Security Assessment for Prospects
Prepare a prospect conversation with a sourced security assessment, explicit unknowns, and a 30-minute first-meeting script.
Open the related path →PROSPECT · SOLUTION
External Attack Surface Review for MSPs
Use a passive external attack surface review to explain what a prospect publishes, what it means, and what it cannot prove.
Run a free domain scoreJoin Open BetaLast reviewed September 25, 2026.
An external attack surface review reads the public records and exposed signals that anyone can observe about a domain. SCOUTz turns those records into dated evidence for an MSP conversation, while keeping internal controls, compromise, and operational practice explicitly outside the public boundary.
SCOUTz keeps the source, timestamp, boundary, and next choice together. That makes the page useful to the seller, the owner, and the operator who receives the work after the meeting.
What does a passive external review check?
It checks published DNS, mail authentication, certificates, headers, exposed services, and related public signals. The public path uses 35 collectors and can reach 123 distinct finding types. It does not authenticate, exploit, or install anything.
The practical test is whether another person can understand the claim, identify its source, and decide what should happen next without treating an unknown as a pass.
What can a public record prove?
It can prove that a record or response was observable at a stated time. A DNS policy can support a question about mail handling. It cannot prove that a mailbox was compromised, that a policy is enforced everywhere, or that a business process is followed.
The practical test is whether another person can understand the claim, identify its source, and decide what should happen next without treating an unknown as a pass.
Why call it outside-in?
Because the evidence starts where an unauthenticated person can stand: outside the environment. That makes it useful before trust exists and makes its limitations easy to explain. Deeper answers require a different source and customer approval.
The practical test is whether another person can understand the claim, identify its source, and decide what should happen next without treating an unknown as a pass.
Evidence, support, and boundary
Evidence stateWhat it supportsBoundary
SPF, DKIM, and DMARC recordsPublished mail-authentication intentNot proof that every sender follows the intent
Certificate and transparency dataObserved certificate issuance and age contextNot proof of private-key control or compromise
Headers and exposed responsesA public response at a timestampNot proof of the internal service behind it
Worked example
A remote login page is indexed. That is a public exposure observation and a reason to ask who owns it. The report does not claim the page was breached, that credentials work, or that the system is unsafe inside.
This example is deliberately narrow. A finding can start a useful business conversation without proving a breach, a clean environment, a complete compliance program, or a commercial outcome. The report should say which of those statements it can support and which remain for the MSP and customer to establish.
How SCOUTz gets the MSP there
SCOUTz begins with the least intrusive source that can answer the question. The public domain layer dispatches 35 collectors and can reach 123 distinct finding types. When a customer approves the next step, the read-only cloud layer is a superset with 93 collectors and 370 reachable finding types. Platform-wide, 601 finding types across 91 emitting modules include fusion and correlation logic that runs on top of collector output.
Every finding carries authored business-language explanation, consequence, recommendation, and the evidence it came from. The ledger separates 440 scored findings, 107 context observations, and 22 declared non-reads. A check that could not be read appears as NOT ASSESSED THIS SCAN, so the next choice is visible instead of hidden inside a score.
The MSP still owns authorization, interpretation, customer communication, remediation, and the final commercial decision. SCOUTz supplies the record and the route. That boundary is what makes the output safe to use in a real relationship.
Frequently asked questions
What does SCOUTz actually read?
The public domain layer reads disclosed public records and signals. A customer-approved Microsoft 365 review reads supported configuration and metadata through a read-only connection. SCOUTz does not read messages, files, documents, chats, or prompts.
Does an unknown result count as clean?
No. A check that could not be read is declared as a non-read. It remains visible on the record and is not converted into a pass or a blended score.
Can an MSP use its own branding?
Yes. Client-safe output is designed for the MSP's name, logo, colors, contact details, and delivery motion while operator evidence remains available to the team doing the work.
What happens after the first result?
The MSP reviews the evidence, agrees the next action with the customer, performs the work through its own process, and uses a supported rescan or source refresh to show what changed.
Is an external attack surface review a penetration test?
No. SCOUTz performs bounded observation and analysis. It does not exploit a target, authenticate to a system, or claim that an observed surface proves current compromise.
Keep the evidence attached to the work.
Read the methodology, review the trust boundary, see the sample report, compare pricing, and run the public tools before you choose the next step.
RELATED SOLUTIONS
Security Discovery Questionnaire for MSPs
Use an evidence-first security discovery questionnaire with plain-language questions tied to observable states and unknowns.
Open the related path →SCOUTz OPEN BETA
Point SCOUTz at your next prospect. Walk in with a defensible answer.
Join Open Beta with a real MSP workflow. A person reviews every application before a workspace goes live. SCOUTz runs without an agent or install and never changes a configuration on its own.
SCOUTz prepares the conversation. The relationship and the sale stay yours.