assessment without a person

03 · What needs your approval

Nothing of yours changes until you say so.

Two things wait for you. A change to your email records is made only when you confirm each step. A re-check your security agent proposes runs only when you approve it.

The one-click email record works where your domain's DNS is at Cloudflare and you supply a token for that one use. Anywhere else you get the exact record to paste.

Each step you confirm is recorded with the value before and after. No token is kept: it is used once and discarded.

04 · Who verifies

A person, every paid release.

A person. Every paid assessment is held until a person has read it, and nothing is released on its own: it is human-verified before release.

Validate is a person's step. We do not call it an agent.

Release without a personNever

A finding with no evidenceNot released

DeliveryInside 72 hours of confirmation

05 · How to see their work

Every line dated, with the stage that did it.

Your dashboard lists what each agent did for your firm, newest first. Every line carries its date and the stage that did it, and a closed finding carries the evidence of the re-check.

How often a check runs is stated only for a record the checks really run for. With monitoring off or paused, the list says so and shows only what happened.

On your dashboard, under Agent activity

DiscoverRead your firm from outside.
ValidateA person verified your assessment before it was released to you.
CloseConfirmed closed from outside, with the evidence of the re-check.
MonitorThe daily full re-check ran and found nothing new.

The kinds of line the list holds. Yours carry your own dates and findings.

06 · Which page next

The stepsFrom your request to a fix you can confirmHow it works → The methodHow each finding is read, ranked and provedMethodology → For a firmCheck my firm, then the External Cybersecurity AssessmentBusiness →