Know first which of your addresses are in breach records
We check monitored breach databases for addresses at your domain and name the breaches they are listed in. Where a listing gives its date and the kinds of data it holds, you get those too. We never look at or try a password.
Attackers now use AI to read a firm the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.
Credential exposure, found first.
Which addresses at your domain appear and in how many published breaches.
The kinds of data a listing holds, such as passwords or phone numbers, where the listing says.
The date of a breach, where the listing gives it, so an old listing is not mistaken for a new one.
The one that makes the rest easier to close, named first in your fix list.
Every way in, found externally only. Not a pen test: nothing attacked, nothing installed, no access given.
Every finding checked, in order of what to fix and human-verified.
We close it: you get the fix for each finding, step by step; forged email closes where we can reach your DNS host, one click per step. Re-checked until closed.
Email settings, look-alikes and new host names re-checked every hour, everything else every day and newly exploited flaws matched to your website's software within a day. Alerts the same day. You are first to know.
Credential findings are carried in Technical Evidence and Findings, part of your evidence pack: an owner summary, the technical evidence with the fix for every finding, a rules and insurance briefing, plus a dated assessment record.
On a paid assessment, our AI agents work your firm externally, stage by stage:
- the Discover AI agent reads what your firm shows the public internet with fixed checks
- the Close AI agent gives you each fix and re-checks it externally
- on monitoring, fixed checks re-check every hour and every day
Every paid assessment is human-verified before release. After you buy, AI chooses follow-up checks, picks when to re-check externally and sorts new changes by which needs you first.
No AI agent can state a finding without a fixed external check behind it.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.
See what is open externally before anyone else does.
The External Exposure Check: your external reading, the openings a stranger can see on your firm today, with the proof for the lead finding. Read-only, externally.