SeguriScan
See how SeguriScan works, screen by screen
SeguriScan, IntruForce's platform, checks the websites and systems your company exposes to the internet and looks for company data and work passwords exposed in leaks. It shows your team what to fix first. Below, one sample company, from its domain to its report for leadership.
SeguriScan covers systems reachable from the internet. It does not assess your internal network.
External review only · Nothing to install · No active testing without your approval
In short
What sets SeguriScan apart.
Vulnerabilities matched to your own systems.
Known vulnerabilities are matched to the software versions on your systems, so you see what may affect you, not a general feed of alerts to read one by one. Step 4: Outdated software →
Fewer false alarms, no duplicates.
Results of many checks become one list, typical false alarms are dropped automatically, and each issue shows how sure we are that it applies. How SeguriScan decides what matters →
Nothing to install, no hardware to buy.
SeguriScan is a cloud service that checks your company from the internet, the way an outsider sees it; no software goes on your servers. Step 1: Your domain →
Finds systems you didn't know you had.
From your domain, SeguriScan finds servers and websites nobody listed, such as ones set up by someone who has since left, and you confirm them before they are scanned. Step 2: Systems you didn't know →
Built by people who test defenses for a living.
IntruForce penetration testers, who try to break in to test defenses, built SeguriScan to automate their own work, and an IntruForce analyst answers your questions right on the issue. Step 7: Ask an analyst →
1 / 9 · Your systems
It starts with your domain.
You send us your domain or address ranges and sign a written authorization; then we load them into SeguriScan. SeguriScan rejects local or internal addresses: the internet can't reach them.
- Added only with your written authorization
- Rejected: internal address
2 / 9 · Systems · Changes
Find systems you didn't know about.
From the company's list, SeguriScan found the servers and websites behind it, including some nobody listed; the company confirms them before they are scanned. Most get a risk score from 0 to 10, and changes since the last check are marked.
- Not on your list
- New since last check
Perimeter changes
Appeared 198.51.100.14
Opened 192.0.2.25 :3306/tcp
Closed 192.0.2.21 :8080/tcp
Perimeter changes
Assets
Appeared 1
198.51.100.14
Disappeared 1
192.0.2.30
Ports
Opened 1
192.0.2.25 :3306/tcp mysql
Closed 1
192.0.2.21 :8080/tcp http
Domains
Appeared 1
pay.example.com
Disappeared 1
old-shop.example.com
3 / 9 · Dashboard
See where the biggest risk sits: here, Web.
SeguriScan scores everything it found in six areas, from network to mail; here, Web scores highest. The center is one overall number, lower is better, and it is not a guarantee.
- Overall score (lower is better)
- Web: highest, and going down
Threat level by category
compared with 16 Oct 2026Lower is better
Current cycle since 22 Octas of 23 Oct 2026
for the current state as of 23 Oct 2026
Websites and web applications: login forms, exposed files, insecure handling of data.
Findings counted13
Critical2
High7
Medium3
Assets in the denominator6
Findings per asset2.2
4 / 9 · Outdated software
Find outdated software before attackers do.
Part of the Network and Web scores is old software: SeguriScan matches the versions the company's systems show to the internet against publicly known vulnerabilities, most severe first. In this sample, the website reports PHP 8.3.24, a version PHP2Shell affects: flaws that let an attacker run code without logging in. Other entries carry a KEV tag: CISA lists them as used in real attacks.
- Published
- Which system to update
5 / 9 · Similar domains · Data leaks
Spot look-alike domains and leaked passwords.
Some of the risk sits outside the company's servers: SeguriScan lists registered domains that imitate it and whether they can receive email. Work accounts found in leaks sit in a separate view for people given access, masked, so the team knows whose passwords to change.
- Can receive email (MX)
Similar domains 11
| Similar domain | Type | Status | Risk | MX records |
|---|---|---|---|---|
| example.netdomain zone (TLD) substitution | domain zone (TLD) substitution | Active | High | mail.example.net |
| examp1e.examplehomoglyph (visually similar characters) | homoglyph (visually similar characters) | Active | High | mx1.examp1e.example |
| example-login.exampledictionary word addition | dictionary word addition | Active | High | mx.example-login.example |
| exarnple.examplehomoglyph (visually similar characters) | homoglyph (visually similar characters) | Active | High | — |
| pay-example.examplehyphen insertion | hyphen insertion | Active | Medium | mail.pay-example.example |
Only registered lookalike domains appear in the list. “MX records” are the domain’s mail servers (phishing risk).
6 / 9 · Issues
Know what to fix first, and how.
Across all areas, Needs attention puts one issue first: a P1 on the company website, whose PHP 8.3.24 is a version PHP2Shell affects. SeguriScan flags it from the version alone; no active check has tried it yet. Next come things left open by mistake: a database reachable from the internet, a settings file with passwords, a copy of the database. Each issue shows where it was found, what it means and steps your IT team can follow. How SeguriScan sets priority →
- Severity: CVSS 9.8
- How to fix
Needs attention 4 of 40
Infrastructure scannerCVE-2026-109618
Remote code execution in PHP 8.3.24 (CVE-2026-109618, PHP2Shell)
https://www.example.com
www.example.com
Description
The website reports PHP 8.3.24 in its X-Powered-By header. PHP 8.3 releases before 8.3.36 have two flaws, published on 21 October 2026, that let an attacker run code on the server without logging in.
How to fix
Update PHP to 8.3.36 or later. Until then, set session.upload_progress.enabled = 0 in php.ini and restart PHP. This blocks the default path of one flaw; only the update fixes both.
7 / 9 · My requests
Ask an analyst while you fix it.
Your IT team asks about that PHP issue right on it, inside SeguriScan. An IntruForce analyst replies in the same thread.
- An IntruForce analyst replies
Infrastructure scannerCVE-2026-109618
Remote code execution in PHP 8.3.24 (CVE-2026-109618, PHP2Shell)
https://www.example.com
My requests · 1
Question or comment In progress
We can’t move the site to PHP 8.3.36 before our next release. Is turning off upload progress in php.ini enough for now?
Only as a stopgap: it blocks the default path of one of the two flaws, not both. Make the change now and schedule the update right after the release. The next check will show the new version.
8 / 9 · Issues · Resolved
See the fix confirmed by the next check.
Earlier, the team closed an admin console on api.example.com:8080. A re-check no longer reached it and moved the issue to Resolved on its own.
- Resolved by the next check
Infrastructure scannerSW-EXT-EXPOSURE-17
API server admin console open to the internet (port 8080)Resolved
http://api.example.com:8080
Question or comment
We closed port 8080 on api.example.com. The console now answers only on our internal network.
Not reproduced: api.example.com:8080 no longer answers from the internet. Status: Resolved.
9 / 9 · Summary
Show leadership the progress on one page.
Fixes like these add up: the summary shows the score, open issues by priority and how fast the team fixes them, ready to print. Your IT team also gets a detailed technical report in Word or Excel for each check.
- Average days to fix (MTTR)
- Print / PDF
DEMO · Fintech — external perimeter
Executive summary · External perimeter assessment (EASM)
Observation period: from 7 Aug 2026 — 23 Oct 2026
Generated23 Oct 2026
EASM perimeter score
Medium▼ -0.3 · risk decreased
One number for how exposed the company is online, not a guarantee.
By response priority
P1 4P2 15P3 21P4 0
Remediation
Average days from detection to fix.
Share of issues the team has fixed.
Overdue: open issues past their fix-by date.
Due soon: issues whose fix-by date is close.
Open findings — trend
7 Aug 202640 open23 Oct 2026
Top risks up to 10 priority open findings
| Prio. | Finding | Asset | Sev. |
|---|---|---|---|
| P1 | www.example.com | C | |
| P1 | vpn.example.com | C | |
| P1 | lk.example.com | C | |
| P1 | 192.0.2.25 | C | |
| P2 | example.com | C |
How priority works
How SeguriScan decides what matters.
Any scanner can produce a long list. SeguriScan narrows what it finds to what needs action and shows what to fix first.
Why it works this way: IntruForce penetration testers built SeguriScan to automate their own work. The stages below follow how they separate real issues from noise.
Sample data
- How severe
- Critical · CVSS 9.8: how much damage it could do. CVSS is the standard severity score, 0 to 10.
- How likely
- Exploitation likely: attackers are expected to use this kind of flaw.
- How sure
- Confirmed: an active check reproduced the issue.
- So
- P1: handle it first. P1 comes before P2 and P3.
- 01
Many checks, one list.
SeguriScan runs several kinds of external checks and combines their results. Duplicates are merged, so each issue appears once.
Typical false alarms are dropped too: some websites answer “page found” even for addresses that don't exist (a soft 404), and SeguriScan detects this and discards those results.
- 02
Only what applies to you.
Known vulnerabilities are matched to the software versions on your own systems, not sent as a general feed. Linux systems often keep an old version number after a security fix (a backport); SeguriScan accounts for it, so a patched server is not reported as vulnerable.
- 03
Priority from three questions.
- How severe is it?
- How likely is an attack: is it already exploited, can it be reached from the internet?
- How sure are we that it applies to this system?
The answers set the priority, P1 first; the standard severity score is one input, not the answer.
- 04
Checked, not guessed.
A version match only means the software may be affected, so it is marked as a candidate, with a confidence level: T1 means we are most sure it applies, not that the risk is highest. An active check that reproduces the problem confirms it; IntruForce analysts also review some candidates.
Priority looks at the issue and how it can be reached, not at how important the system is to your business. Your team adds that judgement.
Then the loop closes, as in step 8: your team fixes the issue, the next check looks again and moves it to Resolved; if the problem returns later, the issue reopens. Each issue says in plain words what to fix and how, so your IT team can act without a security specialist.
← Back to the tourQuestions, answered
FAQ
We already have a scanner. Does SeguriScan replace it?
No, it can work alongside it. SeguriScan covers the outside view: what can be reached from the internet, what changed, which new vulnerabilities concern your software, leaked passwords, fake websites imitating your brand, and what to handle first.
Couldn't we run free scanning tools ourselves?
You can. The work starts after the scan: finding systems you forgot, merging duplicates, filtering out what does not apply, ranking the rest and re-checking after each fix. SeguriScan does that part.
How do you tell a theoretical vulnerability from a real one?
Candidates and confirmed issues are marked differently, so your team sees which is which before anything goes to management. More in How SeguriScan decides what matters →
Is it safe to send you our domains and address ranges?
Anything reachable from the internet can already be found by anyone. We look first, so you hear about it early. We load nothing into SeguriScan until you sign a written authorization.
Need a deeper test of one system?
IntruForce also runs expert security assessments, such as a penetration test of a single system. See Expert Services →
Partner program for MSSPs and integrators →
What needs attention now, and how serious each risk area is.
SeguriScan dashboard: assets, open services, findings by severity, data leaks and the threat level for each category
An issue: priority P1, critical severity, a deadline, a technical description and a fix recommendation
A server card: risk score, open ports, linked domains and the first thing to fix
The reports list: one report per check, downloadable as Word or Excel
A known flaw in a VPN server, flagged as used by attackers, with the deadline to fix it
Data leaks: leaked accounts of staff and customers, whether a password leaked too, and where it turned up
Get started
See what SeguriScan finds for your company.
Share your company website and a work email to request a free SeguriScan pilot. We'll contact you by email to agree on the scope and next steps. Tell us if you want to discuss a specific assessment instead.
- Nothing to install
- No access to your internal network
- No active testing without your approval