signalfort · from outside
Check a website for vulnerabilities from the outside
Not a two-hundred-line CVSS dump — an answer for your perimeter: what faces the internet, which flaws are already used in attacks, and whether that hits you.
- ✓No agent, no server access
- ✓Match CVE, FSTEC BDU and KEV
- ✓“Confirmed” only after a check
- ✓Free to start on Radar
signalfort in numbers
Nothing to install. Enter a domain — and the check starts.
The problem
A typical scanner returns version matches and leaves you with a “critical” queue and no context. You need what is really exposed and what to fix first.
- —Long CVSS 9.8 lists without priority
- —Unclear whether a flaw hits your hosts
- —No SSL, domain and subdomain monitoring alongside
- —False positives burn a week of triage
What the check gives you
One loop: discovery, matching, confirmation, fix deadline and re-check.
Sites and services from outside
Root domain, subdomains, open services — including forgotten stands.
Stack matching
CVE, FSTEC BDU, GHSA/OSV, EUVD, CIRCL. Priority: known attacks (KEV), EPSS and public exploits.
Confirmation
“Confirmed” only after a safe external check — not a version banner alone.
Deadline and re-check
On Contour — owner, deadline and overdue email. After a fix — a re-check. On Business — time to answer and to fix, webhooks into your tools, AI assistants over MCP and deeper API checks with consent.
Up in three steps
Nothing installed on servers. We look from outside — like any visitor or attacker.
- 01
Enter the domain
Company root address. We find subdomains and services.
- 02
Verify ownership
One DNS TXT record — so we know the domain is yours.
- 03
Triage findings
Top: flaws with known attacks online and confirmed risk. Then monitoring continues.
First results in about 10 minutes after DNS
Scanner vs signalfort
Both look from outside. The difference is the outcome you get.
- Long CVSS lists
- Little perimeter context
- One-off report goes stale
- No deadline or re-check
- 1.KEV + EPSS priorityknown attacks first
- 2.Affects us / doesn’ton your hosts
- 3.Monitoring by planweekly or daily
- 4.Deadline → retest → reporton Contour and up
Not a suspicion — a decision
A version match is a signal. Confirmation only after a safe check.
Version and port matched a known issue
Service answered from outside without a password
- ·port open from outside
- ·unauthenticated response
- ·version from banner
Who it is for
Self-service for people who own company sites — no bug bounty, no agents.
Site / IT owner
Need to see what’s exposed without drowning in scanner noise.
Mid-market security
KEV and EPSS next to FSTEC BDU, one contour.
Leadership
A short “affects us / doesn’t” instead of a week-long table.
Plans for the job
Perimeter hygiene is in every plan; frequency and depth differ.
Radar
Free
Passive analysis and weekly hygiene. One domain.
Contour
from ₽1,490/mo
Daily checks, confirmation, fix deadlines and re-check.
Business
from ₽4,490/mo
5 domains, fix deadlines, webhooks and MCP for AI assistants, FSTEC/CRA reports, deep analysis with consent.
What people mean by “check my site”
A site owner or IT lead wants to know what faces the internet, which known flaws the stack already shows, whether HTTPS is expired, and whether forgotten subdomains appeared.
The ask is simple; a 200-line CVSS dump is not a plan. You need priority and a decision on your hosts.
This is not bug bounty intake. We only analyse your sites after domain verification.
What is visible from the perimeter
From outside you often see web server and app versions, open ports, HTTPS mistakes, public files and admin areas guests should not reach.
We also watch SSL and domain expiry and new subdomains.
How to read finding statuses
probable — version or signature matched. Investigate; not proof of compromise.
confirmed — after a safe external check, or when the fact is observed directly (e.g. expired cert).
More: does a CVE affect you, CVE and FSTEC BDU.
Prices and plan details are in the plans block above — or start a free check.
FAQ
Do you need server access or an agent?
No. We look from outside. No passwords, nothing to install. On Business, test accounts for deeper API checks are used only with explicit consent.
How is this different from a vulnerability scanner?
Scanners often return long version-match lists. We match several feeds, weigh known attacks (KEV) and EPSS, raise “confirmed” only after a safe check, and follow remediation through to a re-check.
What does it cost to start?
Radar is free. After domain verification — 14 days of Contour with no card. Then Contour from 1,490 ₽/month per domain; Business from 4,490 ₽/month for a 5-domain pack.
How fast are first results?
Usually about 10 minutes after DNS verification: discovery and first stack match.
Do you store data from our sites?
Findings keep a minimal fact (port, response type, version), not form contents or database dumps.
Check my site for free
No agent: what is exposed and what to do first