Questions and answers

We only look up what is published: DNS data, certificates in public logs, registration data. The same information every browser and mail server requests to work with you. Active tests run only on a domain whose ownership you have confirmed.

Usually the report confirms your partner does good work, and then you know that too. Where something is missing, you get a concrete point with the underlying standard, something you can forward without being technical yourself.

A report ages. Certificates expire, DNS settings change, a server lands on a blocklist. Once a year is a minimum; those who really depend on it have it monitored continuously.

Partly, and we would rather say honestly which part. The European NIS2 directive (2022/2555) and the national laws transposing it require demonstrable basic measures. Some of it is measurable from the outside: mail authentication, DNS and DNSSEC, certificates and encryption, what is publicly reachable. That is the part we measure, and the report cites the standard for every finding, which you can keep as evidence. What we do not measure: your policy, your organisation, your internal systems and your suppliers. If your customer falls under NIS2, this is often the first thing they ask of you as a supplier. For the full journey, from risk analysis to policy and demonstrable compliance, SecVise, our security advisory and NIS2 guidance service, can help.

Your email address is used to confirm your account, deliver your reports and alert you. No newsletter, no reselling. Domains you add are used only for your own reports. The details are in the privacy statement.