A clear answer.
A useful next step.

The public-baseline mode in the protected workspace needs no scanner API key or scanner subscription. Existing authorised access is required. Sign in, confirm that you have permission and verify control of the hostname with a DNS TXT record or HTTPS file. You can explore the sample report and the guided security review without connecting a scanner.

It produces 13 baseline check entries covering public DNS, HTTPS connectivity, redirects, selected web security headers and email configuration. The DKIM lookup needs a selector. It does not test exploits, ports, malware, internal systems or pages behind a login, and it is not a complete TLS or email-delivery assessment.

In the protected workspace, authorised users can connect their own HostedScan or Pentest-Tools.com account. CyberScan can launch HostedScan SSLYZE or Pentest-Tools.com Website Scanner light mode against an existing target. You can also import recent provider scans. Your provider's API access, quotas, permissions and charges still apply.

The review uses your answers to create a practical plan for accounts, updates, backups, email and response arrangements. It makes no requests to your systems and cannot verify your answers. It is a useful way to organise work, not a security score, audit or compliance certificate. Answers stay on the open page unless you download or print your plan.

This release runs assessments on demand. It does not provide continuous monitoring, automated scans or a managed incident-response service. News and guides are a curated collection with source links and publication dates, not a real-time threat feed.

A request may be blocked, a DNS lookup may fail or the evidence may be outside the scan's scope. CyberScan keeps these gaps visible. Not verified means more evidence is needed; it does not mean either safe or vulnerable. Read the finding's evidence and next step before deciding what to change.

No. Workflow status records your work; it does not change the original assessment evidence. Run a fresh check and review comparable observations. A missing finding, changed scope or unavailable check does not establish that an issue was fixed. Ask the responsible provider for evidence where a public check cannot establish the answer.

The key is held in the current workspace page's memory and sent over HTTPS to the protected workspace's server for the requested operation, then to the selected provider's fixed API endpoint. The application does not persist it in its database, reports or browser storage. Disconnect or leave the workspace to clear the current connection.

Saved article choices stay in this browser on this device. Implementation checklists remember progress only if you choose that option. These records are separate from your signed-in reports and do not sync across devices. Clear the reading list or turn off remembered progress to remove those local records.