Exposed services and open ports
Remote desktop, databases, admin panels and file shares that should never face the internet — and often do, left over from a one-off job nobody closed down.
Managed Services
Know what an attacker can see before they do
Every business has an outside: the domains, mail servers, remote-access ports and forgotten test sites that anyone on the internet can reach. Attackers map it for free. External Attack Surface Monitoring from Defined Complex Solutions maps it for you first — a scan within 24 hours, a plain-English report every month, and a same-day alert when something critical appears. Fixed monthly price, no agents to install, nothing to run.
What we check
Six things an attacker looks for in the first ten minutes
We look from the outside in, the way an attacker does — no credentials, no software on your machines, nothing intrusive. Just what your business exposes to the internet and whether it should.
Forgotten subdomains
Old staging sites, a supplier's abandoned portal, a DNS record pointing at a server you cancelled years ago. Each is a way in, and each is invisible until someone enumerates your domain.
TLS and certificate health
Expiring certificates, weak protocols and mismatched names. The first thing a customer sees when it goes wrong is a browser warning with your company name on it.
Email spoofing protection
SPF, DKIM and DMARC, checked and explained. Without all three set correctly, anyone can send invoices from your domain — and the email your customers trust most is the one that reaches them in your name.
Known vulnerabilities on exposed services
Software versions matched against published vulnerabilities. A VPN appliance or web server one patch behind is the most common way an SMB gets in the news.
Leaked staff credentials
Staff email addresses found in public data breaches, so you know which passwords to reset before someone tries them against your Microsoft 365 login.
How it works
From sign-up to first report in a day
Nothing to install and nobody to train. You confirm what is yours; we do the rest.
Confirm your domains
You tell us the domains and IP addresses you own or control, and confirm we have your authority to scan them. That is the whole onboarding.
First scan within 24 hours
We map everything reachable from the internet and send your first report, with every finding explained in plain terms and ranked by how much it matters.
Monthly branded report
Every month you get a report under your company name showing what is new, what has been fixed and what is unchanged — one you can hand to a director, an insurer or an auditor.
Weekly re-check and alerts
We re-check every week between reports. Anything critical — a newly exposed port, an expiring certificate, a leaked credential — gets a same-day alert, not a line in next month's PDF.
Plans
Fixed monthly price, cancel any time
All prices exclude VAT. Monthly subscription by Direct Debit, no minimum term, 30 days' notice to cancel.
Starter
£49 a month, ex VAT
- 1 domain
- Up to 5 IP addresses
- Monthly branded report
- Weekly re-check
Business
£99 a month, ex VAT
- 3 domains
- Up to 20 IP addresses
- Monthly branded report
- Weekly re-check with same-day alerting
Pro
£199 a month, ex VAT
- 10 domains
- Up to 50 IP addresses
- Monthly branded report
- Weekly re-check with same-day alerting
- Quarterly 30-minute review call
By subscribing you confirm you own or control the domains and IPs you submit and agree to our scanning terms.
Not ready for a subscription?
Single scan and report, £149 ex VAT. Same checks, same report, no commitment.
Sample report
See exactly what you would get
No marketing mock-up. This is a real report from our own scanner, anonymised, in the format every subscriber receives each month: findings ranked by severity, each one explained in plain English with the fix alongside it.
Sample report on request
The monthly report as a PDF — what we check, how findings are ranked, and what "fixed" and "unchanged" look like from one month to the next. Ask and we'll send you an anonymised copy.
Request a Sample Report
Ask a question
Tell us your domain and we'll tell you what we see
Not sure which plan fits, or want to know what an attacker sees right now? Send your domain and an engineer will reply — no sales script.
Want the full picture, not just the outside?
External monitoring tells you what the internet can see. A technical review covers the rest — devices, Microsoft 365, backups and network — and gives you a written plan, whether or not you go ahead with DCS.