An outside-in risk score to open every client conversation

Assess a prospect or a client in about 30 seconds.

You need nothing from the client but their domain. TrustSek collects public evidence about it: mail records, certificates and web configuration, threat-intelligence and ransomware-tracker listings, and the internet-facing estate. Nothing is installed and you do not need their credentials.

That makes it useful before a contract exists. Run a scan before the first meeting and you arrive with specific points about their domain rather than a general pitch. Run one at onboarding and you have a dated record of where the client started.

Your technicians get findings they can act on.

Each finding says what was tested, why it matters, what the impact could be and how to fix it. The fix is written for the person who will carry it out, so a finding can go straight into a ticket.

Many first findings are quick to fix and easy to show: a DMARC policy that does not reject spoofed mail, a missing security header, a certificate close to expiry. When you fix one, re-run the scan and show the client the change.

The score itself is a multiplier against a baseline, in four bands. The methodology explains how it is built, and the module pages, such as email security, explain what each part checks.

Hand the client a report.

Every scan can be exported as a PDF report with the score, the findings and the remediation steps, for a client meeting or a quarterly review. Your organisation can add its logo, brand colour and a footer to reports; they still name TrustSek as the source, so the client can see where the evidence comes from.

Keep your clients in one view.

Add each client as a company in your organisation, with its own score and findings. A portfolio view shows them side by side, so you can see which clients need attention first. Tags let you group them the way you work.

To add many clients at once, use the API: one request creates a company and starts its scan.

Today, all your clients sit in one organisation.

Today a partner uses one TrustSek organisation and adds its clients to it as companies. Your team signs in to that organisation, sees every client in it, and exports reports to share.

Your clients do not get their own logins or their own separate workspace, and there is no per-client billing. If a client wants to use TrustSek directly, they have their own account.

It scans from outside; it does not monitor or test.

It is a scan you run, not continuous monitoring. It does not watch client domains between scans or send alerts. It does not include breach or leaked-credential data.

It works from public evidence only, so it cannot see inside a client's network, check MFA or backups, or replace an assessment on site. A source that failed or was not checked is shown as such, never as a clean result.

It is not a penetration test. Vulnerability findings come from advertised software versions, not from active testing.

See a client's point of view.

Your clients may use the same evidence for their own supplier work under NIS2. For companies shows what they see.

Talk to us about partnering, or book a demo to see it with one of your own clients' domains.