Know exactly where you stand. Every month.
Automated vulnerability scanning that catches misconfigurations, outdated software, and known security flaws before attackers do. Every report starts with a clear security score so you can see at a glance where you stand.
New Vulnerabilities Don't Wait for Monthly Scans. Neither Do We.
Every day, security researchers publish new vulnerabilities. A critical flaw in your web server software could be disclosed on a Tuesday and exploited by Thursday. With monthly-only scanning, you wouldn't know until the end of the month. Shield includes daily automated checks against over 8,000 vulnerability templates, updated continuously from public security advisories. If a new CVE affects something you're running, we detect it within 24 hours, not 30 days.
Real-time template updates
Our vulnerability templates are updated daily from public advisories, security research, and CVE databases. When a new exploit is published, we're checking for it the next morning.
Smart, not noisy
Daily checks are lightweight and targeted, they won't affect your server performance. We only alert on confirmed matches, not theoretical risks.
Immediate escalation
If a daily check finds a Critical or High severity issue, it feeds directly into your next report. For Sentinel and Citadel clients, you get an immediate email alert.
Real-time template updates
Our vulnerability templates are updated daily from public advisories, security research, and CVE databases. When a new exploit is published, we're checking for it the next morning.
Smart, not noisy
Daily checks are lightweight and targeted, they won't affect your server performance. We only alert on confirmed matches, not theoretical risks.
Immediate escalation
If a daily check finds a Critical or High severity issue, it feeds directly into your next report. For Sentinel and Citadel clients, you get an immediate email alert.
Real-time template updates
Our vulnerability templates are updated daily from public advisories, security research, and CVE databases. When a new exploit is published, we're checking for it the next morning.
Smart, not noisy
Daily checks are lightweight and targeted, they won't affect your server performance. We only alert on confirmed matches, not theoretical risks.
Immediate escalation
If a daily check finds a Critical or High severity issue, it feeds directly into your next report. For Sentinel and Citadel clients, you get an immediate email alert.
Network and infrastructure scanning
We scan every public-facing IP address you give us, testing against a database of over 100,000 known vulnerabilities updated daily. If there's a published exploit for something you're running, we'll find it.
Known vulnerabilities (CVEs)
We check your systems against a database of over 100,000 known vulnerabilities, updated daily. If there's a published exploit for something you're running, we'll find it.
Open ports and exposed services
Every open port is a potential entry point. We map all accessible services and flag anything that shouldn't be public-facing: databases, admin panels, file shares, development tools.
Outdated software
Running an old version of Apache, Nginx, OpenSSH, or PHP? We detect version numbers and flag anything with known security issues.
Default and weak credentials
We test for default passwords on common services: admin panels, databases, FTP servers, SNMP community strings, and management interfaces.
SSL/TLS configuration
We assess your encryption setup: protocol versions (flagging insecure SSLv3, TLS 1.0, TLS 1.1), cipher suite strength, certificate validity, chain of trust, and HSTS configuration.
Email security
We check your domain's SPF, DKIM, and DMARC records to see if attackers could spoof emails from your domain. Missing or misconfigured records are a common phishing enabler.
DNS configuration
We check for DNS zone transfer vulnerabilities, DNSSEC status, and dangling DNS records that could be hijacked.
Network misconfigurations
SNMP exposure, open relays, unnecessary services, verbose error messages, and other configuration weaknesses that give attackers a foothold.
Known vulnerabilities (CVEs)
We check your systems against a database of over 100,000 known vulnerabilities, updated daily. If there's a published exploit for something you're running, we'll find it.
Open ports and exposed services
Every open port is a potential entry point. We map all accessible services and flag anything that shouldn't be public-facing: databases, admin panels, file shares, development tools.
Outdated software
Running an old version of Apache, Nginx, OpenSSH, or PHP? We detect version numbers and flag anything with known security issues.
Default and weak credentials
We test for default passwords on common services: admin panels, databases, FTP servers, SNMP community strings, and management interfaces.
SSL/TLS configuration
We assess your encryption setup: protocol versions (flagging insecure SSLv3, TLS 1.0, TLS 1.1), cipher suite strength, certificate validity, chain of trust, and HSTS configuration.
Email security
We check your domain's SPF, DKIM, and DMARC records to see if attackers could spoof emails from your domain. Missing or misconfigured records are a common phishing enabler.
DNS configuration
We check for DNS zone transfer vulnerabilities, DNSSEC status, and dangling DNS records that could be hijacked.
Network misconfigurations
SNMP exposure, open relays, unnecessary services, verbose error messages, and other configuration weaknesses that give attackers a foothold.
Known vulnerabilities (CVEs)
We check your systems against a database of over 100,000 known vulnerabilities, updated daily. If there's a published exploit for something you're running, we'll find it.
Open ports and exposed services
Every open port is a potential entry point. We map all accessible services and flag anything that shouldn't be public-facing: databases, admin panels, file shares, development tools.
Outdated software
Running an old version of Apache, Nginx, OpenSSH, or PHP? We detect version numbers and flag anything with known security issues.
Default and weak credentials
We test for default passwords on common services: admin panels, databases, FTP servers, SNMP community strings, and management interfaces.
SSL/TLS configuration
We assess your encryption setup: protocol versions (flagging insecure SSLv3, TLS 1.0, TLS 1.1), cipher suite strength, certificate validity, chain of trust, and HSTS configuration.
Email security
We check your domain's SPF, DKIM, and DMARC records to see if attackers could spoof emails from your domain. Missing or misconfigured records are a common phishing enabler.
DNS configuration
We check for DNS zone transfer vulnerabilities, DNSSEC status, and dangling DNS records that could be hijacked.
Network misconfigurations
SNMP exposure, open relays, unnecessary services, verbose error messages, and other configuration weaknesses that give attackers a foothold.
OWASP Top 10 web application assessment
If you have a website or web application, we test it against the OWASP Top 10 - the industry-standard list of the most critical web security risks.
Injection attacks
SQL injection, command injection, LDAP injection, and XPath injection. If your application passes user input to a database or system command without proper validation, we'll flag it.
Cross-site scripting (XSS)
Reflected and stored XSS vulnerabilities that could allow attackers to inject malicious scripts into your web pages, stealing user sessions or redirecting visitors.
Broken authentication
Default credentials on login pages, weak session management, missing account lockout after failed attempts, and exposed admin panels.
Security headers
We check for the presence and correct configuration of Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Information disclosure
Server version headers, framework fingerprinting, directory listing, exposed backup files (.bak, .old, .sql), and accidentally public configuration files (.git, .env, .htaccess, web.config).
Cookie security
We verify that session cookies have the Secure, HttpOnly, and SameSite flags set correctly to prevent interception and cross-site attacks.
Cross-site request forgery (CSRF)
We check that your forms include anti-CSRF tokens to prevent attackers from tricking users into performing unintended actions.
Misconfigurations
CORS policy issues, dangerous HTTP methods enabled (PUT, DELETE, TRACE), sensitive paths exposed in robots.txt, and insecure file upload handling.
Injection attacks
SQL injection, command injection, LDAP injection, and XPath injection. If your application passes user input to a database or system command without proper validation, we'll flag it.
Cross-site scripting (XSS)
Reflected and stored XSS vulnerabilities that could allow attackers to inject malicious scripts into your web pages, stealing user sessions or redirecting visitors.
Broken authentication
Default credentials on login pages, weak session management, missing account lockout after failed attempts, and exposed admin panels.
Security headers
We check for the presence and correct configuration of Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Information disclosure
Server version headers, framework fingerprinting, directory listing, exposed backup files (.bak, .old, .sql), and accidentally public configuration files (.git, .env, .htaccess, web.config).
Cookie security
We verify that session cookies have the Secure, HttpOnly, and SameSite flags set correctly to prevent interception and cross-site attacks.
Cross-site request forgery (CSRF)
We check that your forms include anti-CSRF tokens to prevent attackers from tricking users into performing unintended actions.
Misconfigurations
CORS policy issues, dangerous HTTP methods enabled (PUT, DELETE, TRACE), sensitive paths exposed in robots.txt, and insecure file upload handling.
Injection attacks
SQL injection, command injection, LDAP injection, and XPath injection. If your application passes user input to a database or system command without proper validation, we'll flag it.
Cross-site scripting (XSS)
Reflected and stored XSS vulnerabilities that could allow attackers to inject malicious scripts into your web pages, stealing user sessions or redirecting visitors.
Broken authentication
Default credentials on login pages, weak session management, missing account lockout after failed attempts, and exposed admin panels.
Security headers
We check for the presence and correct configuration of Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Information disclosure
Server version headers, framework fingerprinting, directory listing, exposed backup files (.bak, .old, .sql), and accidentally public configuration files (.git, .env, .htaccess, web.config).
Cookie security
We verify that session cookies have the Secure, HttpOnly, and SameSite flags set correctly to prevent interception and cross-site attacks.
Cross-site request forgery (CSRF)
We check that your forms include anti-CSRF tokens to prevent attackers from tricking users into performing unintended actions.
Misconfigurations
CORS policy issues, dangerous HTTP methods enabled (PUT, DELETE, TRACE), sensitive paths exposed in robots.txt, and insecure file upload handling.
Certificate Monitoring, Asset Discovery, and Intelligent Reporting
SSL Certificate Alerts
Automatic alerts at 30, 14, and 7 days before any certificate expires. No more surprise outages.
Certificate Chain Validation
We verify your chain is complete and trusted, flagging self-signed certs, missing intermediates, and revoked certificates.
Asset Discovery
We flag any services, ports, or applications discovered that weren't in the agreed scope. Shadow IT identification included.
Security Score (A-F)
Every report starts with a clear grade. Boards and management teams understand A-F without needing CVSS explained.
Professional PDF Report
Executive summary on page one, technical detail behind it. Readable by both technical and non-technical audiences.
Prioritised Remediation
Every finding comes with specific, actionable guidance on how to fix it, ordered by severity.
Trend Tracking
From month two, every report shows how your security posture is changing: new vulnerabilities, resolved issues, recurring problems.
Email Summary
A plain-text email alongside the PDF highlighting what's new, what's fixed, and what's still outstanding.
SSL Certificate Alerts
Automatic alerts at 30, 14, and 7 days before any certificate expires. No more surprise outages.
Certificate Chain Validation
We verify your chain is complete and trusted, flagging self-signed certs, missing intermediates, and revoked certificates.
Asset Discovery
We flag any services, ports, or applications discovered that weren't in the agreed scope. Shadow IT identification included.
Security Score (A-F)
Every report starts with a clear grade. Boards and management teams understand A-F without needing CVSS explained.
Professional PDF Report
Executive summary on page one, technical detail behind it. Readable by both technical and non-technical audiences.
Prioritised Remediation
Every finding comes with specific, actionable guidance on how to fix it, ordered by severity.
Trend Tracking
From month two, every report shows how your security posture is changing: new vulnerabilities, resolved issues, recurring problems.
Email Summary
A plain-text email alongside the PDF highlighting what's new, what's fixed, and what's still outstanding.
SSL Certificate Alerts
Automatic alerts at 30, 14, and 7 days before any certificate expires. No more surprise outages.
Certificate Chain Validation
We verify your chain is complete and trusted, flagging self-signed certs, missing intermediates, and revoked certificates.
Asset Discovery
We flag any services, ports, or applications discovered that weren't in the agreed scope. Shadow IT identification included.
Security Score (A-F)
Every report starts with a clear grade. Boards and management teams understand A-F without needing CVSS explained.
Professional PDF Report
Executive summary on page one, technical detail behind it. Readable by both technical and non-technical audiences.
Prioritised Remediation
Every finding comes with specific, actionable guidance on how to fix it, ordered by severity.
Trend Tracking
From month two, every report shows how your security posture is changing: new vulnerabilities, resolved issues, recurring problems.
Email Summary
A plain-text email alongside the PDF highlighting what's new, what's fixed, and what's still outstanding.
What's Included
Is Shield right for you?
Shield is for
- ✓Small businesses getting their first security assessment
- ✓Companies preparing for Cyber Essentials or ISO 27001 certification
- ✓Organisations needing evidence of regular security testing for client contracts
- ✓Businesses that have never had a vulnerability scan and want to understand their exposure
- ✓Anyone who wants a clear, daily-updated answer to: "Are we secure?"
Important to know
- →Shield is an automated vulnerability assessment, not a manual penetration test - we identify known weaknesses automatically, we don't attempt to exploit them manually
- →For continuous server monitoring, real-time threat detection, and configuration compliance checking, see Sentinel and Citadel
Shield is for
- ✓Small businesses getting their first security assessment
- ✓Companies preparing for Cyber Essentials or ISO 27001 certification
- ✓Organisations needing evidence of regular security testing for client contracts
- ✓Businesses that have never had a vulnerability scan and want to understand their exposure
- ✓Anyone who wants a clear, daily-updated answer to: "Are we secure?"
Important to know
- →Shield is an automated vulnerability assessment, not a manual penetration test - we identify known weaknesses automatically, we don't attempt to exploit them manually
- →For continuous server monitoring, real-time threat detection, and configuration compliance checking, see Sentinel and Citadel
Shield is for
- ✓Small businesses getting their first security assessment
- ✓Companies preparing for Cyber Essentials or ISO 27001 certification
- ✓Organisations needing evidence of regular security testing for client contracts
- ✓Businesses that have never had a vulnerability scan and want to understand their exposure
- ✓Anyone who wants a clear, daily-updated answer to: "Are we secure?"
Important to know
- →Shield is an automated vulnerability assessment, not a manual penetration test - we identify known weaknesses automatically, we don't attempt to exploit them manually
- →For continuous server monitoring, real-time threat detection, and configuration compliance checking, see Sentinel and Citadel
Up and running in 48 hours
No agents to install, no complex setup. Just tell us what to scan and we handle the rest.
Sign up and tell us what to scan
Fill in the form with your domain(s), IP addresses, and web application URLs. Pick Shield or whichever tier fits.
Verify your domain
We'll give you a short DNS TXT record to add to your domain. This confirms you own what you're asking us to test, standard practice, takes two minutes.
We configure your scans
Within 48 hours of payment and verification, your daily threat detection is live and your first full monthly scan is scheduled.
Your first report lands
Within 5 working days, you'll receive your first professional PDF report with your security score, findings by severity, and exactly what to fix first.
Ongoing protection
Daily checks run every night. Monthly full scans run automatically. Each report shows what's new, what's fixed, and how your score is trending.
Sign up and tell us what to scan
Fill in the form with your domain(s), IP addresses, and web application URLs. Pick Shield or whichever tier fits.
Verify your domain
We'll give you a short DNS TXT record to add to your domain. This confirms you own what you're asking us to test, standard practice, takes two minutes.
We configure your scans
Within 48 hours of payment and verification, your daily threat detection is live and your first full monthly scan is scheduled.
Your first report lands
Within 5 working days, you'll receive your first professional PDF report with your security score, findings by severity, and exactly what to fix first.
Ongoing protection
Daily checks run every night. Monthly full scans run automatically. Each report shows what's new, what's fixed, and how your score is trending.
Sign up and tell us what to scan
Fill in the form with your domain(s), IP addresses, and web application URLs. Pick Shield or whichever tier fits.
Verify your domain
We'll give you a short DNS TXT record to add to your domain. This confirms you own what you're asking us to test, standard practice, takes two minutes.
We configure your scans
Within 48 hours of payment and verification, your daily threat detection is live and your first full monthly scan is scheduled.
Your first report lands
Within 5 working days, you'll receive your first professional PDF report with your security score, findings by severity, and exactly what to fix first.
Ongoing protection
Daily checks run every night. Monthly full scans run automatically. Each report shows what's new, what's fixed, and how your score is trending.
A quick comparison
For anyone deciding between the three packages.
| Shield | Sentinel | Citadel | |
|---|---|---|---|
| Full scan frequency | Monthly | Monthly | Weekly |
| Daily threat detection | ✓ | ✓ | ✓ |
| Public-facing IPs | Up to 5 | Up to 10 | Up to 15 |
| Web applications | 1 | 1 | 3 |
| Endpoint monitoring | - | Up to 5 | Up to 10 |
| File integrity monitoring | - | ✓ | ✓ |
| Rootkit/malware detection | - | ✓ | ✓ |
| Log analysis | - | ✓ | ✓ |
| CIS benchmark assessment | - | ✓ | ✓ |
| Breach monitoring | - | - | ✓ |
| Threat briefing | - | - | Monthly |
| iSOS Verified badge | - | - | ✓ |
| Reporting | Monthly | Monthly | Weekly + Monthly |
| Immediate alerts | - | Critical/High | Critical/High |
| Priority support | - | - | Next business day |
| Price | £99/month | £229/month | £449/month |
All packages include daily threat detection and monthly reporting. Sentinel adds endpoint monitoring. Citadel adds weekly scanning, breach monitoring, threat intelligence, and the iSOS Verified badge.
| Shield | Sentinel | Citadel | |
|---|---|---|---|
| Full scan frequency | Monthly | Monthly | Weekly |
| Daily threat detection | ✓ | ✓ | ✓ |
| Public-facing IPs | Up to 5 | Up to 10 | Up to 15 |
| Web applications | 1 | 1 | 3 |
| Endpoint monitoring | - | Up to 5 | Up to 10 |
| File integrity monitoring | - | ✓ | ✓ |
| Rootkit/malware detection | - | ✓ | ✓ |
| Log analysis | - | ✓ | ✓ |
| CIS benchmark assessment | - | ✓ | ✓ |
| Breach monitoring | - | - | ✓ |
| Threat briefing | - | - | Monthly |
| iSOS Verified badge | - | - | ✓ |
| Reporting | Monthly | Monthly | Weekly + Monthly |
| Immediate alerts | - | Critical/High | Critical/High |
| Priority support | - | - | Next business day |
| Price | £99/month | £229/month | £449/month |
All packages include daily threat detection and monthly reporting. Sentinel adds endpoint monitoring. Citadel adds weekly scanning, breach monitoring, threat intelligence, and the iSOS Verified badge.
| Shield | Sentinel | Citadel | |
|---|---|---|---|
| Full scan frequency | Monthly | Monthly | Weekly |
| Daily threat detection | ✓ | ✓ | ✓ |
| Public-facing IPs | Up to 5 | Up to 10 | Up to 15 |
| Web applications | 1 | 1 | 3 |
| Endpoint monitoring | - | Up to 5 | Up to 10 |
| File integrity monitoring | - | ✓ | ✓ |
| Rootkit/malware detection | - | ✓ | ✓ |
| Log analysis | - | ✓ | ✓ |
| CIS benchmark assessment | - | ✓ | ✓ |
| Breach monitoring | - | - | ✓ |
| Threat briefing | - | - | Monthly |
| iSOS Verified badge | - | - | ✓ |
| Reporting | Monthly | Monthly | Weekly + Monthly |
| Immediate alerts | - | Critical/High | Critical/High |
| Priority support | - | - | Next business day |
| Price | £99/month | £229/month | £449/month |
All packages include daily threat detection and monthly reporting. Sentinel adds endpoint monitoring. Citadel adds weekly scanning, breach monitoring, threat intelligence, and the iSOS Verified badge.
Ready to strengthen your security?
Book a free, no-obligation consultation with our team. We'll discuss your concerns, assess your needs, and recommend the right level of protection.
Ready to strengthen your security?
Book a free, no-obligation consultation with our team. We'll discuss your concerns, assess your needs, and recommend the right level of protection.
Ready to strengthen your security?
Book a free, no-obligation consultation with our team. We'll discuss your concerns, assess your needs, and recommend the right level of protection.
What We Do
Tech Solutions for Tomorrow
Web Development
Having a website is no longer enough. Your custom site must be easily found, engaging, and deliver a clear message to your audience.
Read MoreClaris Databases
With over 400 custom Claris FileMaker databases delivered in 10 years, iSOS understands why organisations invest in new database software.
Read MoremacOS & Windows Support
We offer expert macOS and Windows support, ensuring your systems run smoothly and efficiently so you can focus on your business.
Read MoreReady to Elevate Your Digital Presence?
Don't get left behind
Ensure your business stays ahead with cutting-edge digital solutions. Contact us today to keep your company at the forefront of your industry and continue thriving.
Stay Connected with iSOS
At iSOS.com, we specialise in custom software development, web development, and IT consultancy, leveraging Claris FileMaker, Laravel, and AI technologies to create tailored digital solutions that enhance business efficiency and maximise ROI.
Copyright: © 2026 iSOS. All Rights Reserved.
What We Do
Tech Solutions for Tomorrow
Web Development
Having a website is no longer enough. Your custom site must be easily found, engaging, and deliver a clear message to your audience.
Read MoreClaris Databases
With over 400 custom Claris FileMaker databases delivered in 10 years, iSOS understands why organisations invest in new database software.
Read MoremacOS & Windows Support
We offer expert macOS and Windows support, ensuring your systems run smoothly and efficiently so you can focus on your business.
Read MoreReady to Elevate Your Digital Presence?
Don't get left behind
Ensure your business stays ahead with cutting-edge digital solutions. Contact us today to keep your company at the forefront of your industry and continue thriving.
Stay Connected with iSOS
At iSOS.com, we specialise in custom software development, web development, and IT consultancy, leveraging Claris FileMaker, Laravel, and AI technologies to create tailored digital solutions that enhance business efficiency and maximise ROI.
Copyright: © 2026 iSOS. All Rights Reserved.
What We Do
Tech Solutions for Tomorrow
Web Development
Having a website is no longer enough. Your custom site must be easily found, engaging, and deliver a clear message to your audience.
Read MoreClaris Databases
With over 400 custom Claris FileMaker databases delivered in 10 years, iSOS understands why organisations invest in new database software.
Read MoremacOS & Windows Support
We offer expert macOS and Windows support, ensuring your systems run smoothly and efficiently so you can focus on your business.
Read MoreReady to Elevate Your Digital Presence?
Don't get left behind
Ensure your business stays ahead with cutting-edge digital solutions. Contact us today to keep your company at the forefront of your industry and continue thriving.
Stay Connected with iSOS
At iSOS.com, we specialise in custom software development, web development, and IT consultancy, leveraging Claris FileMaker, Laravel, and AI technologies to create tailored digital solutions that enhance business efficiency and maximise ROI.
Copyright: © 2026 iSOS. All Rights Reserved.