Your domain,graded from the outside.
A free external check of your company domain: email, TLS, web, DNS, exposed services and known vulnerabilities. You get a report graded A to F across email, TLS, web, DNS and - once verified - your exposed surface, with a plain-English fix for each finding.
- EmailD
- TLSA
- WebC
- DNSB
- Surface–
- HGHDMARC policy is “none”, so spoofed email isn't blocked
- MEDNo Content-Security-Policy on www
- LOWNo CAA record restricting certificate issuers
An A means nothing we checked from outside looks wrong - not that you're secure.
What an attacker looks at first.
Email security
SPF, DKIM, DMARC, MTA-STS and BIMI: can someone send email that looks like it came from you?
TLS / HTTPS
Certificate expiry and trust, old protocol versions and weak settings on your main sites.
Web security
HTTPS redirects, security headers, cookie flags and the software versions you might be giving away.
DNS hygiene
Name server resilience, CAA, DNSSEC and dangling records that could be taken over.
Exposed attack surface
Subdomains from certificate logs and public DNS datasets and, once you verify the domain, open ports and exposed services on the hosts it finds.
Known vulnerabilities
Software versions it can see, matched against known vulnerabilities and CISA's list of actively exploited ones. Version-based matches are marked “likely”, not confirmed.
Three steps.
Sign up with your work email
Your company domain becomes the first of three domains you can scan.
Get your grade
A light-touch scan runs straight away. Each finding explains what it means and how to fix it.
Go deeper (optional)
Port and exposure checks run on domains you've shown you control. Your work-email domain counts; for others, add a DNS record or a file on your website. Only verify a domain if you're authorised to have its hosts checked.
What you sign up to.
There's no paid plan and no upgrade. We run the scanner because some people who use it will want to go further than a scan can.
- Work email only.Free, disposable and shared-hosting addresses can't register.
- Three domains per registration.Your company domain is the first. Only add domains your organisation owns or has permission to check.
- Braintruder adverts.You'll see a few clearly labelled adverts next to your results.
- Our sales team may get in touch about your results.They can see your account and scan activity so they can do that. Tick “Don't contact me about my results” on your account page and they no longer see your account. Newsletters are separate and opt-in.
- Who sees your results.You, anyone you share a report link with and - unless you opt out - our sales team. Results are deleted after 180 days.
A scanner flags. Braintruder investigates.
Attack Surface Scanner by Braintruder
- A lightweight, automated external check of your domain
- Light-touch by default; deeper checks involve no exploitation, brute force or credential testing
- Flags what's visible from outside - version-based matches are “likely”, not confirmed
- Can raise false positives and will miss issues
- A plain-English fix for each finding
Braintruder
- An AI-driven penetration tester
- Forms hypotheses, corroborates them and discards what doesn't hold up
- Records evidence for every step; CVE mentions are checked against NVD and OSV
- Follows OWASP WSTG methodology and scores severity with CVSS
- Grades findings against Cyber Essentials, Cyber Essentials Plus and ISO 27001:2022, giving you evidence to take into your assessment
Questions, answered.
Is it really free?
Yes. There's no paid plan and no upgrade. We run it because some users will want to go further than a scan can, so you'll see a few clearly labelled Braintruder adverts next to your results, and our sales team may contact you about your results. You can turn that off on your account page.
Will the scan disrupt my website?
By default it's light-touch: public DNS and certificate data, a few ordinary web requests and a short TLS check of your main sites' settings. Your domain is also looked up in public passive-DNS services. Port and exposure checks only run on verified domains, are rate-limited and involve no exploitation, brute force or credential testing.
Which domains can I scan?
Only domains your organisation owns, or ones you have the owner's permission to assess - up to three per registration. Port and exposure checks need proof you control the domain: your work-email domain counts, and for others you add a DNS record or a file on your website. Those checks cover the hosts its subdomains point to, some of which may be run by third parties, so only verify a domain if you're authorised to have its hosts checked.
Is this a penetration test? Will it get me through Cyber Essentials?
No to both. It's a lightweight, automated external check, not a penetration test or professional advice. It can raise false positives and will miss issues, and it doesn't assess you against Cyber Essentials or any other standard. Braintruder won't certify you either - certification comes from an accredited certification body - but it grades evidence-backed findings against Cyber Essentials, Cyber Essentials Plus and ISO 27001, so you can fix the gaps first and take proof into your assessment.
What happens to my results?
You, anyone you share a report link with and - unless you opt out of sales contact - our sales team can see them. They're deleted after 180 days. The service is hosted on AWS in London, with bot checks by Cloudflare. You can delete your account from your account page; deletion is permanent and that email address can't sign up again.
See how your domain looks from the outside.
Sign up with your work email and your first scan runs straight away. It's free, with no paid plan.