From a verified domain
to verified fixes.
Prove you own the domain, authorize the scan, and VulnVerify does the rest: a safe external scan every week, a report you can verify, and every open scan finding tested again on the next run.
Six steps, then every week
The first two happen once. The last four repeat on every weekly run.
Prove you own the domain
Add a DNS TXT record, publish a file on your website, or confirm a link sent to an administrative mailbox such as admin@ or security@ at your domain. Nothing is scanned before one of the three passes.
Sign the scan authorization
Your name, your title and one explicit consent, recorded with the version of the text you agreed to. It covers the registrable domain and the hosts under it, and you can pause scanning at any time.
A safe external scan, every week
Passive subdomain discovery, a light probe of each host, then checks for known CVEs, exposures, misconfigurations, takeovers and TLS problems — critical, high and medium severity only, capped at 50 requests a second.
A report you can verify
Each completed run produces a PDF with what is new, what is still open and what was fixed, plus the authorization it ran under. Its SHA-256 fingerprint can be checked by anyone on our verify page.
Fixes tested again
The next run tests every open scan finding again, and every intelligence finding that carries a CVE the scanner has a check for. When one no longer reproduces on a host that still answers, it is marked fixed and verified, with the date and the run that proved it.
Evidence for your auditor
Findings, verified fixes and reports are mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls. Download them for your audit file, or, on the Weekly Scan plan, connect Drata or Vanta with your own API key and they are pushed as evidence.
What it does — and never does
The full rules, the addresses our traffic comes from and how to stop it are published in our scanning policy.
It does
- Passive subdomain discovery — no DNS brute force, no zone walking
- A light liveness probe of each host it finds
- Known-CVE, exposure, misconfiguration, takeover and TLS checks
- At most 50 requests a second and 10 checks in flight
It never touches
- Denial-of-service, brute-force, fuzzing or intrusive checks
- Default-credential logins
- A host outside the domain you verified — redirects are not followed
- A domain nobody has verified and authorized
What reaches your report
Two sources, one report — each finding labelled with where it came from.
Scan findings
What the scanner observed on your live hosts this week, at critical, high and medium severity, with the host, the path and the check that matched. Anything below medium is left out, and a host outside your domain is dropped before a request is sent.
Intelligence findings
What our research pipeline already holds for your domain. Each one was reproduced by a researcher before it was published. Your weekly scan tests one again when it carries a CVE the scanner has a check for, on a host inside your verified domain. Any other intelligence finding is not re-tested by the scan; you mark it patched yourself when you fix it.
Your first report
The first report for your domain is free — every finding, and the PDF, with no card.
The Weekly Scan plan — weekly scanning, fix verification and the Drata or Vanta push — is $159/month after that.
Our researchers
Our research team consists of security researchers with a combined 50+ years of experience in bug hunting, vulnerability research, and threat intelligence. Every intelligence finding is reproduced by a researcher who signs off on the PoC and the remediation before it is published — and a finding without that sign-off is never published at all.
- Authorization
- We scan only a domain its owner has verified and authorized, under the scanning terms in our Terms of Service.
- Human sign-off
- An intelligence finding reaches your dashboard only once a researcher has reproduced it and written the report.
- Cadence
- A scan every week on the Weekly Scan plan, and a report after each run. Pause scanning from your domains page whenever you need to.
Get your first report free
Sign up with your work email, verify your domain and authorize the scan. Your first report is free — every finding, and the PDF.
See what's exposed on your domain
Verify your domain, authorize the scan, and your first report is on us. Weekly scanning, fix verification and compliance evidence continue on one plan you can cancel any time.
Free first scan · $159/mo after