What would you like to understand?

Open the protected workspace to verify a domain and check DNS, HTTPS, web headers and email settings. Existing authorised access required.

Use HostedScan or Pentest-Tools.com in the protected workspace with your own API key and existing targets. Authorised access required.

Turn your answers about accounts, updates, backups and response into a practical plan.

Use the route chooser and compare the exact coverage and requirements of each assessment.

Explore illustrative findings, evidence, priorities and report exports.

Browse all briefings, guides and implementation checklists, or follow a learning path.

Understand access, credentials, saved reports and what happens to your data.

Learn how CyberScan connects useful evidence to practical action.

Read the conditions for authorised use and the current beta's assessment limits.

Review the accessibility target, source review date and outstanding browser, assistive-technology and print checks.

Understand website security headers, HTTPS and public check limits. Plan a change, assign an owner and record evidence with a website control template.

Check the meaning of SPF, DKIM and DMARC observations. Find the correct DKIM selector, map legitimate senders and plan a controlled email policy change.

Turn a scanner finding into an owned remediation task. Check asset attribution, vendor evidence, business impact and the result of a suitable retest.

Review the accounts, backups and dependencies behind your business. Build a practical security action plan and keep evidence of recovery exercises.

The NCSC’s 21 October alert makes a timely case for checking the software behind your website, including components managed by your host.

Apply the NCSC’s October guidance by connecting technical findings to the services your business needs to keep running.

A September update to UK business guidance added passkey advice. Your registrar, hosting and email accounts are a good place to apply it.

Understand what each mode can observe, which permission it needs and what a reassuring result still leaves unanswered.

Map your real senders, understand alignment and strengthen your policy without losing legitimate messages.

Separate a successful HTTPS request from certificate analysis, origin protection and a complete TLS configuration review.

Give each finding an owner across your business, developer and host, then verify the change with useful evidence.

Learn when an old-looking version needs investigation and which evidence can confirm whether a security fix is present.

Build a policy around your actual application, inspect reports and test essential journeys before enforcement.

A controlled rollout for teams that need stronger anti-spoofing protection while preserving legitimate business email.

Turn a technical finding into a clear request your host, developer or insurer can review without guessing what the scan proved.

Retest the same condition, distinguish missing visibility from remediation, and document what actually changed.

The public-baseline mode in the protected workspace needs no scanner API key or scanner subscription. Existing authorised access is required. Sign in, confirm that you have permission and verify control of the hostname with a DNS TXT record or HTTPS file. You can explore the sample report and the guided security review without connecting a scanner.

It produces 13 baseline check entries covering public DNS, HTTPS connectivity, redirects, selected web security headers and email configuration. The DKIM lookup needs a selector. It does not test exploits, ports, malware, internal systems or pages behind a login, and it is not a complete TLS or email-delivery assessment.

In the protected workspace, authorised users can connect their own HostedScan or Pentest-Tools.com account. CyberScan can launch HostedScan SSLYZE or Pentest-Tools.com Website Scanner light mode against an existing target. You can also import recent provider scans. Your provider's API access, quotas, permissions and charges still apply.

The review uses your answers to create a practical plan for accounts, updates, backups, email and response arrangements. It makes no requests to your systems and cannot verify your answers. It is a useful way to organise work, not a security score, audit or compliance certificate. Answers stay on the open page unless you download or print your plan.

A request may be blocked, a DNS lookup may fail or the evidence may be outside the scan's scope. CyberScan keeps these gaps visible. Not verified means more evidence is needed; it does not mean either safe or vulnerable. Read the finding's evidence and next step before deciding what to change.

No. Workflow status records your work; it does not change the original assessment evidence. Run a fresh check and review comparable observations. A missing finding, changed scope or unavailable check does not establish that an issue was fixed. Ask the responsible provider for evidence where a public check cannot establish the answer.

The key is held in the current workspace page's memory and sent over HTTPS to the protected workspace's server for the requested operation, then to the selected provider's fixed API endpoint. The application does not persist it in its database, reports or browser storage. Disconnect or leave the workspace to clear the current connection.

Saved article choices stay in this browser on this device. Implementation checklists remember progress only if you choose that option. These records are separate from your signed-in reports and do not sync across devices. Clear the reading list or turn off remembered progress to remove those local records.

This release runs assessments on demand. It does not provide continuous monitoring, automated scans or a managed incident-response service. News and guides are a curated collection with source links and publication dates, not a real-time threat feed.