No charge, no obligation
Find the holes before somebody else does.
Every business has gaps. The question is never whether you have them, it is whether you find them first. We test what you show the internet, what a handful of your actual workstations look like from the inside, and what your people would do with a convincing email. Then we tell you plainly what we found.
Why this matters
Nobody is targeting you personally. That is the problem.
Most attacks on businesses your size are not aimed at you. They are automated, they sweep the whole internet looking for something left open, and you are found because you were findable.
-
You find out what is visible from outside
Services left open, old remote access nobody switched off, a login page that should never have faced the internet, certificates about to expire. The things an automated sweep finds in seconds.
-
You find out whether your email can be forged
Whether somebody can send a message that looks like it came from you, to your staff or your clients. This is one of the most common ways a business loses money, and it is usually a settings problem rather than a spending problem.
-
You find out how your machines are really set up
Not how they are supposed to be. On a handful of real workstations: whether updates are landing, whether the protection is running and current, who holds administrator rights, whether the disk is encrypted. This is where the gap between policy and reality usually shows.
-
You find out where your people are exposed
Which of your addresses already appear in known breaches, and how your team responds to a realistic phishing message. Nobody is named and nobody gets in trouble; the result is a picture of where training would actually help.
-
You get something you can act on
A short report in language you can take to a board or an insurer, with the findings ranked by what matters rather than by what is easiest to sell. Fix them yourself, hand them to your IT person, or ask us.
How it works
Outside, inside, and the people in between.
Being straight with you
An introductory test, and a comprehensive snapshot.
This is not the largest engagement we do, and it is not meant to be. It is the one that tells you, in about a week and for nothing, where you actually stand: what the internet can see, how your real machines are set up rather than how they are supposed to be, and what your people do with a convincing email. Most businesses find more in it than they expected to.
A full engagement is a larger paid piece of work, where somebody spends days actively trying to get in under an agreed scope. Worth knowing which of the two you have had, because a client or an insurer will eventually ask.
- Free: the outside view
- Free: a sample of real workstations
- Free: the phishing test, the report, the half hour
- Paid: a full engagement, and any of the fixing
Request it
Tell us the domain and we will take a look.
We will come back within one business day to agree what we are testing, including which handful of machines. Nothing is touched until you have confirmed it in writing.
- Read only, on machines you choose
- Nothing switched off and nothing left installed
- Your information is not sold or shared
- No salesperson, because there is no sales team
Free security test
Protected by reCAPTCHA. We agree the scope with you in writing before anything is tested.
Questions we get asked
The things owners actually want to know.
The ones that come up most, answered in one place so the answer here and the answer anywhere else on the site are the same words. All questions and answers →
Do we have to be a client?
No. Most businesses that ask for this are not clients and a good number never become one, which is fine. We ask only that you are authorised to request a test of your organisation, because testing somebody else’s systems without permission is not something we will do.
Do you need access to our network?
Only what the workstation sample needs, and only with somebody from your side present or having approved it. Nothing is installed permanently, nothing is changed, and no administrator account is created for us. The external and phishing parts need no access at all.
How long does the free test take?
We come back within one business day to confirm what we are testing. The external part takes a day or two, the workstation sample is about an hour of somebody’s time on your side, and the phishing test runs over roughly a week so it is not all sitting in one inbox at one moment. Then half an hour to go through the report with you.
Is the free test really free?
Yes, and there is no salesperson attached because we do not have one. You get the external view, a workstation sample, the phishing test, a written report and half an hour going through it. If you want the findings fixed, that is paid work and we will quote it. If you would rather fix them yourself or hand them to somebody else, that is a completely fine outcome.
Is this a full test?
No, it is an introductory one, and it still gives you a genuinely comprehensive snapshot: what your business shows the internet, how a sample of your real workstations are actually configured, and how your people respond to a convincing message. Most businesses find more than they expected in it.
A full engagement is a larger paid piece of work, where somebody spends days actively trying to get in under an agreed scope. Worth knowing which of the two you have had, because a client or an insurer will eventually ask.
What do you look at on our computers?
A small sample, usually three to five machines chosen with you, and we look at the things that decide whether an attack succeeds: whether updates are actually landing rather than merely scheduled, whether the protection on the machine is running and current, who holds administrator rights, and whether the disk is encrypted.
We do not read your files, your email or your browsing. It is a configuration check, and it is read only.
Will our staff get in trouble if they click?
Not from us. The report says how many people clicked, not who, because the point is to find out where training would help rather than to catch anybody out. We have never seen naming people improve anything. If you want the detail for your own reasons you can ask, but it is not in the report by default.
Will the test break anything?
No. The external part is done from the outside, the way anyone on the internet sees you. The workstation check is read only: nothing is changed, nothing is switched off, and nothing is left installed. The phishing message is a normal email. No passwords are captured at any point.
Related
What usually comes next.
Would rather just talk it through?
Half an hour, no charge, no salesperson. You can ask for the test at the end of it or not at all.
Would rather write?
Send this and we will reply, usually the same business day. No call unless you want one.
Protected by reCAPTCHA.