Skip to content

Your cyber risk, as others see it.

Give us a domain. We collect public evidence and explain every finding. No agents, no access to your systems.

Free, no sign-up. Takes about 30 seconds.

example.comIllustrativeScan complete
3.4×Mediumtimes the baseline risk

Coverage: 1 source not checkedConfidence: High

Lowunder 2.0
Mediumfrom 2.0
Highfrom 5.0
Criticalfrom 15.0
  • Email security20%2 findings
  • TLS and web hygiene20%1 finding
  • Ransomware exposure20%None found
  • Reputation15%Not checked
  • Vulnerabilities15%3 findings
  • Attack surface10%None found

Email security · Medium severityDMARC policy is set to none

What was tested
The DMARC record published at _dmarc.example.com.
Why it matters
Without an enforcing policy, anyone can send mail that appears to come from your domain.
Impact
Phishing and invoice fraud in your name, aimed at your customers and staff.
How to fix it
Monitor DMARC reports, then move the policy from p=none to p=quarantine and on to p=reject.
Illustrative recreation of the scan board, for example.com. Not a real scan.

Six weighted modules make up the score.

Every finding belongs to one module, so you can see exactly where the score comes from.

How each module is scored⁠

The score is a multiplier on a baseline.

There is no mark out of 100. We start from a 2% chance that an average organisation has a cyber incident in a year. The score multiplies that baseline: 1.0× is the baseline, where a domain with no findings lands, and 3.0× is roughly three times as likely.

Likelihood is capped at 95%, because no model should claim certainty.

Methodology, scoring policy v2.1.0⁠

If we could not check it, we say so.

A source we could not reach is marked Not checked, never counted as a clean result. The report names exactly which evidence is missing.

A missing source adds nothing to the score. It shows up as coverage instead, right beside the number.

Reputation Not checked

The reputation source could not be reached, so it is shown as not checked.

Each finding comes with its evidence and its fix.

What was tested, why it matters, the impact, and the steps to fix it. Written so the person who fixes it and the person who signs off read the same thing.

Medium severity

DMARC policy is set to none

What was tested
The DMARC record published at _dmarc.example.com.
Why it matters
Without an enforcing policy, anyone can send mail that appears to come from your domain.
Impact
Phishing and invoice fraud in your name, aimed at your customers and staff.
How to fix it
Monitor DMARC reports, then move the policy from p=none to p=quarantine and on to p=reject.

Built for three kinds of buyer.

Companies

Fix what an insurer or customer will see before they see it, and give NIS2 supplier checks a documented, repeatable basis.

For companies: TrustSek for companies⁠

MSPs and IT partners

Show each client where they stand from the outside, with findings your team can act on and branded PDF reports.

For partners: TrustSek for msps and it partners⁠

Insurers and brokers

Score a prospect at quote time or look across a book in portfolio views. No questionnaire, no access needed.

For insurers: TrustSek for insurers and brokers⁠

Illustrative · example domains, not real scores.

Everything around the score.

Your logoCyber risk report

example.com

3.4×Medium

Lowunder 2.0
Mediumfrom 2.0
Highfrom 5.0
Criticalfrom 15.0
  • Email security2 findings
  • TLS and web hygiene1 finding
  • Ransomware exposureNone found
  • ReputationNot checked
  • Vulnerabilities3 findings
  • Attack surfaceNone found
Illustrative · first page of a branded PDF report.
SupplierScoreBandCoverage
mailer.example3.4×MediumNot checked
logistics.example1.6×LowComplete
hosting.example7.2×HighComplete
payroll.example2.3×MediumComplete
Illustrative · supplier view, example domains.

Portfolio, 6 domains

Lowunder 2.0
Mediumfrom 2.0
Highfrom 5.0
Criticalfrom 15.0
  • logistics.example1.6× Low
  • payroll.example2.3× Medium
  • retail.example3.4× Medium
  • cloud.example4.4× Medium
  • hosting.example7.2× High
  • freight.example11.8× High
Illustrative · portfolio view, example domains.
POST https://api.trustsek.com/v1/subjects?scan=trueAuthorization: Bearer es_…
{
  "name": "Example AB",
  "primaryDomain": "example.com"
}
201 Created
{
  "id": "0b6f…",
  "name": "Example AB",
  "primaryDomain": "example.com",
  "createdAt": "…",
  "runId": "5c2e…"
}
Illustrative · add a company and start its scan in one call.

Findings mapped to the controls you report on.

Outside-in evidence supports these frameworks. It does not replace an audit, and each framework page says plainly what it does not cover.

Email security · Medium severity

DMARC policy is set to none

Email security · Medium severity

SPF record has no all mechanism

Illustrative · the two email findings from the example scan map to 3 of 4 frameworks.

Where does your domain land?

Lowunder 2.0
Mediumfrom 2.0
Highfrom 5.0
Criticalfrom 15.0

Free, no sign-up.

Prefer a walkthrough? Book a demo⁠