One target. Four depths.
Every level deploys several analysis engines in parallel against your target. Start free, then go as deep as you need — each tier includes the ones below it.
Free
The external surface any attacker can already see.
- Email spoofing (SPF/DMARC/DKIM)
- TLS & security headers
- DNS hygiene & leaked secrets
- A–F risk grade
Level 1
Deep active scan of the exposed perimeter.
- Everything in Free
- Active perimeter probing
- Attack-surface mapping (CT logs)
- Shodan exposure + known CVEs
Level 2 · Intrusion
Authenticated intrusion testing + detailed report.
- Everything in Level 1
- Authenticated intrusion (GET-only)
- IDOR / access-control / sessions
- Detailed remediation report
Level 3 · AI audit
Everything, plus a full AI/LLM security audit.
- Everything in Level 2
- AI/LLM audit — 19 attack classes
- Prompt injection, jailbreak, leakage
- Full report + AI executive summary
Authorize. Scan. Verify. Report.
Authorize
Verify domain ownership, sign an electronic mandate. Active tiers stay locked until then.
Scan
Eleven engines run concurrently, each sandboxed behind an SSRF and timeout guard.
Verify
An adversarial AI judge refutes every finding — false positives are dropped, not shipped.
Report
A scored A–F report with an AI executive summary and a print-ready PDF.
Eleven scan engines. Nineteen AI attack classes.
Every check maps to a real attacker technique — and every finding is cited with evidence and a fix.
Email spoofing
SPF, DMARC, DKIM forgeability
TLS & certificates
Weak protocols, expiry
HTTP hardening & CORS
HSTS, CSP, frame, referrer — every header an attacker probes
DNS hygiene
CAA, DNSSEC, MTA-STS
Attack surface
Forgotten hosts via CT logs
Shodan exposure
Open ports + known CVEs
Leaked secrets
Public GitHub search
LLM attack classes
Prompt-injection, jailbreak, multi-turn, encoding, output-handling + your business rules
An AI judge kills the false positives.
Generic scanners drown you in noise. SecurScan runs every ambiguous finding past an adversarial AI reviewer told to refute it — so what reaches your report is real, ranked, and worth your developer's time.
Know your exposure in 60 seconds.
Free passive scan on any domain. No signup, no card.
Scan my company →