SeguriScan · Product tour
See your exposure. Know what to fix first.
SeguriScan, IntruForce’s platform, checks the websites and systems your company exposes to the internet and looks for leaked work passwords. Below are its main screens, in the order you meet them in the portal, on a sample company.
Free pilot · Starts with your domain
External review only · Nothing to install · No active testing without your approval
1 / 9 · Dashboard
Start with what needs attention.
Start with the overall picture, then open what needs attention first.
- Systems, services and open ports
- Findings that need attention first
- A threat level in six areas, from network to mail
The overall score runs from 0 to 10, and lower is better. It is one number, not a guarantee.
2 / 9 · Assets
Know what is out there.
SeguriScan starts from your domain and finds the servers and websites behind it, including some nobody listed; you confirm them before they are scanned.
- Domains and IP addresses
- Open ports and technologies
- The findings and possible vulnerabilities on each system
3 / 9 · Web applications
Put a face to each exposed website.
See the websites and web services found on your systems, each with a screenshot, its technologies, its certificate and its findings. The screenshot helps your team recognise the service behind an address.
- Recognise the websites you expose
- See technologies and certificate dates
- Connect each website to its findings
4 / 9 · Findings
Understand the issue. Know the next step.
Go from a list sorted by priority to one finding. It shows the affected system, how serious the issue is, what it means and how to fix it, with separate tabs for evidence, requests and history.
- Priority and severity
- What the issue means and could lead to
- How to fix it
Needs attention 4 of 40
Infrastructure scannerCVE-2026-109618
Remote code execution in PHP 8.3.24 (CVE-2026-109618, PHP2Shell)
https://www.example.com
www.example.com
Description
The website reports PHP 8.3.24 in its X-Powered-By header. PHP 8.3 releases before 8.3.36 have two flaws, published on 21 October 2026, that let an attacker run code on the server without logging in.
How to fix
Update PHP to 8.3.36 or later. Until then, set session.upload_progress.enabled = 0 in php.ini and restart PHP. This blocks the default path of one flaw; only the update fixes both.
5 / 9 · CVE candidates
See which known vulnerabilities may apply to you.
SeguriScan matches the software versions your systems show to publicly known vulnerabilities (CVE). Each match shows how serious it is (CVSS), how likely it is to be used by attackers soon (EPSS), and whether attackers already use it (the CISA KEV list).
- Vulnerabilities matched to your own systems
- How likely each one is to be used in attacks
- Candidates marked apart from confirmed findings
A version match is a reason to check, not proof the system is vulnerable.
6 / 9 · Data leaks
Look beyond your own servers.
Work accounts of your domain found in known leaks, including logs from password-stealing malware, with the source and whether a password was included. Passwords are masked, and only people given access see this view.
- Whose accounts appear in leaks
- Whether a password is included
- Where the record came from
7 / 9 · Similar domains
See which domains resemble yours.
Registered domains that look like yours, such as a changed letter or another ending, with how alike they are, their risk, whether they are still active and whether they can receive email.
- Names that resemble your brand
- How each one differs from yours
- Whether it can receive email
A similar name is a reason to look closer, not proof of misuse.
8 / 9 · Findings dynamics
Keep the next check in view.
Each check compares with the last one, check by check.
- New findings
- Findings resolved by a later check
- Findings that came back
Your IT team or provider makes the fix; SeguriScan shows what to fix and checks again.
9 / 9 · Reports
Give each reader the right report.
Management gets the key figures in one place: the summary for management, ready to print. Whoever runs your IT gets a full technical report for each check.
- Print the summary or save it as PDF
- Download technical reports in Word or Excel
- See which checks are complete and which are still running
DEMO · Fintech — external perimeter
Executive summary · External perimeter assessment (EASM)
Observation period: from 9 May 2026
Generated5 Nov 2026
EASM perimeter score
Critical▲ +4.5 · risk increased
One number for how exposed the company is online, not a guarantee.
By response priority
P1 10P2 24P3 13P4 35
Remediation
Average days from detection to fix.
Share of issues the team has fixed.
Overdue: open issues past their fix-by date.
Due soon: issues whose fix-by date is close.
Open findings — trend
17 Jan 202682 open5 Nov 2026
Top risks up to 10 priority open findings
| Prio. | Finding | Asset | Sev. |
|---|---|---|---|
| P1 | Leaks — Employees: Stealer logs from corporate hosts (with passwords) | mail.example.com | C |
| P1 | Key-value store is exposed to the internet without authentication | 192.0.2.25 | C |
| P1 | Insecure deserialization in the web portal | lk.example.com | C |
| P1 | Database server accepts an administrator login without a password | 192.0.2.25 | C |
| P1 | Cluster node service accepts anonymous requests | 192.0.2.26 | C |
Questions
Know what you are looking at.
Does SeguriScan check our internal network?
No. SeguriScan covers systems reachable from the internet. An internal security assessment is a separate service.
Is every CVE candidate a confirmed vulnerability?
No. A candidate means the software version may be affected. SeguriScan marks candidates and confirmed findings differently, so your team can check before treating one as confirmed.
Who fixes the issues?
Your IT team or service provider. Each finding comes with steps they can follow, and the next check shows whether the fix worked.
Can we discuss a finding with IntruForce?
Yes. Each finding has a Request tab, where you can ask a question, request a re-check or dispute a false positive; an IntruForce analyst replies there.
Do you test our systems without our permission?
No. We add your systems only after you sign a written authorization, and no active testing runs without your approval.
See these screens for your own company.
Share your company’s domain to request a free SeguriScan pilot. We agree the scope with you by email before anything is checked.
Free pilot · Starts with your domain · No obligation
What needs attention now, and how serious each risk area is.
SeguriScan dashboard: assets, open services, findings by severity, data leaks and the threat level for each category
An issue: priority P1, critical severity, a deadline, a technical description and a fix recommendation
A server card: risk score, open ports, linked domains and the first thing to fix
The reports list: one report per check, downloadable as Word or Excel
A known flaw in a VPN server, flagged as used by attackers, with the deadline to fix it
Data leaks: leaked accounts of staff and customers, whether a password leaked too, and where it turned up