We survey your domains and public IPs from the outside, as the open internet sees them. You get a PDF report with an overall grade, every finding ranked, and the fix for each, within 3 business days of verification.
Need an internal audit? Add it to your request
One grade across every check we run, with every finding ranked underneath.
From verified ownership to the PDF in your inbox.
We work from the public internet only, the way anyone else would reach you. Nothing on your systems is changed.
Our total, across everyone who asks, so each report gets a hand review.
A PDF report with an overall grade, an executive summary, every finding ranked by severity, the evidence, and the exact fix. Plus an optional 30-minute debrief to walk you through it.
An overall grade, A to F
One letter for leadership, backed by every finding underneath it.
A three-line executive summary
Written by the engineer who reviewed your results, for the people who decide what gets fixed.
Every finding ranked, with evidence
What we saw, where we saw it, and why it matters, from critical down to low.
The exact fix
The setting, record, or upgrade that closes each finding, not a generic best practice.
A verified scope
Every asset in the report shows how and when its ownership was verified. Anything we couldn't verify is listed as out of scope.
Reviewed by hand
False positives come out before the report goes to you.
02 · Summary & grade
03 · Verified scope
04 · Findings register
05 · Finding detail
06 · Roadmap
Everything the internet can reach, from open ports to forgotten subdomains. Nothing runs inside your servers, and there's nothing to install.
Every port that shouldn't face the internet, and what's really listening on it.
Exposed services
A wide range of services that should never face the internet, from remote access and file sharing to databases, message queues, orchestration, and industrial control. Each one is validated and verified, not just found open.
Service identification
Every open port is probed to confirm what's there, with services and products named from their banners and protocol replies, and a correction when a port isn't running what it should be.
Unauthenticated access
Every exposed service is checked for whether it really requires a login, from databases and caches to container, cluster, and monitoring APIs. When one answers without a password, we confirm it from the service's own reply, record what it exposes on first contact, and go no further.
UDP services
UDP services that leak information or can be abused to amplify attacks, such as SNMP, NTP, open DNS resolvers, SSDP, and IPMI.
End-of-life software
Every version we can read from a banner or header is checked against its vendor's support window and matched against published CVEs, so you know what no longer gets security fixes and what's already known to be vulnerable.
Files, secrets, and storage that should never be one request away.
Exposed files
Files that should never be public, from version-control folders and .env files to database dumps, server diagnostics, and directory listings, each confirmed by its content, plus robots.txt and sitemap entries that point at sensitive paths.
Secrets in code
Credentials left in the page and its scripts, from cloud and payment API keys to private keys and tokens, plus source maps that publish your source.
Third-party scripts
Every outside script your pages load, inventoried and checked for Subresource Integrity and for CDNs known to be compromised.
Cloud storage
Every storage bucket your pages reference, from S3 to Azure Blob, checked for public listing, and for deleted buckets your pages still link to, which anyone could claim.
APIs
Every API we find is checked for what it reveals about itself, from introspection left on to published specs and docs that map each route and field for anyone who asks.
The records that route your traffic and mail, and the ones attackers take over.
DNS
Your zone's health and integrity, including CAA, DNSSEC chains and signatures, zone transfers, nameservers that have stopped answering for you or could be taken over, and dangling records that point at recycled cloud IPs.
Email security
The records that protect your mail, from SPF, DKIM, and DMARC to MTA-STS and TLS reporting, with spoofing risk.
Domain registration
How securely the domain itself is held: registrar, expiry, transfer lock, and registry DNSSEC, plus certificates issued by CAs your CAA records don't allow.
CDN and origin
CDN detection, a hunt for origin servers reachable around the CDN, and subdomain-takeover checks across hosting and cloud services.
Subdomain discovery
Drawn from sources such as Certificate Transparency logs, passive DNS, and generated names, so the report lists subdomains you may have forgotten.
How your encryption holds up, from protocol versions to the certificate chain.
Protocols
Every version from SSL 2.0 (DROWN) and SSL 3.0 (POODLE) through TLS 1.3, each tested with a raw handshake.
Ciphers and key exchange
Which ciphers and key exchanges your servers will agree to, from legacy RC4 and 3DES to forward secrecy and weak Diffie-Hellman parameters (Logjam).
Certificates
The certificate and its chain, checked for expiry, trust and completeness, hostname match, key strength, and signature algorithm.
The headers, redirects, and browser behavior that decide what an attacker can do with your site.
Security headers
The headers that tell browsers how to protect your visitors, graded for strength, not just presence, from HSTS and CSP to clickjacking protection and cookie flags.
HTTP configuration
How your server answers requests: HTTPS redirects, risky methods such as WebDAV, CORS that trusts any origin with credentials, and the software versions it gives away in its headers.
Rendered page
A headless browser loads your site as a visitor would and records what happens: errors, mixed content, policy violations, page speed, and every outside site it contacts.
What you run, which versions, and which of them have known vulnerabilities.
Web apps and appliances
The products you've put online, from VPN gateways and hypervisors to admin panels and content management systems, each identified from the page it serves.
Technology fingerprint
Your full technology stack, from web server and framework to CMS, libraries, analytics, and hosting, with versions where they show, plus the favicon fingerprint internet-wide scanners use to find sites like yours.
Known CVEs
Versions matched against CVE and OSV data, graded by match confidence, with CISA's known-exploited catalog and EPSS scores. Software patched in place is marked potential, not confirmed.
If a host didn't answer, a scan was throttled or blocked, or a check couldn't finish, the report says so. A clean section means it was checked, not skipped.
Highlights, not the full list · the suite grows as attacks do
A finding is a technical detail until someone uses it. Here's what the common ones cost.
What we see
› GET /.env→200 OK · readable
Exposed .env file
Confirmed by content
What it costs you
Cloud account takeover
Cloud keys and database passwords sit one request away. Whoever finds them first gets your infrastructure.
At stake: Data, Money.
Your part takes a few minutes: the request and the ownership check. We handle the rest.
Your domains and public IPs. No account, no sales call.
Set the one-time token we send for each asset.How verification works
VerifiedYou're done.
We take it from here.
Non-destructive, rate-limited checks, usually the same day.
We review the findings by hand and rank the fixes.
Your PDF: a grade, every finding ranked, and the exact fix.
Delivered
DeliveredYours alone.
After the report · Optional
A call on the top risks and the fixes, then your questions.
The free audit looks only from the outside. To go inside, tick the box in the form and we'll scope it with you after.
Every domain and IP is verified before any check runs. We record how and when, and anything we can't verify stays out of scope.
Every audit keeps a record like this, and your report lists anything unverified as out of scope.
Add one TXT record at the domain apex. It covers the domain and every subdomain.
A work email on the same domain speeds things up, but it never verifies an asset on its own.
Accepted when reverse DNS points to a verified domain, the IP serves the token file, or your hosting account shows it's yours.
Checked by hostname only, never your provider's shared addresses. Servers behind a CDN need a signed testing agreement. See the FAQ ↓
We take on 10 companies a month, across everyone who asks, so every report gets a real review. Past that, requests join next month's list, and we'll let you know.
What happens next
We contact you to verify the assets you listed, with a one-time token for each, valid for 7 days.
You prove ownership one of three ways, and we record how each asset was verified. Anything unverified stays out of scope.
We run the checks and send your report within 3 business days of verification.
Rules of engagement
Yes. There's nothing to buy and no obligation. The security report is yours, and the debrief call is optional.
Only the domains and IP addresses you list and we verify you control. We check them from the outside, non-destructively, across the full suite: exposed services and what's running on them, TLS and certificates, security headers, web apps and known CVEs, exposed files and secrets, cloud storage, DNS, email security, and more. Every area is broken down under What we check on this page.
We check the hostnames you list, never the CDN's or a shared host's IP addresses: you can authorize testing of your own domain, not your provider's infrastructure. If you'd like servers you control behind the CDN tested directly, tick the box in the form and we'll contact you to set up a signed testing agreement.
The free audit covers what anyone on the internet can see. If you'd like an internal review of servers, cloud accounts, or code, mention it in the form and we'll scope it with you after the external audit.
Results are encrypted, used only to write your report, never shared or published, kept for 90 days, and deleted sooner on request. The assessment terms with the request form cover this.
Free · Limited access
A few minutes of your time. Within 3 business days of verification, you know exactly where you stand.
Only 10 companies a month. Past that, you join next month's list.
Reviewed and issued by Atlas engineers
Free security audit
10 companies a month
