An outside-in first look, before the engagement
Before a scope, a contract or any authorisation, you can still see what a company publishes about itself. Hookgap turns that into a short, accurate report you can share.
What a passive check can tell you
Without touching a single system you can learn a lot about an organisation's security habits: whether its email domain can be spoofed, whether mail to it is protected in transit, how its certificates are issued and renewed, whether its website sends modern security headers, and whether its domain is locked at the registrar. Weak basics in public usually predict weak basics inside.
How security consultants use it
- Pre-sales: open with a concrete, verifiable observation instead of a generic capabilities deck.
- Scoping: an F on email authentication and an A on the website tells you where the first phase of work belongs.
- Supplier and portfolio reviews: bulk-check a client's suppliers or a portfolio of companies and sort by grade. Each subdomain is checked on its own.
- Ongoing assurance: watch domains weekly and get an alert in Slack, Teams or Discord when a DMARC policy is weakened or a certificate is about to lapse.
Exactly what is in scope
DNS lookups through a public resolver, public certificate transparency logs, the public registration database (RDAP), and one request each to the homepage, security.txt and, where announced, the MTA-STS policy file. No port scans, no login attempts, no vulnerability probes, no crawling. The full list is on how a check works, and our crawler is documented on the HookgapBot page.
Because it is passive, Hookgap does not replace an authorised assessment. It is the step before one. What you can check before a prospect says yes explains where the line sits.
Language that keeps trust
Reports never say "hacked", "breached" or "vulnerable". They describe what is publicly visible and why it matters, which is what a cautious buyer wants to hear from a security adviser.
Frequently asked questions
Do I need permission to run a Hookgap check?
Hookgap only reads information that is public by design, the same data any mail server or browser uses. It does not test or access systems. Follow the laws and contracts that apply to you, and treat it as reconnaissance, not an assessment.
Does Hookgap find software vulnerabilities?
No. It flags software versions a website advertises publicly, because that is easy to fix, but it never tests whether those versions are exploitable.
Can I check a list of suppliers at once?
Yes. Paste domains or upload a CSV on a paid plan: up to 50 at once on Solo and 200 on Team, with a CSV export of every result.
Related guides
passive security assessment
Passive security assessments: what you can check before a prospect says yesWhere the line sits between reading public data and testing someone's systems, and what you learn from staying on the right side of it.
Guide
Domain and DNS security checklist for small businessesTwelve checks that keep a business's domain, website and email in the right hands, in the order an MSP should work through them.
Guide
Website security headers explained for small business sitesEach header in plain English, a safe starting value, how to add it on common hosts, and how to avoid breaking the site.
Check the first prospect on your list.
Three free checks a day without an account. Sign in to brand reports, save them and watch domains weekly.
Get started