Your contracts, as a stranger reads them
Where your contracts are on a public register, we set the notice beside your email records and show what a stranger could do with it: who to write to, what to quote, and when.
For organisations
See your organisation the way an attacker's first hour does.
We read every hostname, certificate and email record your organisation shows the open internet, and where your contracts are public we set them beside it. Every finding comes with where and when we read it, and the fix.
A regional logistics groupexample.com
- 61names in the certificate logs
- 48live
- 3serious findings
- A forged invoice would quote your real contractSerious
_dmarc.example.com: p=noneRead 29 Oct 2026, 14:02 GMT - A subdomain anyone can claimSerious
old-portal.example.comRead 29 Oct 2026, 14:02 GMT - A certificate that lapsedSerious
vpn.example.comRead 29 Oct 2026, 14:02 GMT
What the audit covers
Six things your organisation shows the outside world, whether or not anyone there knows.
Email that can be faked
SPF, DMARC and DKIM on every domain that takes mail, with the record to paste where one is wrong.
Forgotten doors
Every hostname the certificate logs and DNS give away: old staging sites, VPNs, webmail and portals, each with what it serves and its certificate.
Names a stranger can use
Subdomains anyone can claim, old domains anyone can buy, and near-identical domains already set up for mail.
Signs of a break-in
Hidden spam, injected links, pages you never published and scripts you never added, on every live host.
Who you trust
The outside companies your public records let send email as you, and the outside code your public pages load.
What we read
What comes with your order, and what needs your signature.
On the open internet
- Every page your sites serve at the addresses they advertise
- DNS, certificates and the public certificate logs
- The domain registries
- AusTender's contract notices, where your name is on them
With your written authorisation
- The well-known paths a site never advertises, on the hostnames you confirm: /.git/HEAD, /.env, a backup in the web root, a browsable upload folder, phpinfo and the WordPress debug log.
- Pages a public web index holds for those hostnames that read as sign-in, admin, test or old pages, each read once to see whether it still answers. At most 12.
- GET requests only, at most 8 a host, and a file counts only when its content proves it.
What you receive
A dated report a board can read, with the technical proof underneath for whoever fixes it.
Cover
Your organisation, your domains, your band, and the dates of every read.
Start here
Your own story in plain words: what a stranger can already do with what is public, then the proof, then the fix.
For the board
One screen: the grades, the verdicts, the actions that matter most, and what we could not read.
Your footprint
Every hostname: where it came from, whether it is live, its platform, its certificate and its state.
Findings, by dimension
Each with where and when we read it, the fix to paste with your domain in it, and how we will know it landed.
Method
What we read and when, our sources by name, and the rubric behind every grade.
Monitoring
What we watch from here, what an alert says, and the price for your band.
- A 30-minute walkthrough with us, booked when it suits you.
- Proof of every fix, with Monitoring: the next read shows it landed.
- Email securityC10 of 10 read
- Web securityC24 of 27 read
- CertificatesA5 of 5 read
- PrivacyB4 of 5 read
- FootprintD9 of 9 read
One grade per dimension, each showing what it rests on. Never one number for the company.
Prices
Your band is the highest of your staff, and the live hostnames we find. You see the list and the band before anything is read more deeply.
| Small | Mid | Large | |
|---|---|---|---|
| Staff | Under 50 | 50 to 250 | Over 250, or several brands |
| Live hostnames | Up to 25 | 26 to 100 | 101 to 250 |
| The audit | £2,500 once | £3,950 once | £6,950 once |
| Monitoring | £495 a month | £750 a month | £1,250 a month |
Over 250 live hostnames, by quote. [email protected]
Every finding names the place and the day we read it. Every grade shows its sum. Every fix is the thing to paste, with how you will know it landed.
Exposure Monitoring
Your footprint read again every week. An email when anything changes, and proof on the next read when a fix lands. From £495 a month, on a 12-month term, billed monthly.
What we watch
- Every week
New names in the certificate logs, hosts gone quiet, dangling names, lapsed domains, signs of a compromise, every certificate, and every domain's SPF and DMARC
- Every quarter
Your grades again, and a short summary
What an alert says
- What changed, where and when we read it, and what to do, with the record to paste.
- At most one email a day.
- An all-clear every four weeks when nothing changes.
- When a fix lands, the next read proves it and we tell you that too.
Questions
Is this a penetration test?
No. A penetration test tries to break in. This audit shows what your organisation hands a stranger from the outside, grades it, and gives you the proof for every finding with the fix beside it.
Do you scan our systems?
We read your sites as a visitor does, along with DNS, certificates, the certificate logs, the registries and AusTender's contract notices. With your written authorisation we also request the well-known paths listed above, on the hostnames you confirm.
What do you need from us?
Your written authorisation, on a page we send you after payment, where you see every hostname before you sign. And any domains we would not find ourselves.
How long does it take?
Five working days from your authorisation to your report. A 30-minute walkthrough follows, at a time that suits you.
Who does the work?
Bondstone's cyber security practice. A person reviews every finding before your report reaches you, and takes you through it.
Can we pay on an invoice?
Yes. We send an invoice with your purchase order number on it, or you can pay by card.
Start with a briefing.
We read what the open web shows about your organisation and take you through it, with the proof. No charge.
Rather talk first? Ring 0113 490 0521, weekdays 9am to 5pm UK time. At any other time, book a call and we ring you back.