Free tools and checklists
Key takeaways
- Self-checks are free and immediate, and they make a consultation worth more when you have one.
- Most of these are configuration problems, which means the fix is usually not a rebuild.
- We would rather you find the easy issues yourself than pay us to tell you what is obvious.
- If a tool flags something serious, contact us rather than posting it publicly.
What is available
Password exposure check
Check whether an email address or phone number appears in a known breach corpus. We run it for you as part of an account review — and you can check your own domain addresses directly on the site your browser already trusts, rather than handing them to a free tool you have never heard of.
Website TLS and header check
A scan of your HTTPS configuration: certificate validity, protocol version, cipher suite, and whether HSTS, CSP and the other security headers are set correctly. Most sites fail this on the first run, and the fix is usually a configuration change rather than a code change.
Domain exposure watch
Continuous monitoring for lookalike domains, typosquats and homograph registrations, with a takedown attempt on anything that appears. This is the cheapest protection against a brand impersonation that is otherwise waiting to happen.
Phishing simulation kit
A controlled campaign design for your organisation, with realistic pretexts, safe landing pages that never collect a working credential, and a measurement of who clicked, who submitted and who reported.
Vendor security questionnaire
A structured due-diligence questionnaire for your suppliers, with the questions that actually distinguish a supplier with a security function from one that has answered the same generic form since 2019.
Incident response checklist
The steps to take in the first hour of a suspected incident, in the order they should be taken, and the mistakes that make things worse. Written for someone who has never done this before and is currently doing it.
How to use these well
Run the checks, write down what you find, and bring the output to a scoping call. It saves everyone time, and it means the engagement starts from facts rather than assumptions. The one rule: if a check flags something actively exploitable, do not post it on a forum or a social media account before it is fixed.
What we do not publish
We do not publish exploit code, ready-to-run attack tools, or anything that would make someone else's job easier. A defensive checklist and an attack tool are not the same artifact, and a site that mixes them is a site that ends up in a blocklist. The tools here are defensive on purpose.
Need help interpreting what you find?
Send us the output and we will tell you what matters, what does not, and what to fix first.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.