Scanning
We scan everything you let us see: domains, mail, apps and code. Then we keep scanning.
Talk to us about scanningSecurity you can see.
Not just hope for.
Capisec scans what you expose, hardens what you run and tests what you trust, and shows you every step in one live workspace.
Scan it. Harden it.
Then try to break it.
Blue team
We put the missing security gates in place and harden what you already run.
Talk to us about blue teamingRed team
Authorised attack simulations that show where your defences actually give.
Talk to us about red teamingPhishing simulations
Agreed phishing exercises that train your people instead of blaming them.
Talk to us about phishing testsExposure monitoring
We watch for your domain in leaked credential sets and tell you first.
Talk to us about exposureLive reporting
A live dashboard and a weekly report: what we scanned, found and fixed.
See the workspaceFrom first scan
to weekly proof.
No access needed
Outside-in scan
We start with what anyone on the internet can see: domains, mail, websites and exposed services. No access needed.
$ scan acmepay.example- mx recordsok
- dmarc policyp=none
- tls 1.0enabled
- /admin200 public
- leaked credentialsnone found
Agreed in writing
Agree the scope
Together we decide how deep to go. Accounts, code and infrastructure are each opt-in, in writing.
$ scope show- outside inincluded
- accountsgranted
- codeoptional · not granted
- infrastructuregranted
- signed14 Oct
Blue team
Harden
Our blue team puts the missing controls in place: MFA, mail policy, roles, headers, backups. Fixes can be re-tested before we close them.
$ fixes --since scan- mfaenforced 12/12
- dmarc policyp=quarantine
- tls 1.0disabled
- /adminbehind sso
- retestpassed
Red team
Try to break it
Authorised red team exercises and agreed phishing tests show what still gives, and close it.
$ exercise q3 --authorised- phishing40 sent · 3 clicked
- pathstaging → billing db
- segmentationadded
- retestpath blocked
Weekly
Report, every week
Your console shows every check live, and a weekly report lands in your inbox. Urgent findings reach you straight away.
$ report weekly- fixed11
- new3
- posture score82 (+2)
- sentMon 08:00
You decide
how deep we go.
Every engagement starts outside in. Each extra layer of access is your choice, agreed in writing, and unlocks deeper checks. Code access is always optional.
Public domains, DNS and mail records, websites, exposed services, leaked credentials.
What a signed-in user can reach: permissions, session handling, hidden routes.
Read-only source review: secrets, dependencies, risky patterns. Always optional.
Cloud and network configuration, segmentation, backups and logging.
Administrator-level review of identity, roles and the controls behind them.
Every layer,checked and reported.
- Mail: DMARC policy set to none
- Web: Admin route publicly reachable
- TLS: Legacy TLS 1.0 still enabled
- CMS: Outdated WordPress plugin
- Bundle: Source maps published
Illustrative findings
Outside in first. Black-box checks of everything public, with no access needed.
Depth follows access. Accounts, code and infrastructure unlock deeper checks.
Code is optional. No codebase? We scan your infrastructure, mail and people.
Explained, not dumped. Every finding comes with impact and a fix.
- SPF
- DKIM
- DMARC policy
- DNSSEC
- TLS versions
- Exposed admin routes
- Leaked credentials
- Source maps
- Hidden API endpoints
- Outdated plugins
- Security headers
- MFA coverage
- Least privilege
- Role reviews
- Backups
- Phishing resilience
Want to Know if Your
Domain is Secure?
Get a free security snapshot of your public DNS in seconds.
Know where you stand. Check your domain’s email authentication, mail routing, and DNSSEC records, with practical next steps.
Privacy by designPublic records. No installation.Protection that works together.
So you can move forward.
Every check.
As it happens.
Your console shows what we scanned, found and fixed, live. No black box, no hoping for the best.
Explore the demo consoleWe keep watch.
While you’re off the clock.
Attacks don’t wait for office hours. Your domains, mail, accounts and leaked credentials are watched every hour of every day, and a person decides what needs you.
24/7 incident line+31 (0)20 210 1716- TLSShop certificate expires in 14 daysTicket opened
- MailSpoofed invoice from a look-alike domainBlocked
- WebBrute-force attempts on the login formRate-limited
- LeaksStaff address found in a new credential dumpPassword reset
- IdentityAdmin sign-in from an unknown countryEscalated by phone
- DNSMX record changed outside the change windowFlagged
- ConsoleNight log posted for your teamLogged
- 01
Around the clock
Automated checks run day and night, weekends and holidays included.
- 02
People on call
A specialist triages every alert before it reaches you.
- 03
Escalation you agreed
Urgent findings by phone, everything else in your Monday report.
Security should bring
peace of mind.
Less complexity. More visibility. A practical approach to protecting the business you’re building.
Meet CapisecVisible, not hands-off
A live workspace and weekly reports show exactly what we did.
Always on
Continuous checks run in the background; specialists review every finding.
Authorised and scoped
Every test starts with written scope and your sign-off.
Questions.The short ones are here. For anything else, ask below.
Capisec is the cybersecurity division of Capisoft. We scan what you expose, harden what you run and test what you trust, and show you every step in a live console and weekly reports.
Secure smarter.
Know where you stand.
Run the free domain scan now, or talk to us about a full outside-in look.