Baklyset Assurance · Your security, seen from outside
Your domains, certificates, mail and suppliers are the first thing others see of you, and the first thing an attacker tries. We find them, watch them every day and tell you what to fix first. An overview, not vulnerability scanning.
Why it matters
Most organisations have more domains and services on the internet than anyone has a complete picture of. Much of it was set up years ago, by people who have since moved on.
Before anyone tries a password, they look at what you publish: a forgotten subdomain, an expired certificate, mail that can be sent in your name, an admin page that should never have been public.
A domain registration lapses on a Tuesday. A certificate expires on a Saturday. A cloud service is deleted while its DNS record still points at it, and someone else claims the name. None of this can wait for the next audit.
NIS2 and the Norwegian Digital Security Act require you to manage the risk, including in your supply chain, and to be able to demonstrate it. A spreadsheet of good intentions is not evidence.
What you get
Every domain and subdomain, what each is for, who owns it and what it actually does. More than 50 checks cover mail security, certificates and TLS, DNSSEC, open zone transfers, registrar lock and expiry, takeover risks, internal server names in public DNS and outdated software. A customer portal and a domain that only redirects are held to different requirements.
We keep looking for domains you have forgotten, in public certificate logs, passive DNS and web archives. You see what we found and why, and you decide. Nothing is added or scanned until you approve it.
Every finding states what was seen, why it matters and which record or setting to change. Priorities is the week's worklist: the risks that undo other work at the top (the lapsing registration, the domain someone else can take over, the password in a web page), then overdue requests and what is most worth doing next.
Most fixes are made by someone else: the DNS operator, the registrar, the mail platform or the web agency. Change requests groups the findings by supplier, with the steps, what can go wrong and how to roll the change back. Enter the address and press Send: the request goes out with a PDF, replies come to you, and it is followed up against the due date you set, with a reminder in one click.
Where each certificate is used, which domains it covers, how far a wildcard reaches, when it expires and whether the authority has revoked it. Certificates renewed manually are flagged earlier than automated ones, because they need a person and a purchase. You also see certificates issued in your name by an authority you do not use.
The companies you depend on for mail, hosting, CDN, SaaS and certificates, read from your own public records. For each supplier you see the country in which it is established, whether US law can reach your data, which domains it operates for you and what is exposed there. A starting point for every supplier and transfer assessment.
The ten measures of NIS2 Article 21(2), each with what the external view provides as evidence. 39 questions guide you through what only you can answer: who is responsible, how it is done and the document that proves it. Where your answers and the evidence disagree, you see it before the auditor does. NSM's basic principles for ICT security work the same way, and both can be exported as an editable Word report in one click.
One digest per scan, only when something is new or has a deadline, by e-mail or in Teams or Slack. Each owner sees their own domains; the security team sees everything. You see what was fixed and what is new, how long each problem has been open and the trend week by week, and every decision is recorded in an audit log you can download.
Whether your domains appear in breach catalogues, and how many infected machines with saved credentials for your services appear in infostealer logs. We look up the domain only, never an individual. You also see the e-mail addresses your websites publish, and your own IP ranges with the open ports and known vulnerabilities already on public record. We look them up; we do not scan them.
See it
The screenshots show the demonstration: a fictional group of companies with 227 domains and six months of history.
A score for the whole estate, the trend week by week and what expires soon. One page to show management.
What to do first is at the top, each item with its status: not sent, sent and due, or overdue by a number of days. Below it, the change requests that are overdue.
Open a finding to see what was seen, why it matters and what to change. Similar findings are grouped, so 28 domains without DMARC become one task, not 28.
One e-mail per supplier, written for you, with a PDF. The next scan shows whether the job was done.
Every certificate with the days remaining, whether it renews automatically or manually, and where each one is installed. Manual renewals are flagged earlier.
Who you depend on, where they are established and whether US law can reach your data. Each supplier has its own page with the domains it runs for you.
Everything works on a phone as well.
Principles
Many tools turn a few external checks into a green tick for “compliant”. We do not. A failing check is evidence of a gap; a clean check means only that no gap can be seen from outside. You get findings you can defend before an auditor. It is a tool for overview and order, not a replacement for vulnerability scanning or penetration testing.
A firewall or WAF may block anything that looks like a scanner, including us. We do not try to get around it. You are told about the block instead of being given a grade, because what we see behind a block is rarely what the site actually serves. A timeout is “could not tell”, not “down”. And a DNS record anyone can take over is kept distinct from a stale one nobody can use.
Everything is observed from the outside, the way an attacker sees you. We hold no passwords and no DNS or registrar access, and we change nothing. Deeper checks, such as looking for exposed paths and ports, stay off until you switch them on, and the data processing agreement records this.
A security tool reads what attackers control: web pages, certificates and DNS. Ours treats all of it as hostile. The scanner never connects to internal addresses, reads only a bounded amount of any response and takes screenshots in a browser sealed off from your data.
Every customer has its own instance: its own database, its own process, its own sign-in. Data is stored in Norway, and e-mail is sent from France. The exception is the optional AI features: they are off until you switch them on, and then excerpts go to Anthropic (Claude) and supplier names to Brave Search in the US. Everyone signs in with a passkey or two-factor authentication, or with your own single sign-on by agreement. Everything is backed up nightly to a separate site.
The checks are the same ones Baklyset uses in external security audits for clients. The difference is that they now run every day.
Who it is for
Getting started
We go through it together and confirm that the domains are yours. You get named user accounts, each with the access its holder needs.
Every domain is checked, forgotten domains are suggested, suppliers are mapped and findings are ranked by urgency.
A nightly watch on everything with a deadline, a full scan every month, alerts when something needs a person, and a trend you can report on.
Questions
No. Everything is read from what your domains publish to the internet. We hold no passwords and have no access to your DNS, registrar or internal systems.
No more than a visitor would. By default each domain receives some DNS lookups, a few TLS connections and a handful of ordinary web requests. Nothing is submitted, logged into or guessed. Requests come from a fixed address and identify themselves, so your operations team can recognise them.
No, and be wary of anything that claims to do so from an external check alone. We show what the external view provides as evidence, collect what only you can answer, and make the gaps and contradictions visible, so that you can document the work to regulators and auditors.
In Norway, in a separate instance for each customer. Alert e-mails and change requests are sent through a mail service in France (Scaleway), so customer data stays in Norway and the EEA. The data processing agreement states this and lists every service we query. You get the data processing agreement and a description of our security measures, including what is not yet in place.
Only if you want it. The features that use AI are off until you switch them on in Settings, after which excerpts go to Anthropic (Claude) in the US. Without them, everything still works: findings, priorities, summaries and reports are written by the service itself.
No. It gives an overview of everything you have online and what should be tidied up, seen from the outside. It does not test your systems from the inside, and it does not find software vulnerabilities the way a vulnerability scanner or a penetration test does. Use it alongside them, not instead of them.
Not without your agreement. Looking for paths that should not be public and testing a few administration and database ports are off by default, and are switched on only once you have agreed in writing. It is not a penetration test: nothing is exploited and nothing is logged into.
Yes. The demonstration runs the full product on a fictional group of companies with 227 domains and six months of history. Get in touch and we will show it to you.
Get in touch, and we will work it out together.
Send us an e-mail with your primary domain and we will take it from there. You do not need to grant us access to anything or install anything.
or write to post@baklyset.no
