From a free scan to a closed finding.
The snapshot is where it starts. The console keeps watching your domains, ranks what an attacker would use first, and proves each fix with a re-scan.
Watch the 2-minute demoLeaked passwords, stolen sign-ins, spoofable email and look-alike domains, for you, your family or your business. The free scan reads public sources in about 30 seconds.
A Cloudflare human check runs in the background and only asks for a click when it has to.
Free · No sign-up · Public sources only
About 30 seconds. Every check reads public sources only, and each one appears here as it finishes.
Reading DNS, mail authentication, look-alikes, certificates and breach signals…
The sources these checks read did not answer during this scan. They are left out, not counted as clean, so there is no overall grade until they run. Scan again later, or monitor this domain and it is checked again on its own.
A free scan looks up your domain, not each person. It does not check which staff addresses turn up in other companies' breaches. Monitoring does, for every address you add.
A check that could not run says so. It is never counted as nothing found.
Ranked by what an attacker would use first, and what to change in your own DNS or accounts. The full report names the exact accounts, people and hosts.
Select a stage to see what it is, and what breaks it.
It names the people and accounts behind each finding, so we only send it to an address at the domain you scanned.
One email with a private link to the report, which works for 14 days. Free scan results are deleted after 90 days. See our privacy notice.
Exposure changes every week. New look-alikes get registered and new leaks surface. Monitoring re-scans on a schedule, tells you what changed and proves each fix with a re-scan.
The snapshot is where it starts. The console keeps watching your domains, ranks what an attacker would use first, and proves each fix with a re-scan.
Watch the 2-minute demoThe full report names the people and accounts behind each finding, so it only goes to an address at the domain you scanned.
Every claimed fix is checked by the next scan. One that does not hold is reopened, not quietly closed.
See the whole loop
No account, no agent, nothing installed. We read what anyone on the internet can already see.
Your company domain, or your work email and we take the domain from it.
DNS, certificate logs, your public pages and breach data. You watch each one finish. Nothing touches your systems.
A grade, what to fix first and how, and the full report at an inbox on your domain.
Your people, your brand and your organization. Each check is a route in that starts with public information, and each result says how to close it.
Leaders named on your public pages, and whether their accounts show up in leaks. The target list for CEO fraud.
Staff devices caught by infostealer malware, and breaches of your own site. With monitoring, every address you add is checked against breach data too.
Whether mail can be forged as your domain: SPF, DKIM and DMARC as published. The start of most invoice fraud.
Registered near-copies of your name, and which of them can already send or receive mail.
VPN portals, webmail and admin logins anyone can find under your domain. Where a stolen password gets typed.
Who runs your DNS, who may send mail as you, and who sees your mail flow, read from public records.
Certificate health and the security headers a modern site is expected to send.
A free scan, the console, AI agents proposing the fix, and a re-scan that proves it, in the real product on a demo company.
The free snapshot is stage two of five. Inside HRS Exposure every stage runs on its own: agents work out what matters, it acts where you allow it, and a re-scan proves each fix instead of assuming it.
Your verified domains, re-proved every month, weighted by what each is worth to the business, with out-of-scope hosts set aside.
Subdomains from certificate logs and where they are hosted, your other domains, look-alikes, third parties and identity posture.
The snapshot is hereOne severity scale across every check, ranked by CISA KEV and EPSS exploit intelligence, attack paths and what the asset is worth.
A re-scan behind every claimed fix, run automatically when an agent spots one if you allow it, accepted risks that expire, and captured evidence for look-alike domains.
Tickets in Jira, ServiceNow, GitHub or ConnectWise; SIEM, Slack and Teams alerts, overdue escalations; registrar takedown requests.
The full report names the people and accounts behind each finding, so it is only ever sent to an address at the domain you scanned.
| What you get | Free snapshot | Full report | HRS Exposure |
|---|---|---|---|
| Grade, score and every check's status | Included | Included | Included |
| What to fix first, and how | Included | Included | Included |
| Every finding, with its evidence | Not included | Included | Included |
| The people and accounts behind each finding | Not included | Included | Included |
| Where you get it | This page | An inbox at your domain | Your console |
| Continuous monitoring and change alerts | Not included | Not included | Included |
| Human Risk attribution | Not included | Not included | Included |
| Remediation workflows, proved by re-scan | Not included | Not included | Included |
| Exploit intelligence (CISA KEV, EPSS) | Not included | Not included | Included |
| Ticket sync (Jira, ServiceNow, GitHub) | Not included | Not included | Included |
| Registrar takedown requests | Not included | Not included | Included |
| MSP multi-tenant dashboards | Not included | Not included | Included |
Pick a plan and you are watching your first address or domain in a few minutes. Business plans start with a 14-day free trial. Cancel any time.
For you and your family: your own email addresses and accounts, not a business.
For a small business with one website and email domain.
Stripe needs a card to start your 14-day free trial. Nothing is charged until the trial ends, and we email you three days before it does. Cancel before then from Manage billing and you pay nothing. Trials are limited to once per account and business email domain.
For a growing business with several domains, a bigger team or suppliers to watch.
Stripe needs a card to start your 14-day free trial. Nothing is charged until the trial ends, and we email you three days before it does. Cancel before then from Manage billing and you pay nothing. Trials are limited to once per account and business email domain.
Groups and larger companies: the domains, staff, subsidiaries and integrations in the contract, invoiced. Service providers: a partner workspace with a separate, isolated workspace and a Lite or Professional profile for each client.
Someone from our team replies within one working day.
Prices in US dollars. Payments are handled by Stripe; we never see your card number. Not sure yet? The free checks and the free domain scan need no account, and the sample report shows what a full report looks like.
No calls, no setup fee. You can leave whenever you like: cancel from Plan & billing and your plan runs to the end of the period you paid for.
Pick monthly or annual. You can change both on the sign-up page before you pay.
Your name, your email and a password. A business also gives its name. That is all we ask.
Lite and Professional start with a 14-day free trial: Stripe takes a card and charges nothing until the trial ends. Personal is billed straight away.
We send you a link. Alerts and reports go out once your address is confirmed.
Your console opens on a short checklist: add an email address or your domain, prove you own it, and the first check runs.
Then fix the first things before anyone uses them, and keep watching with HRS Exposure.