What does an attacker see when they look at your company from outside?
We show what of your company is visible from the internet and where to dig deeper.
Three questions the review answers
One goal: find out whether you have anything to close before any active testing.
What of ours is visible from the internet?
Domains, services, panels, forgotten subdomains. The list often includes things nobody inside remembers any more.
Where is it worth looking deeper?
Not "everything is bad", but the specific places that look like the most likely point of entry.
What should we check next?
We show where a deeper technical test is needed, and where it is better to start with email, access or people.
What exactly we look at
We look at you from the same place an attacker does: from outside.
- Public domains and subdomains, including forgotten ones
- Services reachable from the internet
- Interfaces and panels that were never meant to be public
- Technologies visible from outside and their versions
- Signals of problematic configuration
- The overall external attack surface — how it looks from the side
Passive first
We test nothing without your permission
At the first stage we use only publicly available and passive sources — what anyone can see from the internet without touching your systems.
If the review requires active requests to your infrastructure, we first agree the boundaries and obtain written authorisation. Until that point there is no active testing.
What an external review shows, and what it does not
The review shows what the internet reveals about your company and where to look deeper. It does not prove there are no vulnerabilities.
What the review gives you
- Shows the external surface: what is reachable from the internet
- Highlights the places worth testing more deeply
- Helps you understand whether a pentest is needed and at what scope
- Takes little time and requires almost nothing from your team
What the review does not give you
- It does not confirm that the company is secure
- It does not test business logic or access rights inside the product
- It does not replace a manual pentest
- It does not give a full list of vulnerabilities
When to start here
It has been a long time since anyone checked
Or nobody has ever checked — and there is no idea where to start.
There is no dedicated security team
Security is handled by whoever has time. Which means nobody.
A new website, API or product
You launched quickly and put security off until later.
Fast growth
There are now more services, domains and integrations than anyone is tracking.
Entering a new market
Or moving into enterprise accounts, who start asking questions about security.
It is unclear what to order
Pentest, audit, assessment — you first need to understand what is actually needed.
How it runs
Four steps from the first message to the results review.
Request
You leave a domain and briefly describe the situation: what you have and what worries you.
A short call
30 minutes. We work out what your product is and what actually makes sense to look at.
Boundaries and authorisation
We record what is included in the review. If active requests are needed, we put written authorisation in place.
Review and walkthrough
We run the review and go through the results together: what is visible from outside, what is worth closing, whether a deeper test is needed.
A limited number of companies each month
We run the initial external review at no separate charge for a limited number of companies each month — after a short call and agreed boundaries.
This is not a "free pentest" and not a substitute for one. It is a first step that helps both sides understand whether it makes sense to work together.
The founder leads every project and answers for the result
I lead the external review and answer for its conclusions. You talk to someone who knows your situation, not someone reading another person's report.
I lead a cybersecurity team. Since 2019 I have run 170+ penetration tests for 80+ companies. I have worked on the security of many Ukrainian banks and payment systems, as well as government bodies and law enforcement. The founder runs the project, and nothing is handed to outside contractors.
I test systems the same way a real attacker does — from the outside, with no hints, with no access from within.
Frequently asked questions
Other Veiltrack security services
When to go deeper
The external review shows the surface. Need technical testing? There are two paths from here.
Vulnerability Assessment
Active scanning of the agreed external perimeter for known vulnerabilities and unsafe configurations, with manual analysis of the results.
Pentest
Manual testing of the application and the API: authentication, access rights, business logic and linked attack scenarios.
Book a 30-minute review call
Leave a domain — on a short call we will go through the situation and agree what exactly we look at.