Enter your domain below. We run a live passive reconnaissance scan — the same data sources a threat actor uses before any attack. No systems accessed. No credentials required.
Enter your primary domain and contact details. We identify all associated entities, subdomains, and publicly visible infrastructure before we begin.
Our structured 5-phase passive assessment framework is applied across your entire external footprint. No systems accessed. No credentials required.
A structured professional report — risk register, framework mapping, APP compliance assessment, and a Board-level executive summary — delivered within 5–7 business days.
Corporate entity mapping, subsidiary identification, domain and subdomain enumeration, and email security record analysis across all associated entities.
Passive infrastructure review, certificate analysis, SSL/TLS configuration audit, and technology stack fingerprinting across all public-facing systems.
Domain breach exposure analysis, credential scanning, public repository secret detection, historical footprint review, and paste site monitoring.
Privacy policy assessment against Australian Privacy Principles (APP 1–13), cross-border disclosure review, and third-party vendor risk identification.
All findings consolidated into a structured risk register, mapped to ASD Essential Eight, NIST CSF 2.0, ISO 27001, APRA CPS 234, and the Privacy Act. Board-level executive summary and prioritised remediation roadmap.
Open Source Intelligence — OSINT — is the practice of gathering information exclusively from publicly available sources. No systems are accessed. No credentials are required. Everything surfaced in this scan is already visible to anyone who knows where to look.
Domain registrars, certificate transparency logs, DNS records, breach databases, government registries, paste sites, social networks and search engine indexes all contain information about your organisation — published, indexed and accessible right now. Passive OSINT is the discipline of systematically collecting and analysing that information to understand what is exposed.
This scan covers five intelligence categories: infrastructure and hosting, breach and credential exposure, technology stack and known vulnerabilities, Privacy Act compliance posture, and corporate entity intelligence. Each finding above is sourced from publicly available data only.