Your company and your suppliers, as others see them
Score your own domain and the suppliers you depend on from public evidence, and fix what an insurer or a customer would find first.
Last reviewed
Start with your own domain.
Give TrustSek your domain and it collects public evidence about it: your mail records, your certificates and web configuration, what threat intelligence and ransomware trackers say, and what your internet-facing estate looks like. Nothing is installed and nothing inside your network is touched.
The result is a score against a baseline and a list of findings. Each finding says what was tested, why it matters, what the impact could be and how to fix it, so the person who fixes it and the person who signs it off read the same thing.
Email security · Medium severity
DMARC policy is set to none
- What was tested
- The DMARC record published at
_dmarc.example.com. - Why it matters
- Without an enforcing policy, anyone can send mail that appears to come from your domain.
- Impact
- Phishing and invoice fraud in your name, aimed at your customers and staff.
- How to fix it
- Monitor DMARC reports, then move the policy from
p=nonetop=quarantineand on top=reject.
Add your suppliers.
Suppliers are scored the same way, without asking them for anything. Keep a list of the vendors you depend on, each with its own score and findings, and see at a glance where one of them has something that could not be checked.
| Supplier | Score | Band | Coverage |
|---|---|---|---|
| mailer.example | 3.4× | Medium | Not checked |
| logistics.example | 1.6× | Low | Complete |
| hosting.example | 7.2× | High | Complete |
| payroll.example | 2.3× | Medium | Complete |
Use it for NIS2 supply-chain work.
NIS2 asks essential and important entities to address security in their supply chain (Article 21(2)(d)). Scoring a supplier's domain gives that work a documented, repeatable starting point: the same checks for every supplier, with the evidence and the date recorded.
It does not replace your contracts, questionnaires or the supplier's own processes, and a good score is not proof that a supplier is compliant. The NIS2 page lists which Article 21 measures outside-in evidence can support and which it cannot.
Fix what an insurer or a customer will see.
Insurers, customers and partners can look at the same public evidence you can. Seeing it first lets you fix the findings that are cheap to fix, such as an email policy that does not reject spoofed mail, before someone else asks about them. PDF reports put the score and the findings in a form you can hand to a board or a customer.
example.com
3.4×Medium
- Email security2 findings
- TLS and web hygiene1 finding
- Ransomware exposureNone found
- ReputationNot checked
- Vulnerabilities3 findings
- Attack surfaceNone found
It sees only public evidence, when you run it.
TrustSek does not install agents or ask for access, so it cannot see inside your network. It works from public evidence only, and a source that failed or was not checked is shown as such, never as a clean result.
It is a scan you run, not continuous monitoring, and it does not include breach or leaked-credential data. The methodology explains exactly how the score is built and what it cannot see.
Check a domain now
Your own, a supplier's, or one you are quoting.