Mondoo Exposure Check
in Minutes
Scan any domain for exposed services, TLS & DNS posture, subdomains, and known vulnerabilities — the way an attacker sees you.
Try
- Free
- No signup
- Results in ~2 minutes
How it works
Three steps to uncover your external exposure.
Enter your domain
Type any domain name and start a free external scan in seconds. No signup or installation required.
We analyze your exposure
Our engine checks TLS, DNS, email security, vulnerabilities, and more — all from an attacker's perspective.
Get actionable results
See a scored breakdown of your external attack surface with clear findings and remediation guidance.
What is External Attack Surface Management?
External Attack Surface Management (EASM) is the continuous process of discovering, analyzing, and monitoring all internet-facing assets and services that an organization exposes to the public internet. Unlike internal security tools that require agents or network access, EASM operates entirely from the outside, seeing your infrastructure the way an attacker would.
Why EASM matters
Organizations today have a constantly shifting external footprint. Cloud migrations, SaaS integrations, subdomain sprawl, and shadow IT all create exposure that internal security tools cannot see. According to industry research, the average enterprise has 30% more external assets than their security teams are aware of. Unmanaged assets are the most common initial access vector in breaches because they are often unpatched, misconfigured, or forgotten entirely.
How the Mondoo Exposure Check fits in
The Mondoo Exposure Check is a free EASM tool that gives you an instant snapshot of your external security posture. It scans 8 security categories — including TLS, DNS, HTTP headers, certificates, email authentication, IP enumeration, port exposure, and public vulnerabilities — and delivers a scored report with actionable remediation guidance. For organizations that need continuous monitoring, the full Mondoo platform extends this into an ongoing EASM program with automated scanning, alerting, and compliance mapping.
What we check
Mondoo scans 8 security categories from an external attacker's perspective in under 5 minutes: TLS, DNS, HTTP headers, certificates, DMARC/DKIM, IP enumeration, port exposure, and CVEs.
Certificate Security
Validates certificate domain name matching, chain of trust, revocation status, and expiration dates. Expired or misconfigured certificates trigger browser warnings that erode user trust and can expose connections to interception. Mondoo flags certificates expiring within 30 days so you can renew before outages occur.
TLS Security
Checks protocol versions, cipher suite strength, AEAD and Perfect Forward Secrecy support, and protection against BEAST and POODLE attacks. Weak TLS configurations allow attackers to intercept encrypted traffic through man-in-the-middle attacks. Mondoo verifies TLS 1.3 support and flags deprecated protocols like SSLv3 and TLS 1.0.
HTTP Security
Evaluates security headers including Content-Security-Policy, HSTS, X-Frame-Options, and Referrer-Policy. Missing headers are the most common finding, leaving sites vulnerable to XSS, clickjacking, and MIME-sniffing attacks. Mondoo also detects server version disclosure that gives attackers a roadmap to known exploits.
Domain + Subdomain Security
Validates DNSSEC enablement, record hygiene, wildcard usage, NS redundancy, and enumerates subdomains. Misconfigured DNS records can redirect traffic or enable domain hijacking. Mondoo identifies dangling CNAME records, missing DNSSEC, and exposed subdomains that expand your attack surface.
DMARC/DKIM
Validates SPF, DKIM, and DMARC records that protect your domain from email spoofing and phishing. Without proper email authentication, attackers can send fraudulent emails that appear to come from your domain, leading to credential theft and business email compromise. Mondoo checks policy enforcement levels and reporting configuration.
IP Enumeration
Discovers IP addresses, performs reverse DNS lookups, validates PTR records, and maps your infrastructure. Understanding which IPs are publicly associated with your domain is the first step in reducing exposure. Mondoo identifies all resolved addresses and checks for proper forward-confirmed reverse DNS.
Ports/Service Security
Scans for open ports and identifies running services exposed to the internet. Unnecessary open ports such as databases, admin panels, or legacy protocols significantly increase your attack surface. Mondoo detects commonly exploited services and flags ports that should not be publicly accessible.
Vulnerabilities
Detects known CVEs, outdated software, and rates vulnerabilities by severity for all exposed services. Unpatched software is the leading cause of breaches in internet-facing systems. Mondoo cross-references discovered services against public vulnerability databases to surface critical risks.
Why Mondoo
No installation, no account, no agent. Powered by the open-source cnspec security engine, it delivers risk-rated results with remediation guidance in minutes, not days.
Free & instant
No signup, no installation. Get results in minutes with zero friction.
Attacker's perspective
See exactly what hackers see when they look at your domain from the outside.
Actionable scores
Not just findings, but risk-rated assessments with clear remediation guidance.
Powered by cnspec
Built on Mondoo's open-source security engine, trusted across thousands of environments.
Who is this for?
The Mondoo Exposure Check is designed for anyone responsible for securing internet-facing infrastructure.
Security Teams
Ideal for security teams who need a quick external posture check before an audit or penetration test. Get a baseline view of your organization's exposure in minutes.
DevOps Engineers
Verify that deployments haven't introduced misconfigurations, exposed services, or weakened TLS settings. Run a check after every infrastructure change.
Administrators
Monitor domain health across certificates, DNS, and email authentication. Catch expiring certificates and broken SPF records before they cause outages.
Compliance Officers
Generate evidence of external security controls for SOC 2, ISO 27001, and NIS-2 compliance. The scored results map to common framework requirements.
Small Business Owners
No security team? No problem. Get a clear, jargon-free assessment of your website security with actionable steps to fix issues, all completely free.
Frequently asked questions
What does the Mondoo Exposure Check scan?
The Mondoo Exposure Check performs a comprehensive external security assessment across eight areas: certificate security, TLS configuration, HTTP security headers, domain and subdomain security, DMARC/DKIM email authentication, IP enumeration, port and service exposure, and known public vulnerabilities (CVEs). All checks run from an external perspective, showing you what attackers see.
Is the scan free?
Yes, the Mondoo Exposure Check is completely free. No signup, account creation, or installation is required. Simply enter a domain name and get results in minutes.
How long does a scan take?
A typical scan completes in 2 to 5 minutes depending on the domain's size and complexity. Results appear progressively as each check category completes, so you can start reviewing findings before the full scan finishes.
What is an external attack surface?
An external attack surface is the sum of all internet-facing assets and services that an attacker could target, including web servers, DNS records, email configuration, TLS certificates, open ports, and publicly known vulnerabilities. External Attack Surface Management (EASM) is the practice of continuously discovering and monitoring these assets. The Mondoo Exposure Check analyzes your external attack surface from an outsider's perspective, showing you what attackers see when they look at your domain.
How is the security score calculated?
The security score ranges from 0 to 100, where 100 represents the best security posture. It is calculated by evaluating findings across all eight check categories, weighted by severity. Scores above 90 are rated Excellent, 60 to 89 are Good, and below 60 are Critical.
Do you store my scan results?
Scan results are stored temporarily to allow you to view and share them. Results are accessible via the shareable URL generated after each scan. No personal data or credentials are collected during the scan process.
Is the Mondoo Exposure Check safe to run on my domain?
Yes, the scan is completely non-intrusive. It only performs passive and lightweight active checks that are indistinguishable from normal web traffic. No exploit attempts, brute-force tests, or destructive actions are performed. The scan queries public DNS records, connects to open ports, and checks HTTP response headers, the same information any visitor to your site would see.
What's the difference between the free scan and the full assessment?
The free Mondoo Exposure Check covers external-facing security across 8 categories. The full Mondoo assessment goes deeper with internal infrastructure scanning, cloud configuration analysis, Kubernetes security, compliance mapping, and continuous monitoring with alerting. The full assessment requires the Mondoo Connector and provides ongoing visibility, not just a point-in-time snapshot.
Can I scan subdomains?
The Mondoo Exposure Check automatically discovers and enumerates subdomains as part of the Domain + Subdomain Security check. You can also scan any specific subdomain directly by entering it in the search box (for example, app.example.com or api.example.com).
Does Mondoo detect zero-day vulnerabilities?
The Mondoo Exposure Check identifies publicly disclosed vulnerabilities (CVEs) in exposed services and software versions. It does not detect zero-day vulnerabilities, as those are by definition unknown to public databases. However, by identifying outdated software and unnecessary exposed services, it helps reduce the attack surface where zero-days are most likely to be exploited.
How does Mondoo compare to other external scanners?
Unlike most external scanners, the Mondoo Exposure Check is completely free with no signup required and delivers results in under 5 minutes. It is powered by cnspec, Mondoo's open-source security engine that is also used for internal infrastructure scanning. This means findings from the free external check can be directly expanded into a full security program without switching tools or re-learning a new platform.
What is External Attack Surface Management (EASM)?
External Attack Surface Management (EASM) is the continuous process of discovering, analyzing, and monitoring all internet-facing assets and services that an organization exposes to the public internet. EASM tools operate from the outside, seeing your infrastructure the way an attacker would, to identify misconfigurations, exposed services, and vulnerabilities before they are exploited. The Mondoo Exposure Check is a free EASM tool that provides an instant snapshot of your external security posture across 8 categories.
Want a deeper assessment?
Get a comprehensive security evaluation of your entire infrastructure with expert remediation guidance.
Get full assessment