Free cyber health check
See your institution the way attackers see it. Free.
A 2–3 week cyber health check for financial institutions. You get a one-page scorecard, presented in person to your leadership team.
No software to install. Results shared only with you.
What's included
Six checks. One clear scorecard.
Email spoofing check
We check your SPF, DKIM and DMARC email settings.
What you learn
Whether someone can send email that looks like it came from your domain.Fake app and lookalike domain check
We look for fake loan apps, lookalike websites and fake "customer care" numbers using your name.
What you learn
Who is pretending to be you, and where your customers might be fooled.External exposure check
We look for forgotten websites, open admin pages, expired certificates and exposed APIs.
What you learn
What an attacker can see about you from the internet today.Leaked staff credentials check
With your written consent, we look for work email addresses in known data breaches.
What you learn
How many staff accounts may already be in attackers' hands.Phishing simulation
A safe test email, agreed with you in advance, sent to a group of staff.
What you learn
How your teams respond to a realistic phishing email. Results by team, never by person.One awareness session
A 60-minute session for your staff on AI-driven attacks.
What you learn
About the training
What your staff should check before they click, type a password or approve a payment.
How it works
From request to scorecard in four steps.
- 1
Request
Tell us your institution and website domain.
- 2
Agree scope
A short call, and a one-page written permission from a senior officer.
- 3
We check
2–3 weeks. Nothing to install for the outside-in checks.
- 4
Scorecard
A one-page red, amber and green scorecard presented to your MD or CEO, with a clear list of fixes.
What you get
A one-page scorecard your MD can read in two minutes.
Red, amber and green for each area, one line on what we found, and a clear list of fixes.
Sample – fictional institution
Cyber health check scorecard
Northgate Finance
58/100
Needs attention
| Area | Status | Finding |
|---|---|---|
| Email spoofing | Red | No DMARC policy. Anyone can send email that looks like it came from your domain. |
| Lookalike domains and apps | Amber | 3 lookalike websites and 1 fake loan app found using your name. |
| External exposure | Amber | An old test website is public and its certificate has expired. |
| Leaked staff credentials | Red | 14 work email addresses found in known data breaches. |
| Phishing simulation | Amber | 2 of 5 teams entered details on the test page. |
| Website security settings | Green | Secure connection set up correctly on the main website. |
Your information
How we handle your information.
- The outside-in checks use only public information. We never try to log in to or break into your systems.
- Anything beyond public checks happens only with your written permission.
- Findings go only to the people you name. We never publish them or share them with anyone else.
- We delete your health-check data within 90 days unless you ask us to keep it.
Questions
Common questions.
Is it really free?
Yes. There is one health check per institution, and you are under no obligation to buy anything.
Do we need to install anything?
No, not for the outside-in checks. The phishing simulation uses a test email we agree with you in advance.
Who should request it?
The CISO, IT head, CTO, CRO or MD.
What happens after?
If you want, we propose a paid pilot to fix the gaps we found. If not, you keep the scorecard.
Is this a VAPT or an audit?
No. It is a quick outside-in check, not a certified audit or a penetration test.
Request
Request your free health check.
Tell us about your institution. We will set up a short call to agree the scope.
- —Takes about 2 minutes.
- —We reply within 2 working days.
- —Your details are used only for this request.
Prefer to talk first?