Capabilities Core Services

We Do It

Website Security Review

“You cannot claim a posture you did not measure.”

Available Now

Open for new clients now. Tell us your situation and we will scope it with you on the first call.

What It Is

A read-only look at what your website shows the public internet, run from outside with no access to your systems and nothing installed. We check the transport and header posture a browser actually enforces — whether plain HTTP redirects to HTTPS, HSTS and its lifetime, your content security policy and any directive that quietly defeats it, clickjacking and content-type protections, referrer and permissions policy, cookie attributes, software version disclosure, and whether you publish a security contact.

Alongside it we check the DNS underneath: whether DNSSEC is signed and actually validates, your certificate-authority restrictions, how concentrated your nameservers are, and any dangling records pointing at an abandoned provider that someone else could claim. You get one report written for two readers: what it means for the business, and the step-by-step fix for whoever runs your site.

It comes in phases, and only the first is open today. Phase 1 is everything above: read-only, from outside. Phase 2 adds TLS version and cipher enumeration and certificate posture, which needs a raw handshake our current engine does not make — not available yet. Phase 3 adds authorized active checks against assets you have proven you own, under a signed scope — not available yet either, and still not a penetration test.

Add-on

Lookalike Domain Sweep

We search for domains registered against your name — swapped or look-alike characters, missing or doubled letters, a different ending — and tell you which ones can already send mail, which host a site, and which are still free to buy, ranked so you know what to register first. A parked domain is never reported as available. Priced separately, and it attaches to any of our scans.

This is a measurement, not an attack. It does not crawl your site, log in, or test for exploitable vulnerabilities — that is authorized penetration testing, and it is a separate conversation with a signed scope.

Who It’s For

  • Businesses whose website is their front door, their storefront or their lead source
  • Companies told by a customer, insurer or auditor to "get your site checked"
  • Anyone who has never had an outside look at what their site exposes
  • Teams who want a measured starting point before deciding whether they need testing

How We Approach It

  • Read-only and external: nothing installed, no credentials, no load on your site
  • Transport and header posture, measured against what browsers enforce today
  • DNS hygiene, including whether DNSSEC validates rather than just exists
  • Dangling records checked against providers known to be claimable
  • Every finding carries its evidence: what we looked at, what came back, and when
  • Anything we could not measure is reported as unmeasured and costs you points — never quietly dropped, and never rounded up into a clean result

Why Threat Vector Management

We built the engine ourselves, with no runtime dependencies, and it enforces two rules in code rather than in review: no finding without its evidence attached, and an unmeasured check is reported as unmeasured and deducts from the score. A connectivity failure cannot turn into a confident finding, and a short report cannot be mistaken for a clean one. Our own domain was the first thing it was pointed at.

Start the Conversation

Other Capabilities