Home / External assessment
External cybersecurity assessment
In short. Nexorion Tech's external assessment shows what anyone on the internet can see of a company's security, from public information about its domain. It does not enter systems, test passwords or fix flaws. It delivers a short PDF.
How it works
1. Authorisation
You sign the authorisation with the domain and the period of the check. Without this document, nothing runs.
2. Check
DNS, certificates, the website and a short list of ports. Each query is logged with its date and source.
3. Review and PDF
A person reviews every finding before it goes into the report. You receive the PDF.
Explore an example
Choose a block to see what the assessment finds. Example with a fictitious domain.
The map shows the six blocks we analyse. Each one gets a status (correct, attention or critical) and a concrete recommendation.
Further down, the same example in report format.
What the report looks like
Each block gets a status and a recommendation. This is an example with a fictitious domain.
SPF is correct. DMARC only observes (p=none): fake emails using the company name keep reaching clients and suppliers. DKIM was not confirmed.
Recommendation: Move DMARC to quarantine after a monitoring phase.
Website and certificates
The certificate is valid and expires in 41 days. HTTPS is active. Two security headers are missing: Content-Security-Policy and Permissions-Policy.
Recommendation: Renew the certificate before it expires and add the two headers.
Exposed software
The server shows neither the PHP version nor the web server version.
Recommendation: No action needed.
Ports and services
Port 3389 (remote desktop) answers from the internet. Anyone can try to guess access passwords.
Recommendation: Close the port or route remote access through a VPN.
Data leaks
Two company email addresses appear in a known 2023 leak, masked in the report as j***@example-company.pt.
Recommendation: Ask for those account passwords to be changed and enable two-step authentication.
Digital footprint
We found three subdomains in the issued certificates and the client knows all of them.
Recommendation: No action needed.
What we analyse
SPF, DKIM and DMARC: who can send email on behalf of the company.
Website and certificates
Validity, TLS version, HTTPS and security headers.
Exposed software
Versions visible from outside, such as the PHP version.
Ports and services
15 common ports, only on the addresses the client confirms.
Data leaks
Company emails found in known leaks, masked in the report.
Digital footprint
Forgotten subdomains, found through issued certificates.
Frequently asked questions
What is the external cybersecurity assessment?
It is an analysis of public information about a company's domain: email (SPF, DKIM and DMARC), website and certificates, visible software, open ports, known data leaks and subdomains. The result is a short PDF with the risks visible from the internet.
How much does the external assessment cost?
The price is agreed in the first contact, before we start. Request a proposal.
Does the external assessment touch our systems?
No. We look only at public information about the authorised domain, such as DNS records, certificates and ports that answer from the internet. We do not log in, we do not test passwords and we change nothing.
Do we need to sign anything?
Yes. Before we start we sign an authorisation with the domain and the period of the check. Without it, the assessment does not run.
How long do you keep the assessment data?
The query records and the report are kept for 12 months.
Does an external assessment replace a penetration test?
No. It shows what is visible from outside and where to start. A penetration test is a different job, with a different scope.
Request the external assessment
Prefer to talk first? The free 30-minute assessment call by video is still available.
Updated on 3 November 2026.