A score out of 100 in minutes, with the fixes in order. The scan reads how your accounts, policies, cloud and email domain are configured, and every failed check becomes one goal. There is no charge, and we collect no logs.
Sign up with an email address, Microsoft or Google, and choose where your data lives. Today the region we serve is the European Union (Ireland). There are no sources to configure and nothing to install.
no agent · no credit check · freeMicrosoft 365 and Entra: an administrator consents once to a dedicated read-only app. An AWS account: one CloudFormation stack that creates a read-only role. A domain: no credential at all, just a DNS record that proves it is yours. We confirm the tenant or domain is yours before anything is read.
microsoft 365 · entra · aws · domain · next: azure · google workspace and cloud · oktaThe dashboard fills in as each part is read, identity first. Work through the goals in the order that moves the score most for the least effort, then scan again to prove the fix landed. Print it, send it to Word, or take the CSV.
typically minutes · re-scan on demandFour plain bands: exposed, basic, maintained, hardened. A check that could not run, because a licence is absent or a permission was not given, is shown with the reason and left out of the score. A silent gap never reads as a pass.
Each goal says how many points it returns, whether it is a half-hour fix, a half-day job or a project, the numbered steps with a link to the right setting in your admin console, and the accounts or resources it concerns.
Every check is a fixed rule over what was read. The same configuration gives the same answer every time, so a changed number always means a changed configuration.
A configuration scan cannot see policy, training or physical controls, and the framework views end with the controls it cannot speak to. It tells you where you stand. It never claims you are certified.
How things are set: inventory such as accounts, roles and policies, not what is inside them.
dashed needs one optional role or a licence; without it the check says not assessed, with the reason.
It does not read mailboxes, documents or messages. No logs are collected, nothing enters your data lake, no detection runs and no case is opened. Outside your tenant it makes only passive checks to hosts you name: a lookup, a handshake, a single request. It never scans ports.
The Microsoft app holds read permissions only and authenticates with a certificate, not a secret. It is its own app, never the one that connects your products for monitoring, and it cannot act on your tenant. The AWS role is read-only too.
Delete the Enterprise application in your Microsoft tenant, delete the stack in AWS, or remove the DNS record, and access ends at once. You can also tell us to forget the scan, and the targets and results are deleted straight away.
Results live in your own isolated tenancy in the European Union (Ireland). Unless you continue with us, they are deleted thirty days after your last scan. Your data trains nothing. The full picture is on the security page.
Some parts need a licence or an extra role, such as Exchange and Teams settings in Microsoft 365, which need one optional role assignment. Without it those checks say not assessed, with the reason, rather than guess.
Your score and a score for each area, the goals ranked by points per unit of effort, and a line that shows every re-scan so you can see the number rise.
More than 1,200 checks sit in the library, from an open-source engine and our own. Each failed check gives numbered steps, a link into the admin console, and the identifiers it concerns.
NIST 800-53, ISO 27001, SOC 2, NIST CSF 2.0, Cyber Essentials, Essential Eight, NIS2, CISA SCuBA and MITRE ATT&CK, each showing met, gap and not assessed. Print it, take it into Word, or export the CSV.
The posture scan. Configuration only, free, in minutes. It tells you where you stand and what to fix first.
A scan shows how the doors are set, not whether someone has already walked through. The assessment sweeps for the traces an intruder leaves, judged by Cyvantic AI with evidence cited and written up by a person. Free and read-only. How it works.
Detection, investigation and response, with the same posture scan running on its own so drift is caught. A separate consent round, and you decide when. What it costs.
No charge, no sales call required, no credit card. Sign up, connect what you want scanned, and read your score. Prefer to talk first? Ask us below: a person who builds the product reads every message and replies within two working days.