How do you look from outside? We know.
Online, your company shows more than you think: email, website, certificates, services anyone can reach. We check it the way someone looking for a weak spot would, without touching your systems. Then we tell you how to close every gap, in order of priority and in plain language.
The email check is free, takes ten seconds and needs no sign-up.
- SPF~all, not strictMedium
- DMARCmissingHigh
- HTTPS certificatevalidOk
- Remote desktopport 3389 openHigh
- Public subdomains12 foundInfo
3 issues to fix. Two are serious: anyone can send email in the company’s name, and remote access is visible from the internet.
- 10 seconds
- to find out whether someone can send email in your name
- Zero access
- to your systems for the assessment: we only use public data
- 3 days
- working days to receive the full report
- A to F
- a grade you can read without an IT person
Can someone send email in your name?
Type your company’s domain. In ten seconds we read the public records that protect your email: SPF, DMARC and MX.
The lookup runs from your browser, through Cloudflare’s public DNS. Nothing is stored.
Nobody picks you. They find you.
Attacks come from automated programs that try every address, one after another, from anywhere in the world. They don’t look at your turnover: they look for an open door.
“We’re too small for anyone to care.”
To an automated program there are no small companies, only open doors. And small companies are the least watched.
“We already have antivirus and an IT person.”
Good: they protect your computers from the inside. We look at what can be seen from the outside. Two different jobs, and you need both.
“NIS2 doesn’t apply to us.”
Maybe not directly. But if you work for companies it does apply to, sooner or later they will ask you for guarantees: the law requires them to look after their suppliers’ security.
The lines on the globe are an illustration, not real attack data.
How we work.
Four steps. Each one is declared to you in advance, in writing.
We look from the outside
We only read public information: DNS, certificates, reachable services, data breach archives. Just as an attacker would, without touching anything.
scan example-srl.itdns14 records readcertificates3 foundservices5 reachable from the internetdata breach1 public archiveno access to company systemsWe give you a grade and priorities
A grade from A to F, issues ranked by severity and, for each one, what to do. In plain language, ready to hand to your IT person.
- DMARC missing
- Remote desktop open to the internet
- SPF not strict
The three glowing points in the disc are these three issues.
We test, only with your signature
If you want to go deeper, we actually test the weak points. Never before a written, signed authorisation.
Authorisation for active testing Signed by the legal representative. Scope, times and contacts agreed.We stay on watch
We alert you when something changes: a certificate about to expire, a newly exposed service, a new data breach involving your website.
- DMARC on: forged emails are rejected
- Remote desktop closed
- SPF strict: only your servers send mail
- New alert: the HTTPS certificate expires in 14 days
The three points turn green. From here on, we keep an eye on them.
The report you receive.
Written for the people who run the company, with evidence for the people who manage its IT.
Priority 1: turn on DMARC
Today anyone can send emails that look like yours: fake invoices to customers, payment requests to suppliers. One DNS record fixes it, in an afternoon.
What’s inside
- The overall grade and the score by area
- Every issue with its severity and fix
- What an attacker saw, with evidence
- A PDF to hand to your IT person
NIS2: find out in two minutes whether it applies to you.
The EU NIS2 directive, implemented in Italy by Legislative Decree 138/2024, requires companies in many sectors to manage cyber security. And to look after their suppliers’ security too.
- €10 million
- or 2% of total worldwide annual turnover, whichever is higher: the maximum fine for essential entities. For important entities, €7 million or 1.4%.
- 24 hours
- to send an early warning to CSIRT Italia after becoming aware of a significant incident. The full notification within 72 hours.
- Personally
- management bodies approve the security measures and are liable for breaches.
Source: Legislative Decree no. 138 of 4 September 2024, arts. 23, 24, 25 and 38.
A typical scenario: 90 days to answer your customer.
A 25-person company makes components for a customer that falls under NIS2 and is now asking its suppliers for guarantees. Illustrative example, not a real case.
- Day 1Passive assessmentReport with grade and priorities.
- Week 2Urgent fixesEmail protected, exposed services closed, certificates in order.
- Month 1In-depth analysisWith signed authorisation: exposed services and real weak points.
- Month 3Documents for the customerMeasures adopted, incident procedure, improvement plan.
- ThenContinuous monitoringAlerts when something changes, periodic reports.
Who is behind Resilience Z.
A Cybersecurity Analyst and Penetration Tester. Our job is to look at companies the way attackers do, and close the doors before anyone opens them. No products to sell you, no off-the-shelf packages: only what your company needs.
Based in Monza, working remotely with clients across Italy.
Our commitments
- Never an active test without your signed authorisation.
- What we do and what it costs, in writing and before we start.
- Plain language, not tech jargon.
Frequently asked questions.
Is it legal to analyse my company?
Yes. The first assessment uses only public information, the same anyone on the internet can see. Active tests happen only after a written authorisation signed by you.
Do you need to install anything or get into our computers?
No. For the assessment and the report, your domain name is all we need.
How much does it cost?
It depends on what you need and how big your company is. The email check here on the site is always free. For everything else we tell you first, in writing, what we will do and what it costs: nothing starts without your go-ahead.
What happens after I get in touch?
We get back to you to understand what you need: your domain, how many people you are, whether a customer is asking for guarantees. Then you receive a written proposal with what we will do, how long it takes and the price. No obligation.
How long does the report take?
You receive it within 3 working days of the go-ahead.
Will you slow down our staff?
No. The assessment does not touch your systems. For the in-depth analysis we agree times and scope together.
See your company from the outside. Before anyone else does.
Tell us about your company: we’ll tell you what we can do and what it costs, in writing and with no obligation. The report arrives within 3 working days of the go-ahead.