Subscription · Monthly, cancel any time
Know what criminals and customers can see about your business
Cyber Essentials proves the controls were there on the day. An assessment proves it on the day of the assessment. Nothing tells you what has changed since — the certificate that quietly expired, the DMARC record someone edited, the look-alike domain registered last Tuesday, the analytics tag a plugin update added before the cookie banner. The Exposure & Trust Monitor looks at what the outside world can see of your organisation every month, tells you what changed, and ranks what to do about it. Independent monitoring, never a certificate.
£49
a month plus VAT for one domain; £99 for up to three, checked weeklyNo minimum term
2 pages
every month: what changed, what to fix now, what to fix this month, what to keep watchingThe report
0 logins
needed. Everything in the base plan is read from public records and ordinary page loadsNothing installed
Says so
when nothing changed and no action is needed — most months, for most organisationsThe honest month
Who this is for
Owner-managed businesses, charities and professional firms of five to two hundred people that have done the basics — or paid someone to — and have nobody watching afterwards. It suits organisations that hold Cyber Essentials and want to know whether it still holds, organisations whose insurer or customers ask what they monitor, and anyone who has ever found out about an expired certificate from a customer rather than a colleague.
It is the natural next step after a website privacy scan, and the first month is included with one. It is also what we recommend, ahead of anything more expensive, to the organisations that take the free self-assessment and score well.
What we watch
The records that decide whether criminals can send email as you.
- SPF, DKIM and DMARC: present, correct, and set to reject rather than just report
- MTA-STS and TLS reporting for inbound mail
- Certificate expiry dates and weak TLS configuration on every host we can see
- Domain and DNS changes since last month, with what changed and when
What a first-time visitor's browser is actually handed.
- Every third-party service and tracker loaded, and any that appeared since last month
- Cookies set before consent, and whether the banner actually blocks anything
- Security headers, mixed content, exposed admin paths and forgotten pages
- Site drift: the pages that changed, so a defacement or an injected script is noticed in days, not months
The things registered to look like you.
- Look-alike domains newly registered or newly issued a certificate — the ones used for invoice fraud
- Certificates issued in your name by anyone, from the public transparency logs
- Your public statements about security and privacy — the privacy notice, the trust page — checked against what the site actually does
What you receive
A two-page report on the first working day of each month, in plain English, with three lists: fix now, fix this month, and keep watching. Each item says what we saw, why it matters to an organisation like yours, and what to ask your IT provider to do — in words you can paste into an email. Above the lists is a one-line summary the owner can forward to the board or the insurer. When nothing has changed, the report says exactly that, and that month's report is the one you keep for the renewal form.
Every report states plainly what we did not check. We do not log in to anything, we do not scan behind your firewall, and we do not test your staff. Those are different products, and two of them are on this site.
What it costs
One domain and the mail, website and look-alike checks above. A monthly report and a monthly change summary by email.
£49 + VATPer month, cancel any time
Start monitoring — £49 + VAT a month
Secure checkout by Stripe · cancel from any invoice. Checked monthly. Includes a dated statement each quarter that the domain is under independent monitoring, for questionnaires and renewals.
Up to three domains, checked weekly, with an email the week something changes rather than a month later. Includes the short quarterly resilience questionnaire — MFA, backups, patching, incident arrangements — reported as what you told us, not what we verified.
£99 + VATPer month, cancel any time
Start Monitor Plus — £99 + VAT a month
Secure checkout by Stripe · cancel from any invoice. Most organisations with a trading name, a group name and an old domain they still own need this one.
A reviewed tier — a named person reads your report before it goes out, and authorised scanning of your internet-facing systems under a signed scope — follows once the first customers have had six months of reports. It will be £199 + VAT a month. If you need it now, tell us and we will scope it as a piece of work.
How we score it, and why the score is not the point
Each report carries a simple exposure rating from A to E, with the method published on the report itself so that anyone you show it to can see what it does and does not mean. We keep it deliberately coarse. A number that goes up and down will be quoted back at you by an insurer or a customer, and we would rather you were judged on the three lists than on a decimal. The rating changes only when something in the fix-now or fix-this-month lists changes.
What actually happens, and when
Sign up
Tell us the domain and the email address the report should go to. We confirm the domain belongs to you by a record you add or an email to an address on it. No account, no software, no access to anything.
Within five working days
Your first report: the baseline. It is usually the longest one you will get, because it lists everything that is already true. Thereafter the reports are about change.
Your effort
Ten minutes a month to read it and forward the items to whoever runs your IT. On Monitor Plus, ten minutes a quarter to answer the resilience questions.
Every month
The report on the first working day. On Monitor Plus, an email the week something changes — a certificate inside thirty days of expiry, a new look-alike domain, a DMARC record edited, a new third party on the site.
When something is found
The report says what to do. If you want us to do it, that is a separate piece of work and we say so; we do not sell the fix inside the report.
If you leave
Cancel from the link on any report or invoice. Your reports stay yours; we delete our copies and the scan history ninety days after the last one, unless you ask us to keep them.
Questions we are usually asked
Is this a vulnerability scan or a penetration test?
No. The base plans look only at what is public: DNS and mail records, certificates, the pages your website serves to anyone, and the public certificate logs. Nothing is probed, nothing is logged into. Authorised scanning of your systems comes with the reviewed tier, under a signed scope, and a penetration test is a separate service delivered by our accredited partner.
Our IT provider says they already monitor this.
Ask them for last month's report. Some do, and do it well; if so you do not need us. Many monitor the things inside the network and nobody is watching the outside. The report is also independent of the people whose work it checks, which is the point of it when an insurer or a customer asks.
Will you tell me if my staff's passwords are in a breach?
Not in the base plans. Breach data is personal data, and telling you a named person's credential is exposed needs domain verification, a processor agreement and a plan for what happens next. It is part of the reviewed tier for exactly those reasons.
Can I show the report to my insurer?
Yes, and it is written for that. The quarterly statement says the domain is under independent monitoring and what that covers. It does not say your organisation is secure, because no external report can, and an insurer who reads it will respect that more than a badge.
What do you do with our data?
We hold your domain names, the report history, and the contact details for the reports. The reports are generated from public sources. We are a processor for the contact details and a controller for our own records of the service; the privacy notice and the subscription terms set that out, and a data protection impact assessment for the service is available on request.
The first ten organisations are founding customers: the report is produced partly by hand while the automation is finished, the price is fixed for twelve months, and you get to tell us what the report should say. Secure checkout by Stripe; we confirm the domain is yours by email within one working day. Rather talk first, or need the reviewed tier now? Tell us about your organisation, or start with the one-off scan.