Scheduled security scanning of your public systems.
We check the parts of your estate that the internet can already see — certificates, protocols, exposed paths, software versions, domain and DNS records — on a fixed schedule, and report what actually matters.
What is included
Fixed schedule
Checks run on a defined interval, so a certificate or domain never expires unnoticed between annual audits.
Severity that means something
Every finding is rated high, medium or low with the business impact written in plain language, not tool output.
Verified, not assumed
We report what we observed. Where exploitability was not verified, we say so instead of inflating the finding.
Non-intrusive by design
Passive checks only: no password attempts, no exploitation, no load on your production systems.
Remediation guidance
Each finding comes with the fix, and we can carry it out under the infrastructure management service.
Authorised deep testing
Where you authorise it in writing, scanning is extended to authenticated and deeper checks.
Guardian plans
Periodic security scanning from the outside, from the data centre you choose. Results arrive as a report every month.
- Periodic scanning
- Monthly report
- No access to your systems required
- Tested from the outside only
- SSL/TLS and certificate checks
- Periodic basic port scanning
- Security headers
- Email security (SPF/DMARC)
- Exposed software versions
- Spam and malicious code traces
- Redirect checks
- Everything in Guardian
- Extended port and service scanning
- Exposed admin panels
- SQL injection and XSS testing
- Exposed sensitive files (.git, .env, backups)
- Advanced DNS checks (DKIM, DNSSEC, CAA)
- Detailed TLS configuration (protocols, ciphers)
- Subdomain discovery
- Cookie, CORS and directory listing checks
- Everything in Guardian Pro
- Dedicated scanning server with a fixed IP
- Extended injection testing
- Known vulnerability (CVE) checks
- Everything in Guardian Max
- Scope agreed for your organisation
- Many domains and systems
- Reporting to your format
Active tests (ports, injection) run only on domains you prove you own and authorise in writing. Billed monthly, cancel any month.
Let us look at your current setup
Send us your domain and a short description of your environment. You get a written assessment back — no access required for the first step.