Know what'sexposed onyour domain— every week

Two places, both about your domain only. Most come from the weekly authorized scan of the domain you verified. The rest come from VulnVerify's intelligence pipeline: findings our research team verified for the same domain from publicly accessible sources, often before you signed up. Both appear in the same dashboard and the same report, and each scan tests the intelligence findings again wherever it has a check for them.

It depends on where the finding came from, and the report keeps the two apart. A scan finding is verified when a check in the published safe profile matched on your host during an authorized scan; the host, the path and the check that matched are recorded with it. An intelligence finding is verified when one of our researchers reproduced it before it was published. A fix is verified when a later complete scan checks the same live host with the same check and can no longer reproduce the finding. A host that has gone away is reported as gone, never as fixed.

It collects hostnames under your verified domain from passive sources only, sends each a light HTTP and HTTPS probe, and runs critical, high and medium checks for known CVEs, exposed files and configuration, misconfigurations, subdomain takeovers and TLS problems — at most 50 requests a second across the whole run. It never runs denial-of-service, fuzzing, brute-force, intrusive or default-credential checks, never follows a redirect, and never touches a host outside the domain you verified. It is not a penetration test: it does not log in, and it does not chain findings together the way a person testing your application would. The full profile, our egress addresses and how to stop a scan are on the scanning policy page.

Sign up with a work email, add your domain, prove you control it and authorize the scan. The first complete scan of that domain is free, with no card: every finding in it, including any intelligence findings for the domain, the PDF report and the export are yours to keep. Every report after it, fix verification and the Drata / Vanta push come with Weekly Scan at $159/mo; the free report stays available either way.

Only your own domain's data, through an API key you add in Settings: each new scan finding, each verified fix, each completed scan report and each monthly monitoring statement, as evidence mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls. The statements, reports and evidence pack are prepared by the platform from your scan runs, not written up by hand. The same events can go to a signed webhook, or open and close GitHub Issues. The key is stored encrypted, nothing about any other company is ever sent, and pushes are part of the subscription — the free first report can be downloaded and uploaded by hand.

Press Pause scanning on the domain in Domains to take it out of the schedule, or remove the domain to end its authorization. You can also email security@vulnverify.com. Anyone who sees our scanner in their logs and did not expect it can write to the same address, and we stop scanning the domain concerned while we look into it.

Each completed scan sends its own report email with a summary, and the details are in your dashboard and the PDF. Alerts cover findings from our intelligence pipeline: on the Alerts page you create rules for the severities you care about, the channels (email, Slack) and how often a rule may re-fire. Delivery runs once a day at 09:00 UTC, so the frequency setting caps how often a rule can ping you — it does not make delivery faster.

Nothing, on your side: we re-test every open scan finding on the next weekly scan, under the authorization you already gave, along with any intelligence finding whose CVE the scanner has a check for. If a complete run can no longer reproduce it on the same live host, it is marked fixed and verified, with the date and the run that proved it. Any other intelligence finding you mark Patched by hand. A scan finding's status is the scanner's to change, except that you can accept the risk, with a note.

Every account is bound to a company domain extracted from your work email. This is what makes the single-tenant security boundary work: you see findings on your domain, and only your domain. We block free providers such as Gmail, Yahoo and Proton at signup. Security researchers without a work email can contact us for special-case access.

It just works. We fold your work-email host to its registrable domain at signup — us.example.com becomes example.com — so regional and departmental mailboxes land in the same company tenant with no support step. Hosted-platform hosts are the deliberate exception: acme.zendesk.com keeps the acme label, so one platform's customers never share a tenant.