How Blindspot Measures Public Exposure
You enter a domain. We read what is already published about it, confirm what we find, and turn it into a grade and a prioritized list.
We never log in, test a credential, install software, or enter a private network.
- No Login
- No Software
- No Network Access
- Public Records Only
- DNS recordspublic
- Certificate transparency logspublic
- Public web responsespublic
- Domain registrationpublic
- Breach and infostealer datasetslicensed
- Your systemsnever touched
We Observe the Door. We Do Not Open It.
Blindspot is passive by design and is not a penetration test. It reads what is already served publicly. If a check would need a password, credential testing, exploitation, or access to a private system, it is outside what Blindspot does.
That boundary is not evidence that a business is secure. It defines the question this scan answers, which is what someone can already discover from outside.
The Ten Things Blindspot Checks
Ten categories run on every scan. This is the production list, so a category appears here only because the scanner actually runs it.
- 01
Email authentication
Can someone send email that looks like it came from you?
Your customer gets a fake invoice and believes it.
- 02
DNS hygiene
Is the plumbing behind your domain set up correctly?
Mail and web traffic can be misrouted or quietly blocked.
- 03
Certificates
Is your site about to start warning visitors it is unsafe?
Visitors see a red warning and leave.
- 04
Breach exposure
Are staff addresses at your domain already in public breach data?
Old staff logins are circulating where anyone can take them.
- 05
Infostealer signals
Do credentials tied to your business appear in recent criminal data?
A computer in your office may already be infected.
- 06
Website privacy
Is your site sending visitor information somewhere it should not?
Your site tells advertisers who visited, and which pages.
- 07
Lookalike domains
Has someone registered a domain one character from yours?
Someone built a copy of your address to catch your mail.
- 08
Public discovery
What of yours is reachable from the open internet?
A login door is sitting open where anyone can find it.
- 09
Registration
Could your domain be lost or taken?
Your web address can expire or be transferred away.
- 10
Business details
What does your own site publish about where you are?
Your published address and location are readable by anyone.
Three Outcomes, and No Fourth
Pass
The check completed and the failing condition was not found.
It does not mean the business is secure. It means this one thing was fine when we looked.
Finding
The check completed and confirmed a condition that meets the published rule.
Every finding shows the evidence behind it and what it takes to fix.
Unavailable
The check could not produce a reliable answer.
Never converted into a pass. It is named in your result, excluded from the score, and it lowers confidence.
How a finding is confirmed depends on the check, and each has to hold up on its own terms before it ships. If it does not, you never see it.
How the Grade Is Calculated
Confirmed findings reduce the grade in proportion to how much they matter. Severity drives the deduction, and nothing is weighted in secret.
If a check cannot complete, it is left out of the score rather than counted in your favor, and the report says which one. A grade with checks missing covers less ground than the same grade with all of them.
Severity drives the deduction
- CriticalLargest deduction
- HighSubstantial
- MediumModerate
- LowSmall
- InformationalNone
What is left is your grade
- A90 and above
- B80 to 89
- C70 to 79
- D60 to 69
- FBelow 60
The score never goes below zero, and no single finding caps the grade on its own. Several findings in one category each take their own points, which is why a domain with three medium email problems can score lower than one with a single high one. The grade summarizes the findings. It does not replace reading them.
What Blindspot Never Does
This is the boundary, and it is not a policy we could quietly relax. It is what makes it possible to scan any business, for free, without asking anyone first.
No PasswordsWe never ask for one, never test one, and never show you one we found.
No LoginNothing is accessed. There is no account to create and nothing to authorize.
No SoftwareNothing is installed on your machines or your network.
No Network AccessWe never touch your systems. Every check reads a record that is already public.
Evidence, Data Handling, and Limits
Findings show their evidence, redacted where showing it in full would cause harm. A recovered password is never displayed, stored, or tested.
What it cannot tell you: whether your internal network is secure, whether staff would fall for a phishing message, whether you are compliant with any framework, or whether a finding has already been exploited. A clean grade means the public checks found nothing, and nothing more.
If you believe a finding is wrong, write to us and we will recheck it at no cost. A finding that cannot be reproduced is removed.
Method last reviewed 2026-08-24 against the production scanner. Changes to the check register, weights, or grade bands are reflected here in the same release.
Now See It on Your Own Domain
The method above, run against your business. Thirty seconds, no signup, no access required.
We only read public records. We never touch your computers and we never ask for a password.