Know what's exposed on your domain — every week.
An authorized external scan of the domain you verify, every week, under a published safe profile. Every open scan finding is tested again on the next run, every report carries a fingerprint anyone can verify, and the evidence goes to Drata or Vanta. Your first report is free.
Free domain check — no signup needed. You'll see how many verified findings our intelligence already holds for the domain.
The free external scan needs a work email (we don't support gmail / outlook / yahoo, etc.).
Hall of Fame
VulnVerify researchers have been recognized in the security hall-of-fame and responsible-disclosure programs of leading global companies — for privately identifying and reporting vulnerabilities in their products.
Hear it from the teams we reported to
VulnVerify was professional, clear, and very easy to work with throughout the process. They reported the issue responsibly, explained everything well, and supported us during validation and retesting.
Mehmet Taşar
CTO at ProjectSynergy
Recommendation 1 of 10: Mehmet Taşar
A scan finding
Exactly what your weekly report shows.
The host, the path and the check that matched, with severity and remediation — and a status the next run keeps honest: open until a scan proves it fixed.
- Verified intelligence findings
- 541
- 322 critical · each reproduced by a researcher
- False positives
- 0%
- Across published intelligence findings
Most vulnerability data is noise.
Point a scanner at the internet and it will hand you a long list, most of it low severity, some of it wrong, none of it telling you whether last month's fix held. We run a narrower scan, only against the domain you verified and authorized, and we test every finding again on the next run — so the list you get is the list worth fixing, and the fixes are proven.
What you usually get
- Mostly low and informational results
- Aggressive checks that set off your own alerts
- No re-test: fixed and still-open look the same
- Scans of hosts nobody proved they own
- A PDF nobody can map to a control
What lands in your report
- Critical, high and medium only
- Every open scan finding tested again on the next weekly run
- Safe profile: no denial-of-service, fuzzing or brute force
- Only your verified domain, only with your authorization
- Researcher-verified intelligence findings for the same domain
Low and informational checks are not run at all. A finding is marked fixed and verified only when a complete run checked the same live host with the same check and could no longer reproduce it; a host that has gone away is reported as gone, never as fixed.
From a verified domain to audit evidence
You do the first step once; the other four repeat every week on the Weekly Scan plan. Your first scan is free, and so is its report: every finding in it, including the intelligence findings we already hold for your domain. Weekly re-tests, fix verification and the Drata or Vanta push come with the plan.
Prove you own the domain, then authorize
Add your domain and prove control with a DNS TXT record, an HTTPS file or a link sent to one of the domain's role mailboxes. Then someone at your organization authorizes scanning, by name and title. Nothing is scanned until both are done.
An authorized external scan, every week
Passive subdomain discovery, then critical, high and medium checks under the published safe profile: a bounded request rate, no denial-of-service, fuzzing or brute force, and nothing outside your verified domain. The first scan is free.
A verifiable report after every run
Each finding with its host, path, severity, CVE and CWE where one applies, and remediation — plus any finding our researchers verified for the same domain. Every PDF carries a SHA-256 fingerprint anyone can check on our public verification page.
Fixes proven on the next run
Every open scan finding is tested again on the next weekly scan, and so is an intelligence finding that carries a CVE the scanner has a check for. When a complete run checks the same live host and can no longer reproduce it, it is marked fixed and verified, with the date and the run that proved it. A host that has gone away is reported as gone, never as fixed.
Evidence where your auditor looks
New findings, verified fixes and the monthly monitoring statement go to Drata or Vanta through your own API key, mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls. A signed webhook and GitHub Issues are there too.
Findings you can act on, and proof you fixed them.
Not a one-off PDF — a weekly scan of the domain you verified, a report anyone can verify, and every fix tested again on the next run.
Everything you need to fix it
Each finding names the host, the exact path and the check that matched, with the severity, CVE and CWE where one applies, and remediation. Findings from our intelligence pipeline were reproduced by a researcher before they reached you.
- host
- app.example.com
- path
- /.git/config
- check
- exposure · git-config
- severity
- high · CVSS 7.5
- status
- open · tested again next run
An authorized scan of your verified domain, and a report after every run.
Fix verification
No low or info checks
Evidence where you work
VulnVerify vs. the alternatives
A scanner you run yourself finds things and leaves the rest to you. A pentest is thorough and happens once. A ratings service watches from outside without asking. VulnVerify scans the domain you verified, with your authorization, every week — and proves each fix on the next run.
| Feature | VulnVerify | DIY scanner | Manual pentest | Ratings services |
|---|---|---|---|---|
| Cadence | YesWeekly | PartlyWhenever you run it | PartlyPer engagement | YesContinuous, passive |
| Authorization before testing | YesVerified owner consents | PartlyUp to you | YesSigned scope | NoNot asked |
| Fix verification | YesNext weekly run | PartlyRe-run by hand | PartlySeparate retest | PartlyOn their schedule |
| Manual verification of criticals | PartlyIntelligence findings | NoAutomated only | YesBy the tester | NoAutomated only |
| Compliance evidence push | YesDrata · Vanta | NoExport by hand | PartlyOne PDF | PartlyRating reports |
| Price | Yes$159/mo | PartlyTool + your time | PartlyPer engagement | PartlyAnnual contract |
One plan. Your first report is free.
Verify your domain and the first scan is on us — every finding, the PDF and the export, no card. Weekly Scan continues it at $159/mo with a scan every week, fix verification on the next run and compliance evidence for Drata and Vanta.
Weekly Scan
Or $1,590/yr · 2 months free
Authorized external scanning of your domain, every week, with a verified report.
Start with a free scan- Authorized external scan of your verified domain, every week
- Critical, high and medium findings under a published safe profile
- Fix verification: every open scan finding re-tested on the next run
- Weekly PDF report with a public SHA-256 fingerprint
- Monthly monitoring statement, even in zero-finding months
- Findings from VulnVerify intelligence on the same domain
- Email + Slack alerts, CSV / JSON export
- Drata, Vanta, webhook and GitHub Issues integrations
- Priority support · 24h target response
Enterprise
For multi-domain teams and MSPs — every domain you verify scanned, on a cadence and scope agreed with you.
Contact sales- Everything in Weekly Scan, on every domain you verify
- Multi-domain and MSP portfolios under one account
- Custom scan cadence and scope, agreed with you
- Custom integrations (SIEM, SOAR, ticketing)
- Dedicated security analyst (named individual)
- 1h target response + quarterly business reviews
Compare everything on the full pricing page →
Built for the people responsible for security outcomes
Security teams
A weekly authorized scan of your external surface, critical to medium only, under a safe profile with a bounded request rate. The report email after each run summarizes what it found; the host, path and remediation are in the dashboard and the PDF, and the next scan tells you whether the fix held.
CISO & leadership
A weekly report and a monthly monitoring statement, each with a fingerprint anyone can verify, that show what was found, what was fixed and when the fix was proven. Evidence you can put in front of a board, not a score.
Compliance & audit
New findings, verified fixes and monthly statements pushed to Drata or Vanta, mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls. The statement is issued even in months with nothing to report, and an evidence pack, prepared from your scan runs, bundles the period for your auditor.
Engineering & response
When a critical lands, the finding already names the host, the exact path, the check that matched and the remediation. Your engineers start at the fix, not at discovery — and the next run confirms it is gone.
Questions, answered
See what's exposed on your domain
Verify your domain, authorize the scan, and your first report is on us. Weekly scanning, fix verification and compliance evidence continue on one plan you can cancel any time.
Free first scan · $159/mo after