For organisations

A sample report.

This is the report a client receives, for an organisation we invented, as it would have read on 30 October 2026.

An illustration. The organisation is invented; the kinds of finding are real.

External Exposure Audit

A regional logistics group

This report sets out what your organisation shows the open internet, read the way an attacker's first hour reads it: every hostname we could find, what each one serves, and the records behind them.

Domains: example.com, example.net
Size: Mid band, 48 live hostnames
When: Read between 29 and 30 October 2026

In this report

Start here
For the board
Your footprint
Findings
Software on show
What the web remembers
Your documents
Credentials
Method
Monitoring

Start here

illustration

Serious

A forged invoice would quote your real contract

You supply a federal department under a contract worth up to £9,600,000, until 26 June 2027. The public contract register publishes all of that, with the agency's own reference and the branch on the notice. The record for example.com tells mail servers to take no action on forged email.

So anyone can write to that branch from an address at example.com, quote the real contract and reference, and ask for the next payment to go to a new bank account.

The proof

A federal department, £9,600,000, to 26 June 2027
The public contract registerRead 29 October 2026
example.com publishes a DMARC record that only monitors
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Read 29 October 2026

The fix

Move the DMARC record for example.com from monitoring to enforcement once your real senders pass. Until then, ask that department to confirm any change of bank details by phone, on a number it already holds.

What else stands out

One near-identical address has mail set up

Serious

example.org is registered and has mail servers set up. It is your name with a different ending. We cannot see that it is yours. Mail sent there by mistake reaches whoever holds it, and what they send looks like you.

example.org has mail servers set up
example.org MX 10 mail.example.orgRead 29 October 2026

The fix. If it is yours, add it to your list of domains and set its records to refuse forged email. If not, warn your accounts team and ask its registrar to act.

Two names you may have forgotten still answer

Worth fixing

Certificate logs keep every name a firm has ever secured. staging.example.com is a test name, and anyone can open it. vpn.example.com still answers, and the certificate it serves has lapsed.

staging.example.com: a live site
https://staging.example.com/Read 29 October 2026
vpn.example.com is live, and its certificate has lapsed
https://vpn.example.com/Read 29 October 2026

The fix. Close what nobody uses, and give each of the rest an owner and a sign-in that is not open to everyone.

Six outside companies can send email as you

Worth knowing

Six outside companies can send email as example.com. If any one of them is broken into, what it sends in your name passes your own checks.

The SPF record for example.com names six outside companies
example.com TXT "v=spf1 include:mail.example.net include:crm.example.net ... -all"Read 29 October 2026

The fix. Name an owner for each one, and take out any that nobody here can name.

For the board

illustration

names you did not give us

old-portal.example.com staging.example.com tracking.example.com vpn.example.com and 55 more under Your footprint

A note for the board
Three findings need attention this week, and each is a short job for whoever holds the access.
The rest can follow in the normal run of work.
We will take you through all of it on the walkthrough.

Grades

External indicators, read from the outside. A domain's row reads its email and its main site. Footprint reads every hostname, so anything wrong elsewhere shows there.

Grades by domain and dimension
	Email security	Web security	Certificates	Privacy
`example.com`	C10 of 10 read	C24 of 27 read	A5 of 5 read	B4 of 5 read
`example.net`	A10 of 10 read	NOT STATED2 of 27 read	B4 of 5 read	NOT STATED1 of 5 read

FootprintThe whole organisationD9 of 9 read

Verdicts

Compromise

Clear

We read all 48 live hosts, and none showed the signs of a break-in.

Email in your name

Can be faked

Your DMARC record watches forgeries rather than stopping them.

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Read 29 October 2026

Exposed files and details

Found

2 files or details open to anyone who asks. Listed under Findings.

Software on show

1 on the exploited list

1 version your pages state falls inside a flaw attackers are known to be using.

Breach history

Not listed

Have I Been Pwned's public list holds nothing under your domains. Your staff's addresses are a separate question, set out under Credentials.

The five actions that matter most

Delete the record behind old-portal.example.comSerious10 minutesWhoever runs your DNS
Move your DMARC policy on from p=noneSerious10 minutesWhoever runs your DNS
Renew the certificate on vpn.example.comSerious30 minutesYour IT provider
Stop the uploads folder listing its filesWorth fixing10 minutesYour web developer
Put a script policy on your main siteWorth fixing90 minutesYour web developer

What we could not read

intranet.example.comDNS did not answer on either try.
dev.example.netNothing answered on 443 or 80 in the time allowed.

Your footprint

Every hostname we found, where it came from, and what it serves. Live means it answered on the web, on 443 or 80.

illustration

61names in the certificate logs
48live hostnames
1orphan: dangling, lapsed or not yours

The 12 most telling of the 61 names, to keep this illustration short. A real report lists every one.

Every hostname in the footprint
Hostname	Found in	Live	Platform	Certificate	State	Findings
`vpn.example.com`	Certificate logs	Live		DigiCert Lapsed 20 Oct 2026	Clean	Certificate lapsed
`www.example.com`	Certificate logs	Live	WordPress	Let's Encrypt To 26 Dec 2026	Clean	Folder anyone can browse
`staging.example.com`	Certificate logs	Live	WordPress	Let's Encrypt To 26 Dec 2026	Clean	Software version advertised
`tracking.example.com`	Certificate logs	Live			Clean	Plain HTTP only
`old-portal.example.com`	Certificate logs	Not live				A subdomain anyone can claim
`legacy.example.com`	DNS	Not live				Nothing listening
`archive.example.net`	Certificate logs	Not live				Nothing listening
`example.com`	Given by you	Live	WordPress	Let's Encrypt To 26 Dec 2026	Clean
`portal.example.com`	Certificate logs	Live	Microsoft IIS	DigiCert To 28 May 2027	Clean
`drivers.example.com`	Certificate logs	Live	Nginx	Let's Encrypt To 26 Dec 2026	Clean
`shop.example.net`	Certificate logs	Live	Shopify	Let's Encrypt To 26 Dec 2026	Clean
`intranet.example.com`	Certificate logs	Could not read

The orphans

Dangling names

A name pointing at a provider resource nobody holds. A stranger can claim it.

old-portal.example.compoints at example-old.azurewebsites.net

Findings, by dimension

8 findings. Each has where and when we read it, and the fix beside it.

illustration

Email security1 finding

Your DMARC record watches forgeries rather than stopping them

Serious

example.com

Email in your name can be faked. A receiver that detects a forged message from you will usually still deliver it.

p=none is the monitoring setting. It is the right place to start and the wrong place to stay.

Where we read it: _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
When: 29 October 2026, 14:02 GMT

The fix10 minutes

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

This is the record we read with one change: p=none becomes p=quarantine. Publish it once your reports show every service that sends as you passing, which usually takes 4 to 8 weeks of reading them. Then move to p=reject.

How we will know it is fixed. The next read of DMARC policy shows the change.

How the grade was worked out

example.comC

100 less 28 is 72. 10 of 10 read.
- 20DMARC is set to p=none, which asks receivers to do nothing: the policy exists and protects nothing
- 5No MTA-STS policy: mail servers cannot tell whether TLS is required for mail to this domain
- 3No TLS-RPT record: nobody reports failed TLS deliveries to this domain
example.netA

Nothing deducted. 10 of 10 read.

Web security1 finding

Nothing limits what scripts are allowed to run on your pages

Worth fixing

www.example.com

If anything ever injects a script, through a plugin somebody has altered or a third-party tag that gets taken over, it runs with the full run of the page.

A policy is the difference between an incident and a non-event.

Where we read it: https://www.example.com/ sent no Content-Security-Policy header
When: 29 October 2026, 14:05 GMT

The fix90 minutes

Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'self'

Deploy it as Report-Only first: as written it blocks nothing and reports what it would have blocked. Read those for a week, add the third parties you use, then drop -Report-Only.

How we will know it is fixed. The next read of Content-Security-Policy header shows the change.

How the grade was worked out

example.comC

100 less 25 is 75. 24 of 27 read.
- 20No Content-Security-Policy: nothing constrains what scripts the page may run
- 5X-Content-Type-Options is missing, so browsers may guess a response is a script

CertificatesNothing to fix

How the grade was worked out

example.comA

100 less 8 is 92. 5 of 5 read.
- 5The connection negotiated TLS 1.2 rather than 1.3
- 3No CAA record: any certificate authority may issue for this domain
example.netB

100 less 3 is 97. 4 of 5 read. An A needs every input read.
- 3No CAA record: any certificate authority may issue for this domain

PrivacyNothing to fix

How the grade was worked out

example.comB

100 less 10 is 90. 4 of 5 read. An A needs every input read.
- 10Cookies are set but no cookie policy could be found

Footprint4 findings

A subdomain anyone can claim

Serious

old-portal.example.com

This name points at a provider resource nobody holds. A stranger can claim that resource and serve whatever they like at your address.

A claimed subdomain sits inside your own domain, so its pages and its email look like yours.

Where we read it: old-portal.example.com CNAME example-old.azurewebsites.net (the target does not resolve)
When: 29 October 2026, 14:02 GMT

The fix10 minutes

Delete this record:
old-portal.example.com  CNAME  example-old.azurewebsites.net

How we will know it is fixed. The next read of the dangling names in your DNS shows the change.

The certificate on this host has lapsed

Serious

vpn.example.com

Until it is renewed, every person who connects sees a full-page browser warning, and your staff learn to click through warnings.

A lapsed certificate proves nothing to the person connecting.

Where we read it: https://vpn.example.com/ certificate, issued by DigiCert
When: 29 October 2026, 14:02 GMT

The fix30 minutes

Renew it with whoever issued it, then put its renewal date in a diary somebody reads.

How we will know it is fixed. The next read of the certificate expiry date shows the change.

This host answers on plain HTTP only

Worth fixing

tracking.example.com

Everything sent to this host can be read and altered on the way.

Nothing a person sends to it is private.

Where we read it: http://tracking.example.com/ answered; https://tracking.example.com/ did not
When: 30 October 2026, 09:41 GMT

The fix45 minutes

Put a certificate on it and redirect HTTP to HTTPS, or take it offline if nobody needs it.

How we will know it is fixed. The next read of the hosts on plain HTTP shows the change.

A name where nothing answered on the web

Tidy up

legacy.example.com

Nothing answered on the web at this name. If the service has gone and the address is ever reassigned, your name points at a stranger.

An old record is a small risk that costs nothing to remove.

Where we read it: legacy.example.com A 203.0.113.14 (nothing listens on 443 or 80)
When: 30 October 2026, 09:41 GMT

The fix5 minutes

Delete this record:
legacy.example.com  A  203.0.113.14

How we will know it is fixed. The next read of the names with nothing behind them shows the change.

How the grade was worked out

The whole organisationD

100 less 39 is 61. 9 of 9 read.
- 20old-portal.example.com points at a provider resource nobody holds
- 10vpn.example.com serves an expired certificate
- 5tracking.example.com answers on plain HTTP only
- 2nothing answered on the web at legacy.example.com
- 2nothing answered on the web at archive.example.net

Exposed files and details2 findings

Folder anyone can browse

Worth fixing

www.example.com

This folder lists its files to anyone who opens it, including documents nobody meant to publish.

Anything uploaded for one person is open to everybody.

Where we read it: https://www.example.com/wp-content/uploads/
When: 30 October 2026, 09:47 GMT

The fix10 minutes

Options -Indexes

Add that line to the site's .htaccess file, or ask your host to turn directory listing off.

How we will know it is fixed. The next read of the folder listing shows the change.

Software version advertised

Tidy up

staging.example.com

This page tells anyone which version of WordPress the site runs. The version is behind the current one.

A version number is the first thing anyone looking for an old site reads.

Where we read it: https://staging.example.com/readme.html
When: 30 October 2026, 09:47 GMT

The fix15 minutes

Update WordPress, then delete readme.html from the web root. The update puts it back, so make deleting it part of updating.

How we will know it is fixed. The next read of the WordPress version on show shows the change.

Software on show

Every version your public pages state, from their tags, script addresses and headers, matched against public flaw records.

illustration

Software versions your public pages state
Software	Version	Where it says so	What is known
jQuery	`1.12.4`	`portal.example.com` https://portal.example.com/js/jquery-1.12.4.min.js	On the known exploited list: `CVE-2020-11023`, listed 23 January 2025. Fixed in 3.5.0. Chance of attacks in the next 30 days, by EPSS: 85%. No longer gets security fixes. 3 other published flaws.
Microsoft IIS	`8.5`	`vpn.example.com` Server: Microsoft-IIS/8.5	Security fixes ended 25 October 2023.
Apache HTTP Server	`2.4.52`	`tracking.example.com` Server: Apache/2.4.52 (Ubuntu)	Built by a Linux distribution, so the number says nothing about its fixes.

A number is what the page states. A fix carried back by whoever runs the software would not change it, so IT may know more than this table can. Flaw records read 29 October 2026, the known exploited list 29 October 2026, support dates 29 October 2026.

What the web still remembers

A public web index keeps what its crawlers found. We read its crawls from 2021 to 2026 for your domains.

illustration

1,240pages it holds under your domains
2hostnames it has crawled
1name our other reads did not give

Names it gave us

tenders.example.com. These are in Your footprint, read like every other name. A wildcard certificate hides a name from the certificate logs, and a crawler still finds it.

Pages a public web index holds that read as sign-in, admin, test or old pages
Address	Reads as	Last seen	Today
`https://portal.example.com/login`	Sign-in page	29 September 2026	Still answers, with a sign-in
`https://www.example.com/test/`	Test page	28 November 2024	Still answers
`https://www.example.com/old/`	Old page	20 September 2022	Gone, or closed (404)

What your documents carry

We opened 2 documents your pages link to. 1 carries a login name or a path from inside your network.

illustration

What the properties of your public documents hold
Document	Carries	Made with
`annual-report.pdf`	Login name `j.citizen` Path `S:\Finance\Reports\annual-report-final.docx`	Microsoft Word 2016
`supplier-terms.pdf`	No login, path or author.	Adobe InDesign 18.0

Read from each file's own properties. Anyone who opens the file can see the same.

Credentials in known breaches

illustration

Have I Been Pwned's public list of 1,048 breached sites holds nothing under example.com, example.net.

Read 29 October 2026. Source: Have I Been Pwned, under CC BY 4.0.

Check your own staff's addresses

The list above is of sites that were breached. Most of your staff's exposure sits in the breaches of other sites, and only you can ask about that. It takes about ten minutes.

Open Have I Been Pwned, go to the Dashboard and sign in with a work email address. It sends a link to that address.
Under Domains, add example.com.
Prove you control it, by the record, the file, the meta tag or the admin mailbox it offers you. Whoever runs your DNS can do the first in five minutes.
Read the list. It shows each address on your domain that sits in a known breach, and which breaches. It is free for a domain with up to 10 breached addresses, and a larger domain takes a subscription.
For each address still in use, change the password anywhere it was used, and turn on two-step sign-in. Leave the domain on, and it tells you of the next one.

Method

illustration

What we read

The pages your sites serve at the addresses they advertise
DNS, certificates and the public certificate logs
The domain registries
AusTender's contract notices, where your name is on them
The properties of documents your pages link to
A public web index, for your own domains
A public list of breached sites, matched against your domains

With your authorisation

Authorised by the finance director on 29 October 2026.

The well-known paths a site never advertises, on the hostnames you confirm: /.git/HEAD, /.env, a backup in the web root, a browsable upload folder, phpinfo and the WordPress debug log.
Pages a public web index holds for those hostnames that read as sign-in, admin, test or old pages, each read once to see whether it still answers. At most 12.
GET requests only, at most 8 a host, and a file counts only when its content proves it.

Sources: Certificate logs, through crt.sh. Public DNS. The registries' RDAP records. Public contract notices, through AusTender. Common Crawl's public web index. Have I Been Pwned's public list of breached sites.
Grades: Rubric bondstone/rubric-v1. One grade per dimension, 100 less its deductions. An A needs every input read, and under three inputs a dimension says NOT STATED.
When: Read between 29 and 30 October 2026.

Software versions were matched offline. Known exploited flaws: the catalogue published by the US Cybersecurity and Infrastructure Security Agency, which does not endorse this report. Version ranges: the GitHub Advisory Database under CC BY 4.0, through OSV.dev. Attack likelihood: EPSS, from FIRST (first.org/epss), scores by Empirical Security. Support dates: endoflife.date. CVE identifiers are copyright The MITRE Corporation.

Everything here can be checked by you. Every finding names the place and the day, and every grade shows its sum.

Monitoring

illustration

Mid

£750a month

Starts the week after delivery, on a 12-month term, billed monthly.

Request a briefing

What we watch

Every weekNew names in the certificate logs, hosts gone quiet, dangling names, lapsed domains, signs of a compromise, every certificate, and every domain's SPF and DMARC
Every quarterYour grades again, and a short summary

What an alert says

What changed, where and when we read it, and what to do, with the record to paste.
At most one email a day.
An all-clear every four weeks when nothing changes.
When a fix lands, the next read proves it and we tell you that too.

Start with a briefing.

We read what the open web shows about your organisation and take you through it, with the proof. No charge.

Request a briefing See the External Exposure Audit

Rather talk first? Ring 0113 490 0521, weekdays 9am to 5pm UK time. At any other time, book a call and we ring you back.