Which free security tools and checklists do you offer?
Key takeaways
- Self-checks are free and immediate, and they make a consultation worth more when you have one.
- Most of these are configuration problems, which means the fix is usually not a rebuild.
- We would rather you find the easy issues yourself than pay us to tell you what is obvious.
- If a tool flags something serious, contact us rather than posting it publicly.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Which tools are available, and what does each one do?
| Tool | What it checks | Who it is for |
|---|---|---|
| Breach exposure check | Whether your email address or domain appears in a known breach | Anyone, including individuals |
| TLS and header validation | The transport security and hardening headers on your public site | Web teams and site owners |
| Domain takeover check | Whether a DNS record points somewhere you do not control | IT teams and domain owners |
| OAuth consent audit | Third-party applications with access to your cloud accounts | Anyone using a cloud workspace |
| CERT-In six-hour checklist | The clock, the log retention and the reporting path for an incident | Any organisation that handles data |
| Deepfake triage checklist | What to capture before you report a manipulated video or image | Public figures, creators and victims |
| Phishing indicator sheet | The operational signals that a message is hostile | Staff and finance teams |
| Ransomware first-six-hours card | The first six steps after an incident is noticed | Anyone who can be the first to notice |
What is available?
Password exposure check
Check whether an email address or phone number appears in a known breach corpus. We run it for you as part of an account review — and you can check your own domain addresses directly on the site your browser already trusts, rather than handing them to a free tool you have never heard of.
Website TLS and header check
A scan of your HTTPS configuration: certificate validity, protocol version, cipher suite, and whether HSTS, CSP and the other security headers are set correctly. Most sites fail this on the first run, and the fix is usually a configuration change rather than a code change.
Domain exposure watch
Continuous monitoring for lookalike domains, typosquats and homograph registrations, with a takedown attempt on anything that appears. This is the cheapest protection against a brand impersonation that is otherwise waiting to happen.
Phishing simulation kit
A controlled campaign design for your organisation, with realistic pretexts, safe landing pages that never collect a working credential, and a measurement of who clicked, who submitted and who reported.
Vendor security questionnaire
A structured due-diligence questionnaire for your suppliers, with the questions that actually distinguish a supplier with a security function from one that has answered the same generic form since 2019.
Incident response checklist
The steps to take in the first hour of a suspected incident, in the order they should be taken, and the mistakes that make things worse. Written for someone who has never done this before and is currently doing it.
How do we use these well?
Run the checks, write down what you find, and bring the output to a scoping call. It saves everyone time, and it means the engagement starts from facts rather than assumptions. The one rule: if a check flags something actively exploitable, do not post it on a forum or a social media account before it is fixed.
What do you not publish?
We do not publish exploit code, ready-to-run attack tools, or anything that would make someone else's job easier. A defensive checklist and an attack tool are not the same artifact, and a site that mixes them is a site that ends up in a blocklist. The tools here are defensive on purpose.
What are the common questions about this?
Need help interpreting what you find?
Send us the output and we will tell you what matters, what does not, and what to fix first.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.