Skip to main content

Exposure Check

A fast, external check of whether your internet-facing systems are exposed to the serious vulnerabilities in the current advisory schedule.

Book a Scoping Call

Exposure Check answers one question quickly. We discover what you expose to the internet and check every in-scope asset against a dated schedule of serious, externally detectable advisories, plus a set of baseline checks. It covers a wide estate against a narrow, current list rather than testing that estate in depth, which is what makes it short and what makes it cheap. It is not a penetration test and does not replace one.

Scope

One organisation. All registered domains you own or manage, and up to 256 public IP addresses, a full /24, which is 254 usable hosts. Assets on shared hosting, SaaS platforms or CDNs you cannot authorise are out of scope.

Sizing the check

There is one fixed scope. Answer four questions before ordering. If any answer exceeds the limit, the enquiry moves to the matching Enhanced product rather than growing this one.

Which registered domains do you own or manage?
All of them, listed
How many public IP addresses do you own or manage?
Up to 256, a /24
Who hosts each website, and who built or manages it?
Named for every in-scope site
Do you run a self-hosted CMS such as WordPress, self-managed GitLab or a Palo Alto firewall?
Yes, no or unsure

Subdomains found during discovery are included. Addresses on shared hosting, SaaS platforms or CDNs are not counted and are not tested.

What we check

  • Every advisory in the current schedule.
  • Self-hosted CMS and PHP versions where disclosed, and visible signs of known compromise.
  • Exposed firewall, VPN, hypervisor and CI/CD administration interfaces.
  • TLS configuration, certificates and CAA records.
  • Security headers on in-scope web services.
  • SPF, DKIM and DMARC email authentication records.

Each advisory is reported as Affected, Not affected, or Cannot tell externally.

What goes on the schedule

Each check runs against a dated schedule of advisories that is replaced as new ones qualify. The edition that applies to your check is recorded on the order form.

An advisory qualifies only if it is:

  • Detectable from outside, without credentials or authenticated access.
  • Confirmed by the vendor or a national CERT, not by secondary reporting.
  • Affects products that are common in the market we test.

Provider breaches, supply-chain incidents and endpoint software are not included, because an external check cannot see them.

What you get

  • One-page summary for the board or owner in plain language.
  • Asset list of what was discovered.
  • Advisory results table per asset.
  • Prioritised fix list.
  • Second-practitioner quality review.
  • One 30-minute results call.

Follow-on credit

Book an Enhanced test within 60 days of your Exposure Check report and it is quoted with one tester day less effort, because the discovery work is reused.

Not included

  • Internal systems.
  • Authenticated or web application testing.
  • Exploitation.
  • Incident response or forensics.
  • Remediation.
  • Any statement that you are secure or not compromised.

What we need from you

  • Written authorisation from the asset owner listing every in-scope domain and IP address, plus permission from any hosting provider where it is required.
  • Answers to the four sizing questions, and the name of whoever hosts and manages each website.
  • A named contact who can be reached on the testing day.
  • Notice to any party that monitors the in-scope assets, using the Tarian Labs source addresses supplied in the rules of engagement.

Good to know

Remote. One tester day for discovery and checks, then reporting and quality review. The report is issued within five business days of accepted authorisation, followed by a results call of up to 30 minutes.

Checks are non-intrusive. No exploit is run against your systems. Critical exposures and signs of compromise are raised with your named contact the same day.

AI-assisted analysis is used only on sanitised discovery output, never with credentials or direct access to your systems. Every suggestion is treated as an untrusted hypothesis and confirmed by a qualified tester before it reaches the report.

Exploitability, not a scanner dump

  • Every finding is reproduced by hand before it reaches the report. Anything a tester cannot reproduce is discarded rather than passed on with a caveat.
  • Findings are rated by what an attacker could actually do with them in your environment, not by the raw score a tool assigned.
  • Where a route exists from a starting foothold to something that matters, we show the route rather than listing the steps as separate findings.
  • Every report is independently quality reviewed by a second senior practitioner before it is issued.

Who tests

Testing is led by a UK Cyber Security Council Principal practitioner (Security Testing) holding CREST CRT, OSCP, OSEP and CyberScheme Team Leader. Every report is independently quality reviewed by a second senior practitioner before issue. Our founders bring over ten years each in UK defence and critical national infrastructure. Tarian Labs is Cyber Essentials certified and based in South Wales.

Fixed scope, fixed fee, agreed before work starts.

A short call with a practitioner is enough to size this accurately.

Book a Scoping Call