Start here · FeaturedHalo Scan
$99 flat, one-time
A full passive perimeter sweep of your external footprint, run with your permission: DNS and mail authentication, TLS, security headers and certificate transparency. Every finding is dual-verified and delivered in a branded PDF report with a prioritized fix list.
Timeline: automated passive checks start after payment; the PDF report is usually emailed within minutes, and always within 3 business days.
Not included: active testing or exploitation, application or AI agent review, retest, compliance certification. Checks are passive and limited to the one domain you authorize, and every finding is re-verified by a second check before it goes in the report.
What's included in the Halo Scan
TLS certificate
- Certificate presented on port 443
- Issuer and subject
- Expiry date, flagged if under 21 days
HTTP security headers
- Strict-Transport-Security (HSTS)
- Content-Security-Policy
- Clickjacking protection (X-Frame-Options or CSP frame-ancestors)
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Software version disclosure (Server, X-Powered-By, X-AspNet-Version, X-Generator)
Cookies
- Secure and HttpOnly flags on cookies set by your homepage
DNS and email authentication
- A, AAAA, MX and NS records
- SPF presence and overly permissive +all
- DMARC presence and monitor-only p=none
- DKIM on 12 common selectors
- CAA records
Discovery and disclosure
- Subdomains in public certificate-transparency logs
- security.txt with a contact
- robots.txt disallowed paths
- sitemap.xml
Verification and report
- Every finding re-checked by a second, independent pass; anything that does not reproduce is dropped
- Branded PDF report with severity, evidence and a fix for each finding
- Emailed to you, usually within minutes of payment
All checks are passive: public DNS lookups, one TLS handshake and ordinary page requests to the one domain you authorize. No active testing, exploitation or login attempts.
Value breakdown
Estimated value if done separately by a consultant (~$150/hr)
| SSL/TLS certificate review | $150 |
| Security headers audit | $150 |
| Cookie settings review | $75 |
| DNS & email security (SPF/DKIM/DMARC) | $200 |
| Subdomain discovery | $200 |
| Second-pass verification of every finding | $250 |
| Branded PDF report with fixes | $300 |
| Total estimated value | $1,325 |
| Your price | $99 |
Estimates based on typical consultant time; not a quote from any third party.
FlagshipCustom quote after your Halo Scan
Timeline: About 3 to 5 weeks from signed scope to final report, then advisory for 90 days
The full engagement, from first look to verified fix and beyond.
Our most complete engagement. We take the whole path together: passive recon, a comprehensive Scoped Assessment of your applications and AI agent systems, remediation guidance, retest, and continuing advisory as your stack changes.
What is included
- Passive public recon: DNS and mail authentication, TLS, security headers, certificate transparency
- Comprehensive Scoped Assessment across agreed systems, including AI agent tool permissions, secrets exposure, prompt injection paths and sandbox boundaries
- Scenario design with private local models, reviewed by a person
- Ranked remediation guidance with owners and verification steps
- Retest of every fixed finding, and a written record you can hand to your own auditors
- Ongoing advisory: scope reviews when your architecture or agents change
Deliverables
- Passive recon summary
- Scoped Assessment report with ranked findings and evidence
- Remediation plan with owners and verification steps
- Retest report confirming each fix
- 90 days of advisory and scope reviews
Who it is for
Teams that run AI agents or customer-facing platforms in production and want one accountable partner from discovery through verified fixes.
Not included
- Active exploitation or any testing without written client authorization
- Compliance certification or an audit opinion (we give you evidence for your auditor, not a certificate)
- Writing or deploying fixes in your systems for you
- Anything outside the written scope
- A managed security operations center or round-the-clock response
Custom quote after your Halo Scan
Timeline: One cycle each quarter, written summary within 5 business days of each check
A recurring watch on what the outside world can see, with periodic retests.
A continuing service for teams that have already been assessed and want to keep their exposure honest. We re-run passive recon on a schedule, review what changed, retest earlier findings periodically, and report by written report and email.
What is included
- Scheduled passive-recon re-checks of your public footprint
- Change review: what appeared, disappeared or drifted since the last report
- Periodic retests of previously reported findings
- Email alerts for notable changes we spot in a scheduled check, and a written summary each cycle
- Short advisory calls to interpret changes and prioritize fixes
Deliverables
- Quarterly passive-recon change report
- Retest notes on earlier findings
- Email alerts for notable changes found in a scheduled check
Who it is for
Teams with a stable footprint that changes over time (new hosts, new vendors, new agents) and want regular, human-reviewed check-ins.
Not included
- Compliance certification
- 24/7 monitoring, a security operations center, or real-time blocking
- Software agents or sensors installed in your environment
- Any active testing outside a signed scope
Custom quote after your Halo Scan
Timeline: About 2 to 3 weeks, with one retest round within 60 days
One deep assessment, then the hardening work to close what it finds.
A single, deep Scoped Assessment of one defined target, such as one application, one API or one AI agent system, followed by remediation guidance and a retest so the fixes are verified.
What is included
- Passive recon of the target's public surface
- One Scoped Assessment inside a written scope and window
- Findings with proposed severities and plain-language explanations
- Remediation guidance and one retest round
- A final written report
Deliverables
- Scoped Assessment report for one target
- Remediation guidance per finding
- Retest report
- Final written report
Who it is for
Teams preparing for a launch, a customer security review or fundraising diligence that need one system looked at properly.
Not included
- Active exploitation beyond the written scope and window
- Compliance certification or an audit opinion
- Recurring re-checks after the retest
- Coverage of systems beyond the single agreed target
Custom quote after your Halo Scan
Timeline: Report within 5 business days of kickoff
A light first look at your public exposure. The easy on-ramp.
A lightweight passive-recon report on your public footprint, delivered by us. It is observational only: what can be seen from outside, what looks off, and what to fix first. No active testing.
What is included
- Passive recon only: DNS and mail authentication, TLS, security headers, certificate transparency
- A short written report with a prioritized list of what to look at first
- One follow-up conversation to walk through it
Deliverables
- Passive recon report on your public footprint
- Prioritized top fixes list
- One 30-minute walkthrough call
Who it is for
Small teams and founders who want a sober, inexpensive first read on their public exposure before deciding what to do next.
Not included
- Compliance certification or an audit opinion
- Any Scoped Assessment or active testing
- Retest of fixes (available by moving to Thrones)
- A self-serve scanner. Self-serve is not available today.