01
Discover
Map the public footprint associated with your domain — domains, subdomains, certificates, IPs, technologies, and services.
- Domains
- Subdomains
- Certificates
- IPs
- Technologies
- Services
External security intelligence
See Your Company the Way the Internet Sees You.
SecurityPosture continuously maps your public digital footprint, analyzes your external security posture, and tells you what deserves attention — before someone else finds it.
No credentials required · Passive external analysis
- No credentials required
- External visibility analysis
- Continuous monitoring
- Actionable recommendations
External attack surface
example.com
Live map · demo
example.com
app.example.com
Cloudflare
Next.js
api.example.com
AWS
TLS A+
docs.example.com
GitBook
mail.example.com
SPF
DMARC ⚠
4
Assets
6
Tech
1
Findings
DNS discovered4 subdomains mapped6 technologies detected1 email finding
Discovery
What can someone discover about your company without logging in?
A passive discovery pass already reveals a surprising amount about your public footprint.
SecurityPosture Discovery Engine
Target: acme.com
Public footprint
- Domains0
- Technologies0
- Certificates0
- Public services0
- Email signals0
- Documents0
Workflow
From domain to actionable security intelligence.
Four steps that turn public signals into a prioritized list of what actually matters.
02
Analyze
Evaluate publicly observable security signals across DNS, TLS, HTTP, email, headers, and configuration.
- DNS
- TLS
- HTTP
- Headers
- Configuration
03
Understand
Correlate observations into meaningful findings — explained in plain English, not raw scanner noise.
- Staging infrastructure appears publicly accessible
- Email authentication needs attention
- Unnecessary third-party exposure
04
Act
Get prioritized recommendations instead of another endless security dashboard.
- HIGH — Review public staging environment
- MEDIUM — Strengthen email authentication
- LOW — Review unnecessary third-party services
Features
Everything you need to understand your external security posture.
Discovery, analysis, prioritization, and monitoring — designed as one coherent product, not a pile of scanner outputs.
Attack Surface Discovery
Know what is publicly exposed.
Discover domains, subdomains, certificates, public endpoints, and other externally observable assets.
Technology Intelligence
Know what powers your public infrastructure.
Identify frameworks, hosting providers, CDNs, analytics platforms, SaaS integrations, and other technologies.
Next.jsAWSCloudflareStripeSentryGoogle Analytics
DNS & Domain Security
Understand your domain configuration.
Analyze DNS, SPF, DKIM, DMARC, CAA, MX, nameservers, and TLS certificates.
Web Security Analysis
Analyze publicly observable web security controls.
Check HTTPS, HSTS, CSP, security headers, cookie attributes, and TLS configuration.
Public Intelligence
Understand what your company exposes publicly.
Surface relevant documents, repositories, technology references, and public-facing services.
Risk Prioritization
Turn hundreds of observations into a short list of actions.
Severity-ranked findings so your team knows what to fix first.
3
High
7
Medium
14
Low
AI Security Analysis
Security information in plain English.
Instead of "DMARC p=none", see: Email impersonation protection is not fully enforced — and why that matters.
Continuous Monitoring
Your security posture changes every day.
Detect new subdomains, technologies, certificate changes, DNS shifts, and new public services.
Report preview
One dashboard. Your entire external footprint.
Scores, category breakdowns, and priority findings — animated into view the way a real scan would populate.
SecurityPosture
acme.com
Last scan: 2m ago
0
Posture score
0
Assets
0
Technologies
External posture
- DNS Security0
- Web Security0
- Email Security0
- Asset Exposure0
Priority findings
High
Public staging environment
High
Email authentication needs attention
Medium
Unnecessary public service
Attacker perspective
Think like an outsider.
SecurityPosture doesn't need access to your internal systems to answer an important question: what does the outside world already know about you?
Your view
Outsider's view
“We have one website.”
23 public assets
“Our infrastructure is secure.”
17 technologies exposed
“We don't expose staging.”
4 additional hostnames
“We only use a few SaaS tools.”
14 third-party services
SecurityPosture connects the dots.
Evidence-based AI
AI explains the evidence. It doesn't invent it.
Deterministic collection and security rules produce findings. AI turns those findings into clear language and next steps.
Observation
→Evidence
→Security rule
→Finding
→AI explanation
→Recommendation
Observed
No DMARC enforcement detected
Finding
Email security requires attention
AI explanation
Attackers may have an easier time spoofing your domain in certain circumstances.
Recommendation
Review and strengthen your DMARC policy.
Continuous monitoring
Your attack surface changes. So should your security posture.
SecurityPosture continuously watches for meaningful changes to your public footprint.
- +
Monday
api.example.com discovered
- +
Tuesday
New certificate detected
- !
Wednesday
Security header changed
- +
Thursday
New SaaS technology detected
- ✓
Friday
Issue resolved
Who it's for
Built for teams that need security visibility without another security team.
Startups
Know what you've exposed before customers, investors, or security reviewers ask.
Engineering Teams
Understand changes to your external infrastructure without manually tracking every asset.
Security Teams
Maintain an always-current view of your organization's external security posture.
Voices
From teams who needed external visibility — not another scanner.
Engineering, security, and founders using SecurityPosture to understand what the internet already sees.
“We thought we had two public properties. SecurityPosture showed staging, docs, and a forgotten API host before our SOC 2 reviewer did.”
MC
Maya Chen
Head of Engineering · B2B SaaS · Series B
Boundaries
SecurityPosture is built for visibility, not exploitation.
Clear product boundaries build trust — for your customers and for the teams you ask to run a scan.
What we do
- Passive external discovery
- Publicly observable analysis
- Configuration analysis
- Security posture monitoring
- Evidence-based recommendations
What we don't do
- No credential harvesting
- No destructive testing
- No unauthorized exploitation
Security & privacy
Your domain is yours. Your data should be treated that way.
No credentials required for basic scans. We don't claim certifications we haven't earned — we ship clear controls you can evaluate.
No credentials for basic scans
External analysis starts from your domain alone — nothing to install or hand over.
Encrypted data handling
Scan data is protected in transit and at rest with modern encryption practices.
Access controls
Workspace-scoped access so only the right people see your posture reports.
Scan isolation
Each analysis runs in isolation so one customer's scan never bleeds into another.
Retention controls
Clear controls over how long scan history and findings are retained.
Audit logging
Track who initiated scans and accessed reports for accountability.
Pricing
Start with a free external analysis.
Pricing for continuous monitoring will expand as the product ships. The first value is clear: see what the internet already sees.
Free Analysis
$0
Run an external scan and see your public footprint.
- 1 domain
- Full discovery pass
- Posture score
- Top findings
Monitor
Coming soon
Continuous change detection across your external assets.
- Recurring scans
- Change alerts
- Historical diffs
- Team access
Team
Custom
For orgs that need shared workspaces and reporting.
- Multiple domains
- Exportable reports
- Audit-friendly history
- Priority support
FAQ
Questions teams ask before their first scan.
Get started
See what the internet sees.
Enter your domain and discover your external security posture in minutes.
No credentials required · Passive external analysis
Start with a free external analysis →