See your website the way an attacker would.
ISA checks the websites, domains and servers you own, scores the result with a published formula, and tells you what to fix first in plain language. Technical evidence sits one click away for your IT team.
- HTTPS & TLS 20% 82
- Security headers 15% 54
- DNS 15% 90
- Email security 15% 61
- Network exposure 20% 70
- Web technologies 15% 88
Example only. Each arc is a category; its length is the category's weight and its fill is that category's score. The dotted ring shows how much of the assessment was completed.
What a scan checks
ISA combines established open-source techniques rather than inventing its own scanner. It inspects public configuration only: no exploitation, password guessing or load testing.
Website & HTTPS
HTTPS availability, redirects, mixed content and insecure references
HTTP security headers
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookies
SSL/TLS certificate
Certificate validity, chain, hostname, key strength and protocol support
DNS configuration
A/AAAA/MX/TXT/NS/SOA/CAA records, nameserver redundancy, DNSSEC
Email authentication
SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT
Network exposure (Nmap)
Bounded TCP connect scan of an approved port list
Technology fingerprint
Web server, language and framework identification from public responses
CMS detection
WordPress, Joomla, Drupal and Magento detection and hardening checks
From sign-up to a fix list
Authorization comes first. ISA will not scan anything until you prove you control it, and that proof covers only the exact host you verified.
Register an asset
A website, domain, server, public IP or email domain belonging to your organization.
Prove you control it
Add a DNS record or a small file on your site. An administrator can review signed permission instead.
Run a scan
Quick, Standard or Custom. Background workers do the checks and report progress live.
Fix and recheck
Track each finding to resolution, then recheck to confirm the problem is gone.
Built to be trusted
Security tools are targets too. ISA applies to itself the controls it recommends to you.
Deterministic scoring
The same evidence always gives the same score. Coverage is shown separately, so a partial scan never looks perfect.
AI that explains, never decides
Connect Gemini, OpenAI or Claude for plain-language explanations. Data is redacted first, and the score never depends on it.
Hardened by default
Strict CSP, CSRF tokens, Argon2id passwords, optional two-step sign-in, rate limits and a full audit trail.
Reports for two audiences
Executive PDFs for owners, technical PDFs with evidence and server configuration for IT.