Reading a firm from outside, with zero access

Security that never needs the keys to your firm

A lot of security work starts by asking for access: a login to your systems, software on your machines, a way into your mailboxes. Each of those is a key. A key that opens many firms is worth more to an attacker than any single firm behind it, and government advisories describe attackers using a provider’s access as a way into many of its clients at once.

So we hold no keys to your firm. No login to your systems. Nothing installed on your machines. No access to your mailboxes. Everything below is read from the outside, the way a stranger planning a fraud would read it.

What a firm shows from outside

Every firm has a footprint on the internet: the domains it owns, its email settings, its website, and systems it may have forgotten, such as an old client portal or a test site. Your firm’s addresses in breach data are part of it too. Anyone can read this footprint.

• Email and domain settings: SPF, DKIM and DMARC records, which decide whether email in your name can be forged.
• Your firm’s addresses: presence in monitored breach databases.
• Website: what its responses reveal about its software, its security headers and its certificate.
• Look-alike domains: registered domains made from your name, and whether they can send email.
• Public records and website code: business registrations that name the firm, and keys left in its own website code.

Why a list of known systems is not enough

An internal review starts from the systems the firm knows about. An outside read starts from the domain and finds what is connected to it, which often includes systems nobody remembered: a site set up by a former supplier, or a domain that still points at a service the firm stopped using.

A score is not proof

A number on its own tells you nothing you can check. Every finding we report carries the public record it rests on and the date it was read, so anyone can confirm it. A person verifies every finding before your firm sees it.

Outside verified, inside confirmed

Some things can only be seen from inside, such as who can sign in and how a payment is approved. We do not go inside to look. The assessment includes an inside checklist that your own team completes, on your schedule. Your team’s answers are your confirmation, not something we verified, and the record keeps the two apart: what we verified from outside, and what your team confirmed inside, on one dated record.

Putting findings in order

Not every finding comes first. A readable password for a current staff address, or a domain whose email can be forged, comes before a missing website header. Each finding says what it is, why it matters and where the change is made.

How LeakTrace does it

An External Cybersecurity Assessment reads this outside view once and dates it. Every finding carries the command or public source that proves it, and a step-by-step fix, re-checked from outside until it is closed. Forged-email protection is switched on where we can reach the firm’s DNS host, one click per step and only when you approve it, with the exact records to paste where we can’t. No key is kept afterwards.

One reading goes stale

A one-time check is true on the day it is read. A firm’s outside changes every week: a new host name, a changed email record, a look-alike registered in its name. Monitoring re-reads email settings, look-alike domains and new host names every hour, and everything else every day, and each change found is recorded with its date.

A check you can run now

nslookup -type=txt _dmarc.yourfirm.ca

If nothing comes back, there is no DMARC policy. If it says p=none, forged email in your name is still delivered.