When you are the security team
Plenty of security tooling assumes a team behind it - people to triage alerts, tune rules and chase owners. If that is not your situation, most of it makes your week worse rather than better.
This page is about the other case: you are responsible for security, you are not doing it full time, and nobody is going to arrive to help.
The three things that actually go wrong
Talk to enough people in this position and the same three problems come back.
You cannot list what you have. The main website and the product are easy. Then there is the blog on a subdomain nobody has logged into since the content lead left, the staging environment that was meant to be temporary, and the DNS record pointing at a service the company cancelled two years ago. You cannot defend a list you do not have.
The tool produces more work than it removes. A scanner that returns four hundred findings, a fifth of which turn out to belong to someone else, has not helped you. It has given you a sorting job on top of your actual job - and once you stop trusting the output, you start ignoring real findings along with the noise.
You cannot answer the question upward. Someone asks whether things are getting better. You have a report full of severities and no way to turn it into a sentence.
What we built against those
A list you can trust, because you supplied it. Connect your DNS provider - Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy, Hetzner or Contabo - or upload a zone file, and those become the assets we watch. Discovery runs alongside to find what your DNS does not know about. The difference from a tool that infers your estate from the internet is that somebody else's server cannot appear in your report.
Before anything is scanned, you prove you control the domain. That is a deliberate constraint, and it is the reason a report about your infrastructure stays about your infrastructure.
Findings that come with the next step. Six checks run against verified assets: discovery, TLS and certificates, HTTP security and known CVEs, open ports, DNS and mail authentication, and domain reputation. Each finding can be explained by AYA, the assistant built into the report - what it means, and what to do about it - so you are not reading a CVE identifier and opening a search engine.
One grade you can say out loud. Each check produces a score and a letter from A+ to F, combined into one overall grade. "We went from D to B this quarter" is a sentence a non-technical manager understands. Underneath it, the technical detail is still there for you.
It keeps watching without you remembering. Put scans on a schedule and you are told when a grade drops or a certificate is approaching expiry. Posture decays quietly - a header dropped in a deploy, a protocol re-enabled to fix a compatibility complaint - and noticing that is exactly the work a part-time security function has no time for.
What it will not do
Being clear about this saves everyone time.
- It looks from the outside only. Internal networks, employee laptops and anything behind the perimeter are out of scope.
- It is not cloud posture management. Misconfigured storage and IAM policy are a different problem and a different tool.
- It is not a full application security programme. The HTTP scan uses OWASP ZAP and finds a great deal, but deep authenticated application testing is its own discipline.
- It does not make you compliant. You get findings, grades and a dated record. Certification involves an assessor.
If your main problem is one of those, we are not the answer and it is better to know now.
Getting started, realistically
Adding a domain and running Discovery takes a few minutes. The step that takes longer is proving you control the domain, because it means adding a DNS record - and if you are not the person who administers DNS, it means asking someone and waiting.
That is worth planning for rather than being surprised by. Verifying an apex domain covers its subdomains, so it is one request rather than one per host.
The free plan is free permanently: one member, weekly scans, seven days of history. It is enough to see your own attack surface and decide whether this belongs in your week.
Frequently asked questions
I am not a security specialist. Is this going to be over my head?
The findings are explained in the report rather than assumed. You will meet terms you have to look up, but you will not be handed a list of CVE numbers and left there.
How much time does this take each week?
Once scans are scheduled, none, until something changes and you are told. The work is in the first setup and in acting on what comes back.
We already have a vulnerability scanner.
Then the question is whether it knows about everything you expose. A scanner checks the assets you point it at; the problem this solves is the assets nobody pointed it at.
Can I show this to management?
That is what the grade and the PDF export are for. There is a separate page on building evidence that a manager or auditor will accept.
What happens when I find something I do not know how to fix?
Ask AYA in the report. If it is beyond that, the finding at least tells you precisely what to hand to whoever does.