How the assessment works.

The Cyber Exposure Assessment is a private, outside-in look at how exposed your organization is to cyber attack. Light, non-disruptive automated tooling checks your domain using only information that is already public, and BirdyFoot analysts review the findings and turn them into a report for you.

Think of the findings as low-hanging fruit. Each one takes an attacker little effort to find or use, yet it can put a business, its people, and its customers at serious risk.

It is a public service, free of charge. We do this work so organizations can see where they stand and act before a weakness becomes a breach.

After a verification process we run the assessment free of charge with a zero data retention policy.

1. 1

   Request

   Fill out the request form with your name, work email, organization, and the domain you want assessed. We confirm by email that we have it.

2. 2

   Verify

   We contact you to confirm who you are and that you’re authorized to request an assessment for the organization. A request we can’t verify is not assessed.

3. 3

   Assess and deliver

   We run the assessment from the public internet, our analysts review the findings, and we send you the report and the raw data.

Attackers start from the outside, so the assessment does too. We check your organization on four signals, in the order an attacker would try them, using nothing the open internet does not already show. No logins are attempted and no test messages are sent.

The first is email spoofing protectionWhat an attacker doesSends invoices and password resets that look like they came from you., because a forged invoice or password reset is the cheapest attack there is. Next come website encryptionWhat an attacker doesReads or alters what visitors and staff send to your site. and visible outdated softwareWhat an attacker doesRuns a published exploit against the version you advertise.: what one look at your homepage turns up. Last are basic security headersWhat an attacker doesInjects scripts or frames your site inside a phishing page., which decide how much a browser will protect your visitors from a tampered page.

Every signal lands in one of three tiers: protected, partial, or exposed. The report says where you landed on each one, why, and what to fix first.

Beyond those signals, the same scan runs passive checks for exposed files, leaked configuration, and dangling subdomains across every host it finds under your domain.

Because every step is automated and repeatable, you can ask for another assessment later and a change in the result means something changed, not that we looked differently.