Tools.
The checks I run in the day job, published for anyone. All read-only — they look at what your estate already shows the world and tell you what an attacker would see first. Nothing is stored beyond a short cache, and nothing you enter goes anywhere but the check.
External Exposure Report
Eight checks in one pass, graded together: the outside of the building at dusk.
open → VulnerabilitiesCVE Explorer
Every published CVE, ranked the way you should actually patch: KEV first, then live exploits, then EPSS.
open → Your products onlyCVE Watchlist
Paste your stack. Get told only when something that matters to it moves.
open → Attack surfaceDNS Audit
The whole zone read out loud: records, delegation, DNSSEC, and the names that leak.
open → SpoofingEmail Security
SPF, DKIM, DMARC and the transport around them. Whether someone can send as you.
open → Browser protectionsSecurity Headers
What your responses tell the browser to enforce, graded and explained.
open → HTTPS configurationTLS Checker
Protocols, ciphers, key exchange and the certificate — probed one handshake at a time.
open → Attack surfaceCertificate Transparency
Every certificate ever issued for your names, and which of them point at nothing now.
open → PECR and third partiesCookies & Consent
What a first visit sets before anyone clicks, and whether that is lawful under PECR.
open → Threat intelligenceReputation Lookup
An address, host or URL against the open threat feeds and mail blocklists.
open → PhishingEmail Header Analyser
Paste a raw message. Read back the authentication results and the phishing tells.
open → Vulnerability disclosuressecurity.txt
Check a disclosure policy, or generate one that validates against RFC 9116.
open →Why these are here
Most of what a penetration test turns up in its first hour is not a clever exploit — it is the ordinary stuff that was visible all along: a domain anyone can send mail as, a certificate for a staging box nobody took down, a header that was never set. These tools run those first-hour checks, so you can find them before someone else does. They are the same ones I reach for; there is no reason to keep them to myself.
If you would rather one number than twelve pages, start with the External Exposure Report — it runs eight of them over your domain and grades the lot together.
→ off duty · the day job · writing