# What an attacker finds about you, we find first. Source: https://vetosec.at/en/external-security-analysis/ Every attack starts with reconnaissance: find subdomains, probe services, read versions, search leaks. We run exactly this enumeration against your domain and IP address, with your approval and without access to your systems. - **from €249** excl. VAT - **34** checkpoints - **No** access to your systems - **5 working days** to report ## What we enumerate Your attack surface, mapped like an attacker would. - **Subdomains and forgotten systems**: We find what is publicly discoverable: test and legacy systems, old websites, dangling DNS records. - **Open services and versions**: Which ports answer, which software runs behind them and whether admin interfaces sit open on the internet. - **Known vulnerabilities**: Detected versions matched against known and actively exploited vulnerabilities. - **Leaks and spoofed senders**: Company addresses in credential leaks, look-alike domains and whether someone can send mail in your name. ## Process From order to report in five working days. 1. **Send domain and IP**: Two details and your written approval. We find the rest ourselves. 2. **Enumeration**: Active scans and public source research. No login attempts, business as usual. You get our source IP up front. 3. **Report and call**: Within 5 working days of approval. PDF plus a 30 minute call. ## External analysis or IT Check ### External security analysis (from €249) - Reconnaissance from outside, like an attacker - 34 checks on domain and IP - No access to your systems - Report in 5 working days ### IT security check (from €1,299) - On-site check, from inside - 100+ checkpoints in 8 areas - Backups, accounts, network, server room - Findings and action plan in 2 weeks What is only visible from inside, such as backups, phishing resistance or Microsoft 365, is outside the external analysis. ## All 34 checkpoints ### Email & DNS: Can someone send email in your name? - SPF: which servers may send for you - DKIM: signature and published key - DMARC: policy against spoofing and reporting - MTA-STS and TLS-RPT: enforced encrypted delivery - DNSSEC: signed DNS answers - Nameservers: zone transfer, redundancy, stale records ### Reachable services: What answers from the internet? - Open ports on your IP address - Admin access: SSH, remote support, firewall, NAS and printer UIs - Databases and file shares exposed - VPN endpoints and versions - Visible product versions - Subdomains, fully enumerated - Test, staging and legacy systems - Dangling DNS records (subdomain takeover) - Cameras, building systems, controllers on your line - Unprotected cloud storage ### Web configuration: Is your website configured safely? - Security headers - Cookie flags - Exposed paths: .git, config files, backups, directory listings - Login pages and detectable versions ### Reputation & credentials: Are your domain passwords in leaks? - Company addresses in leak collections, with source and date - Domain and mail servers on blocklists - Typosquatting and look-alike domains - Certificates issued in your name ### OSINT: What is in search engines and archives? - Indexed documents, web archives, code repositories and file metadata ### Encryption: Is your encryption current? - TLS versions and ciphers - Certificate chain, issuer, validity, names - Encryption on your mail servers ### Vulnerabilities: Are there known vulnerabilities? - Known CVEs in detected versions - Match against actively exploited vulnerabilities (CISA KEV) - Software without vendor support - Default and sample configurations - Vulnerable third-party website components - Misconfigurations that combine into an attack path ## Typical triggers ### A good fit if - Your systems grew over years and some are forgotten - Website on WordPress or another CMS - Own servers, VPN or remote access - Your insurer or a client asks about your security - Nobody has ever checked from outside ### What it does not cover - Not a full penetration test, we exploit nothing - Not a certification - No internal checks, that is the IT Check ## Promised in writing before we start. - We only test what you approved in writing. - We change nothing and try no passwords. - The report goes to you only. No sharing, no reference without consent. - Data is stored encrypted in Austria and deleted after 12 months at the latest. ## Further reading - [**Neue Sicherheitslücke gemeldet: Was Firmen jetzt tun sollten**](https://vetosec.at/en/articles/cybersecurity/neue-sicherheitsluecke-was-tun/): Almost every week there is a new critical vulnerability. - [**PHP2Shell: Was Website-Betreiber jetzt tun müssen**](https://vetosec.at/en/articles/cybersecurity/php2shell-was-website-betreiber-jetzt-tun-muessen/): Two critical PHP flaws are being exploited since October 2026. - [**Wie Hacker in kleine Firmen kommen: die 6 häufigsten Wege**](https://vetosec.at/en/articles/cybersecurity/wie-hacker-in-kleine-firmen-kommen/): Most break-ins at small companies follow six simple paths. ## Frequently asked questions ### What is enumeration? Enumeration is the reconnaissance phase of an attack: systematically collecting which systems, services, versions and credentials are discoverable from outside. We do it first so you can close gaps before someone else finds them. ### Will we notice the analysis? Business continues as usual. We only query what your systems already answer publicly, without load and without login attempts. A security monitoring tool may alert, so we give you our source IP up front. ### Is an external scan legal? Yes, with your explicit approval. You confirm you control the domain and IP. We verify against public registers. If something does not match, we do not scan and refund you. ### How do I find my IP address? Open icanhazip.com from your company network. That address is your public IP. If you have several, check your ISP contract. We are happy to help. ### What does the external analysis cost? €249 excl. VAT for one domain or IP address, each additional one €69. Book right here and pay online. ## Related - [IT Check](https://vetosec.at/en/services/it-check/): from €1,299 - [Gap analysis & consulting](https://vetosec.at/en/services/gap-analysis/): ISO 27001, NIS2, GDPR - [IT emergency](https://vetosec.at/it-notfall/): for companies ## External security analysis and attack surface enumeration in Austria The vetosec external security analysis is an attacker-view attack surface assessment: subdomain enumeration, port scanning, service and version detection, leak research and CVE matching. 34 checkpoints in seven areas. The report works as evidence for cyber insurance, supplier questionnaires and NIS2 supply chain requirements. Updated: October 19, 2026 Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/