Menu
Autonomous Exposure Intelligence

Leaked passwords, stolen sign-ins, spoofable email and look-alike domains, for you, your family or your business. The free scan reads public sources in about 30 seconds.

A Cloudflare human check runs in the background and only asks for a click when it has to.

Free · No sign-up · Public sources only

Live scan

Scanning

About 30 seconds. Every check reads public sources only, and each one appears here as it finishes.

Starting

    Reading DNS, mail authentication, look-alikes, certificates and breach signals…

    Free scan

    Your exposure snapshot

    Get the full report
    – —
    0Critical
    0High
    0Medium
    0Low
    What we checked

    Each check, and what it found.

    A check that could not run says so. It is never counted as nothing found.

    Fix these first

    Where to start.

    Ranked by what an attacker would use first, and what to change in your own DNS or accounts. The full report names the exact accounts, people and hosts.

    How this could be used The usual way in, against what this scan saw

      Select a stage to see what it is, and what breaks it.

      Full report

      Get the full report at your company inbox.

      It names the people and accounts behind each finding, so we only send it to an address at the domain you scanned.

      • Every finding, with the evidence behind it
      • What breach and infostealer data shows for your domain
      • The leaders named on your pages, and what we found for them
      • Every registered look-alike, with its mail and web status
      • The record or setting that fixes each one, and what was not checked

      One email with a private link to the report, which works for 14 days. Free scan results are deleted after 90 days. See our privacy notice.

      Keep watching

      Exposure changes every week. New look-alikes get registered and new leaks surface. Monitoring re-scans on a schedule, tells you what changed and proves each fix with a re-scan.

      Inside HRS Exposure

      From a free scan to a closed finding.

      The snapshot is where it starts. The console keeps watching your domains, ranks what an attacker would use first, and proves each fix with a re-scan.

      Watch the 2-minute demo
      Demo workspace · Example data
      What the free scan returns

      A grade, and the first thing to fix.

      Exposure snapshotSample scan · Example data
      northwind.example Grade D · Needs attention 9 findings across 7 checks
      CriticalAccounts in infostealer logs
      HighMail can be forged as this domain
      Medium3 look-alike domains registered
      Free vs full

      The snapshot is free. The names go to your inbox.

      The full report names the people and accounts behind each finding, so it only goes to an address at the domain you scanned.

      Compare what you get
      Validate

      A fix counts when a re-scan says so.

      Every claimed fix is checked by the next scan. One that does not hold is reopened, not quietly closed.

      See the whole loop
      The HRS Exposure remediation view: fixes verified by a re-scan, fixes awaiting proof, and open work with owners and due dates.
      Demo workspace · Example data
      How it works

      Thirty seconds, three steps.

      No account, no agent, nothing installed. We read what anyone on the internet can already see.

      01

      Enter a domain.

      Your company domain, or your work email and we take the domain from it.

      02

      Seven checks run at once.

      DNS, certificate logs, your public pages and breach data. You watch each one finish. Nothing touches your systems.

      03

      Fix the first things today.

      A grade, what to fix first and how, and the full report at an inbox on your domain.

      What we check

      Seven checks. Three things attackers go after.

      Your people, your brand and your organization. Each check is a route in that starts with public information, and each result says how to close it.

      • People · Brand · Organization

        Who they would pretend to be, mail that looks like you, and where a stolen password works.

        Run free scan
      • People

        Executive exposure

        Leaders named on your public pages, and whether their accounts show up in leaks. The target list for CEO fraud.

      • People

        Leaked credentials

        Staff devices caught by infostealer malware, and breaches of your own site. With monitoring, every address you add is checked against breach data too.

      • Brand

        Email spoofing

        Whether mail can be forged as your domain: SPF, DKIM and DMARC as published. The start of most invoice fraud.

      • Brand

        Look-alike domains

        Registered near-copies of your name, and which of them can already send or receive mail.

      • Organization

        Sign-in surface

        VPN portals, webmail and admin logins anyone can find under your domain. Where a stolen password gets typed.

      • Organization

        Third parties

        Who runs your DNS, who may send mail as you, and who sees your mail flow, read from public records.

      • Organization

        Web and TLS

        Certificate health and the security headers a modern site is expected to send.

      See it in two minutes

      From a domain to a closed finding.

      A free scan, the console, AI agents proposing the fix, and a re-scan that proves it, in the real product on a demo company.

      Autonomous, end to end

      Not a one-off scan. A loop that runs itself.

      The free snapshot is stage two of five. Inside HRS Exposure every stage runs on its own: agents work out what matters, it acts where you allow it, and a re-scan proves each fix instead of assuming it.

      1

      Scope

      Your verified domains, re-proved every month, weighted by what each is worth to the business, with out-of-scope hosts set aside.

      2

      Discover

      Subdomains from certificate logs and where they are hosted, your other domains, look-alikes, third parties and identity posture.

      The snapshot is here
      3

      Prioritize

      One severity scale across every check, ranked by CISA KEV and EPSS exploit intelligence, attack paths and what the asset is worth.

      4

      Validate

      A re-scan behind every claimed fix, run automatically when an agent spots one if you allow it, accepted risks that expire, and captured evidence for look-alike domains.

      5

      Mobilize

      Tickets in Jira, ServiceNow, GitHub or ConnectWise; SIEM, Slack and Teams alerts, overdue escalations; registrar takedown requests.

      Free vs full

      The snapshot is free. The names go to your inbox.

      The full report names the people and accounts behind each finding, so it is only ever sent to an address at the domain you scanned.

      What you getFree snapshotFull reportHRS Exposure
      Grade, score and every check's statusIncludedIncludedIncluded
      What to fix first, and howIncludedIncludedIncluded
      Every finding, with its evidenceNot includedIncludedIncluded
      The people and accounts behind each findingNot includedIncludedIncluded
      Where you get itThis pageAn inbox at your domainYour console
      Continuous monitoring and change alertsNot includedNot includedIncluded
      Human Risk attributionNot includedNot includedIncluded
      Remediation workflows, proved by re-scanNot includedNot includedIncluded
      Exploit intelligence (CISA KEV, EPSS)Not includedNot includedIncluded
      Ticket sync (Jira, ServiceNow, GitHub)Not includedNot includedIncluded
      Registrar takedown requestsNot includedNot includedIncluded
      MSP multi-tenant dashboardsNot includedNot includedIncluded
      Pricing

      Plans for people, businesses and groups.

      Pick a plan and you are watching your first address or domain in a few minutes. Business plans start with a 14-day free trial. Cancel any time.

      Billing

      Personal

      For you and your family: your own email addresses and accounts, not a business.

      $5a month, billed monthly
      $4a month, billed $48 a yearYou save $12 a year
      • Up to 5 email addresses for your household, each checked once a day against the breaches Have I Been Pwned has published
      • When a check finds something new, an email with the steps to lock that account down
      • Scam checker for links, emails, texts, QR codes and phone numbers, with 90 days of history
      • Cover up to 4 family members, each with their own account, sharing your 5 addresses
      Choose PersonalChoose Personal

      Billed from the day you sign up. Cancel any time.

      Lite

      14-day free trial

      For a small business with one website and email domain.

      $49a month, billed monthly
      $39.20a month, billed $470.40 a yearYou save $117.60 a year
      • 1 business domain, scanned every week
      • Email spoofing, look-alike domain, website and TLS checks, with what to fix first
      • Leaked-password checks for up to 25 staff, every day
      • An "Is this really us?" page where customers check messages that claim to be you
      • Scam checker for the whole team, and 5 personal email addresses watched
      • Email alerts and a PDF report you can share
      Start 14-day free trialStart 14-day free trial

      Stripe needs a card to start your 14-day free trial. Nothing is charged until the trial ends, and we email you three days before it does. Cancel before then from Manage billing and you pay nothing. Trials are limited to once per account and business email domain.

      Professional

      14-day free trial

      For a growing business with several domains, a bigger team or suppliers to watch.

      $199a month, billed monthly
      $159.20a month, billed $1,910.40 a yearYou save $477.60 a year
      • Up to 5 business domains, scanned as often as every day
      • Email spoofing, look-alike domain, website and TLS checks, with what to fix first
      • Leaked-password checks for up to 200 staff, every day
      • Executive exposure for up to 10 executives you name, and takedown requests for look-alike domains
      • Up to 25 suppliers checked from the outside, with an alert when one gets worse
      • Slack, Teams, SIEM, ticketing and API connections
      Start 14-day free trialStart 14-day free trial

      Stripe needs a card to start your 14-day free trial. Nothing is charged until the trial ends, and we email you three days before it does. Cancel before then from Manage billing and you pay nothing. Trials are limited to once per account and business email domain.

      Enterprise and MSP Partner

      Groups and larger companies: the domains, staff, subsidiaries and integrations in the contract, invoiced. Service providers: a partner workspace with a separate, isolated workspace and a Lite or Professional profile for each client.

      By quoteallowances set out in your contract, paid by invoice
      • The domains, staff and subsidiaries your group needs, set out in your contract
      • One view of the whole group, with each subsidiary's own console
      • Single sign-on, API access, SIEM and ticketing integrations
      • Executive and family protection for your leadership
      • Takedowns, a named contact, invoicing and purchase orders
      Talk to us

      Someone from our team replies within one working day.

      Prices in US dollars. Payments are handled by Stripe; we never see your card number. Not sure yet? The free checks and the free domain scan need no account, and the sample report shows what a full report looks like.

      After you sign up

      What happens next.

      No calls, no setup fee. You can leave whenever you like: cancel from Plan & billing and your plan runs to the end of the period you paid for.

      1. 01

        Choose a plan

        Pick monthly or annual. You can change both on the sign-up page before you pay.

      2. 02

        Create your account

        Your name, your email and a password. A business also gives its name. That is all we ask.

      3. 03

        Pay securely with Stripe

        Lite and Professional start with a 14-day free trial: Stripe takes a card and charges nothing until the trial ends. Personal is billed straight away.

      4. 04

        Confirm your email

        We send you a link. Alerts and reports go out once your address is confirmed.

      5. 05

        Follow the setup guide

        Your console opens on a short checklist: add an email address or your domain, prove you own it, and the first check runs.

      FAQ

      Questions, answered.

      Is the scan free, and do I need an account?
      Yes, it is free, and no account is needed. You only share an email if you want the full report.
      How much does Exposure cost?
      Personal is $5 a month, Lite $49 a month and Professional $199 a month. Paying for a year costs $48, $470.40 and $1,910.40. Enterprise and MSP plans are priced by quote. Prices are in US dollars.
      Is there a free trial?
      Lite and Professional come with a 14-day free trial, one per business. Stripe takes a card when you start and charges nothing until the trial ends. Cancel before then and you pay nothing. Personal has no trial: it starts when you pay.
      How do I cancel?
      Open Plan & billing in your console and choose Manage billing. Stripe's customer portal opens; cancel there. Your plan keeps working until the end of the period you have paid for, and nothing more is charged.
      Can I change plan or switch to annual billing?
      Yes. Before you pay, change either on the sign-up page. After that, Manage billing opens Stripe's customer portal, where you can switch plan or billing period, update your card and download invoices.
      Is my scan public?
      No. Your results are fetched with a random link only your browser has. We never list or publish the domains people scan, and the page never receives the names behind a finding.
      Do you ever see or store our passwords?
      Never. Credential exposure is recorded as presence only, that an account appeared in a breach or infostealer log, never the password itself. We never see your card number either: Stripe handles payment.
      What happens to my data if I leave?
      An admin can close the account from Account in the console. The subscription is cancelled, and everything is deleted after 14 days. Until then, a link we email you restores the account or downloads your data.
      Why does the full report only go to an inbox at my domain?
      Because it names people and accounts. Sending it only to an address at the scanned domain means nobody can pull a report on a company they do not belong to.
      Can I scan a domain I do not own?
      The snapshot, yes: it is built from public records anyone can read. The full report needs an inbox at that domain, and monitoring needs the domain verified.
      Do you install anything or log into my systems?
      No. The scan is passive: no agents, no credentials, no sign-in attempts and nothing sent to your staff. We only read what is already public.
      Get ahead of it

      See your exposure in 30 seconds.

      Then fix the first things before anyone uses them, and keep watching with HRS Exposure.

      Free · No sign-up · Public sources only