14-day free trial · No credit card
See your company the way an attacker does — and fix it before they act.
One platform for attack-surface exposure, email and brand protection, data exposure and compliance readiness. Plain-English priorities for your leadership, exact fixes for your IT team, no agents to install.
- Passive checks only
- Never changes your systems
- Evidence for every finding
Check your business security free — right now
Enter your domain for an instant security check. No account, no credit card.
Built on open internet standards
- SPF
- DKIM
- DMARC
- TLS / HTTPS
- DNSSEC
- CAA
- HSTS & CSP
- security.txt
- OWASP guidance
- automated security checks
- 19automated security checks
- score categories, with published weights
- 7score categories, with published weights
- changes made to your systems — ever
- 0changes made to your systems — ever
- free trial, no card required
- 14 daysfree trial, no card required
See it in 88 seconds
From a free check to a 100 score
Test your business, understand the results, send the fixes to your IT team, and prove they worked.
Illustrative sample data for a fictional company, not a customer story. A score is an indicator based on the checks currently available, not a guarantee of security.
Read the steps instead
- Test your business: type your website address, no signup and nothing to install. About 30 seconds later you get a score out of 100.
- Understand the results: each finding says what it means for your business, in plain English, with the technical detail for your IT team.
- Send the fixes to your IT team: the assistant writes the message, including the exact DNS record to publish. You send it.
- Your IT team applies the fixes. PixelPrivate never changes your systems.
- Re-scan to verify: the score goes from 58 to 100 and no open issues are found.
- Stay protected: daily monitoring warns you when something changes, such as a look-alike domain.
Try the dashboard
Click through the product before you sign up
This is the real layout of the dashboard, filled with sample data so you can explore every view. Run the free check above to see your own.
Overview
example-company.com · last scan today
Security Score
+26 since July
8 open findings, 1 high.
Score over time
| Jul | 52 |
|---|---|
| Aug | 58 |
| Sep | 63 |
| Oct 1 | 71 |
| Oct 8 | 74 |
| Oct 15 | 78 |
Open findings by severity
- Critical0
- High1
- Medium3
- Low4
Score by category
- Domain92/100
- Email58/100
- Website66/100
- TLS96/100
- Config71/100
Sample data — run a free check to see your own. No real company or customer is shown.
What attackers see first
Your public footprint is the front door, and most of it is unattended
Before anyone targets a person, they look at what your domain tells the internet. PixelPrivate reads exactly that, the way an outsider would, and turns it into a short list you can act on.
Spoofable email
No enforced DMARC means forged mail can pass as yours.
Weak transport security
Missing HSTS or an expiring certificate erode customer trust quietly.
Reachable files
Backups or environment files left in a web folder can leak secrets.
Forgotten DNS
Old records and subdomains outlive the projects that created them.
Connect your company
Start from the outside. Add the inside when you are ready.
The outside-in scan needs only a domain. Read-only connectors add what an outside scan cannot see, such as who has no multi-factor sign-in.
Microsoft 365
NewMFA coverage and sign-in settings, read-only.
Google Workspace
RoadmapIdentity and sharing posture.
GitHub
RoadmapRepository and secret-scanning posture.
AWS
RoadmapCloud account configuration review.
Network sensor
RoadmapVisibility of devices on your office network.
Endpoint agent
RoadmapLaptop patching and disk encryption status.
Only Microsoft 365 is available today. Items marked Roadmap are planned, not shipped, and dates are not promised.
Outcome
What fixing the top three issues can do to your score
An illustration with sample data: the same company, before and after enforcing DMARC, removing an exposed file and adding HSTS. Your own result depends on your own findings.
Before
DMARC p=none, exposed file, no HSTS
After
All three fixed and re-verified
Sample data
The problem
Attackers don't need to be sophisticated to target a small business
They look for the easy things: a domain anyone can send email as, an expired certificate, a forgotten subdomain, a lookalike site that fools customers. You usually find out after a customer does.
Anyone can send email as you
Without an enforcing DMARC policy, spoofed invoices and password-reset emails reach your customers looking genuine.
Small gaps nobody is watching
Expiring certificates, missing browser protections, changed DNS records — all silent until they cause an outage or an incident.
Someone is using your name
Lookalike domains and fake login pages borrow your brand to mislead customers, long before you hear about it.
The platform
Five pillars of protection and proof, in one place
Enterprise security teams buy five or six separate products for this. PixelPrivate brings the outside-in view into one score, one prioritised list and one report your leadership can read.
Attack Surface & Exposure
Scans your domain, DNS, certificates and website like an outsider would, then ranks what to fix first.
AvailableExplore
Email & Brand Protection
Checks SPF, DKIM and DMARC, generates the fix, and watches for lookalike domains that impersonate you.
AvailableExplore
Data Exposure
Looks for publicly reachable secrets, backups and directory listings, without ever storing the data it finds.
NewExplore
Trust & Compliance
Readiness checklists, policy templates and a public trust page for customers and auditors. Readiness, not certification.
RoadmapExplore
Policy & Access
Baseline security policies with owners and due dates, and simple approval workflows.
RoadmapExplore
AI Copilot & Reports
Plain-English explanations grounded in your findings, plus shareable reports for boards, clients and insurers.
AvailableExplore
Items marked Roadmap are planned and not yet available. See the full platform overview.
For leaders
Security you can explain in the boardroom
You do not have to read DNS records to see the risk. PixelPrivate translates findings into the questions leaders actually face.
Winning customer deals
Answer security questionnaires with evidence and share a clean report instead of promises.
Stopping payment fraud
Spoofed invoices and fake supplier emails start with weak email authentication. See and close that gap.
Cyber-insurance questions
Know what an insurer will see before they ask, and fix it first.
Protecting your name
Find lookalike domains used to impersonate you, with evidence and risk ratings.
Real-world risk
What these gaps tend to lead to
No statistics, just how each common weakness is typically abused.
Invoice fraud
A forged email from your domain asks a customer to pay a new bank account. Enforced DMARC makes receivers reject it.
Account takeover
A reused password plus no second factor gives an attacker your mailbox, and from there password resets for everything else.
Leaked credentials
A backup or environment file in a public folder can hand over database or API keys without any hacking at all.
Built for real businesses
For the people who run the company, not just the people who run the servers
Leaders, finance teams and operators each ask different questions. PixelPrivate answers them in language they use.
Growing companies
No security team? Get a clear picture and a plan.
Learn more
Finance leaders
Fraud, insurance and board reporting in plain terms.
Learn more
Manufacturers
See your internet-facing exposure across sites and suppliers.
Learn more
Agencies and MSPs
Check every client domain from one place.
Learn moreFix
From “what's wrong?” to “fixed” in one place
Every finding explains what happened, why it matters to your business, how serious it is and how sure we are. Where it is safe, PixelPrivate generates the exact configuration — record type, name, value, TTL.
You apply it. Press Verify fix and PixelPrivate re-checks, updates your score and records it in your history.
Protect
See impersonation early, with evidence you can act on
Brand Shield rates each lookalike by risk and confidence, lists the reasons, and lets you investigate, dismiss, allow-list partners and mark your own domains.
It is an automated indicator — never a legal verdict — and it shows you exactly why a domain was flagged.
Understand
An AI Security Copilot that only talks about your findings
Ask “what should I fix first?”, “explain this to my boss” or “write a message to my IT person”. Answers are built from your structured scan results — the AI explains, it never invents findings.
Monitor
Know the day something changes
Scheduled re-scans detect changes in DNS, certificates, headers, email authentication and brand threats. You see what changed, why your score moved, and get alerts above the severity you choose.
Share
Reports your boss, client or insurer can read
Send a clean security report by unguessable, expiring, revocable link — a summary by default, details only if you choose. Methodology and limitations are always included.
Features
Everything a small team needs, nothing it doesn't
Transparent score
PixelPrivate Security Score with published weights and an explanation for every change.
Remediation Center
Step-by-step fixes, copy-paste config and verification.
Continuous monitoring
Scheduled scans and change detection, from weekly to daily.
Smart alerts
Email and in-app, with your own severity threshold.
Severity + confidence
Know how serious an issue is and how certain we are.
Grounded AI
Plain-English explanations without hallucinated findings.
Multi-organization
Separate organizations and roles, built for agencies and MSPs.
Shareable reports
Revocable, expiring links with methodology attached.
How it works
Discover. Understand. Fix. Protect.
Six steps from a domain name to a continuously monitored business.
- 1
Discover
We look at your public domain, DNS, email and website setup.
- 2
Analyze
Structured checks produce evidence, not guesses.
- 3
Prioritize
Findings ranked by severity and confidence.
- 4
Explain
Plain-English impact and a grounded Copilot.
- 5
Fix
Copy-paste config and clear steps. You stay in control.
- 6
Monitor
Re-scans, change detection and alerts.
Trust
Precise claims. Honest limits.
Security products earn trust by being exact. We publish how every check works, what the score means and what we do not do.
What PixelPrivate does
- Passive, low-impact checks of public configuration
- Evidence, timestamp and source check on every finding
- Hardened scanner: public hosts only, pinned DNS, size and time limits
- Server-side access control for every organization
- Published methodology, score weights and known limitations
What it does not do
- Exploit vulnerabilities, brute-force or test passwords
- Change your DNS, email or website on its own
- Claim you are “100% secure” or fully OWASP-covered
- Replace backups, endpoint protection or a pen test
- Claim certifications it does not hold (it holds none today)
Who it's for
Built for businesses without a security team
Learn from what really happens
Real incidents, and the scenarios that could be yours
We summarise public incidents with their sources, and we show what an outside-in check would and would not have shown. No customer stories are invented.
Public incidents, with sources
Public incident
Business email compromise
FBI IC3 reports BEC adjusted losses of $3,046,598,558 for 2025.
Read the summary
Public incident
Exposed .env files
Unit 42 reported a campaign that hit 110,000 domains through exposed environment files.
Read the summary
Public incident
An expired certificate
Ericsson attributed the 2018 O2 and SoftBank outage to expired software certificates.
Read the summaryHypothetical scenarios
What is at stake
The damage you can avoid
Most attacks on small businesses are not clever. They use gaps that are easy to find and easy to close, if you know they are there.
Fake invoices sent in your name
What can happen: A criminal sends your customer an email that looks exactly like it came from you, asking them to pay a different bank account. The customer pays. The money is gone and your name is damaged.
How we help: We check whether your email is protected against this, and show you the exact setting to switch on so forged emails get blocked.
A fake copy of your website
What can happen: Someone registers a website address that looks almost like yours, with one letter changed, and builds a login page that fools your customers into typing their password.
How we help: Brand Shield looks for look-alike addresses, tells you when one appears, and gives you a ready-made complaint to send to the company hosting it.
A file left open to the whole internet
What can happen: A backup, or a settings file with passwords inside, is sitting in a public folder on your website. Nobody knows it is there, except the people who search for exactly that.
How we help: We look for these accidental leaks from the outside, the same way an attacker would, and tell you to remove them.
The padlock suddenly disappears
What can happen: Your website certificate quietly expires. Visitors see a big red warning saying your site is not safe, and many leave and do not come back.
How we help: We watch the expiry date and warn you well before it happens, so the warning never reaches your customers.
The numbers, from public sources
- Fake-invoice and impersonation fraud by email (called business email compromise) cost victims reported to the FBI about $3 billion in 2025.
- In a major annual study of data breaches, the typical ransom demand was about $115,000, and ransomware showed up far more often in small-business breaches than in large ones.
Sources: FBI Internet Crime Complaint Center, 2025 report; Verizon Data Breach Investigations Report. These are industry-wide figures, not a promise about your business. See the sourced case studies for the details and limits.
PixelPrivate helps lower the chance of these problems by finding the gaps early. No product can promise that nothing will ever go wrong.
Fair question
Why plans start at $15 a month, when big security companies charge thousands?
Because we are built differently, not because we cut corners. Here is the honest answer, in plain words.
Software does the routine work
The big names employ large sales teams, consultants and offices, and the price covers all of it. PixelPrivate is an AI-driven product. Software runs the checks, watches for changes and writes the explanations. That work does not need an army of people, so you do not pay for one.
Nothing to install or set up
Many security tools need engineers to roll out programs on every computer, which is slow and expensive. We look at your company the way an outsider would, starting from just your website address. You can be up and running in minutes, with no project and no consultant.
One price, no sales calls
You will not need to book a demo or wait for a quote. The price is on this page, you try it free for 14 days, and you can cancel any time.
What you get
- A clear score and a to-do list in plain English, most important first
- Warnings when something changes or someone copies your brand
- An assistant that explains any problem and drafts a message to your IT person
- Reports you can show a boss, a customer or an insurer
What we are not
We are honest about the limits. PixelPrivate does not replace a security team that watches your computers around the clock, and it does not guarantee you will never be attacked. It finds the common, easy-to-exploit gaps and tells you how to close them. The kind of gaps attackers look for first. That is where a small business gets the most protection for the least money.
Try it free for 14 daysNo credit card. If it is not for you, it simply reverts to the free plan.
Pricing
Start free. Try full Pro for 14 days.
Plans from $15/month. Most businesses choose Business at $39/month for up to 5 domains. No credit card to start, and you land on Free afterwards with everything kept.
Annual billing saves 20%. Shown as the price per month.
Free
Know where you stand. Free forever.
$0forever
No card, ever.
Start FreeRun a full security check now.
- 1 domain
- Weekly security monitoring
- Security Score
- Core security findings
- Remediation instructions
- Limited AI Security Copilot
- One-time Brand Shield check
- Basic security history
- Email support
Starter
Continuous security monitoring for one business.
$12/month
Billed $144 per year · Save 20%USD, excluding taxes
Start 14-Day Pro TrialNo credit card required.
- 1 domain
- Daily scanning and monitoring
- Full findings and remediation guidance
- Full AI Security Copilot
- Data Exposure monitoring
- Continuous Brand Shield
- Email alerts
- Security history
- Shareable security reports
- AI assistant chat
- All core external security checks
Business
Complete security monitoring for growing businesses.
$31/month
Billed $372 per year · Save 20%USD, excluding taxes
Start 14-Day Pro TrialNo credit card required.
- Up to 5 domains
- Everything in Starter
- 1 Microsoft 365 connection
- Executive security reportsComing soon
- Up to 3 usersComing soon
- Advanced security history and trendsComing soon
- Priority alertsComing soon
- Enhanced reportingComing soon
Pro
Security monitoring for agencies and teams.
$63/month
Billed $756 per year · Save 20%USD, excluding taxes
Start 14-Day Pro TrialNo credit card required.
- Up to 25 domains
- Everything in Business
- Up to 5 Microsoft 365 connections
- Priority support
- Up to 10 usersComing soon
- Client-ready reportsComing soon
- Multiple organizationsComing soon
- Advanced Brand ShieldComing soon
- Team and role managementComing soon
- API and integrationsComing soon
Agency
Manage security for multiple clients from one dashboard.
$119/month
Billed $1,428 per year · Save 20%USD, excluding taxes
Start 14-Day Pro TrialNo credit card required.
- Up to 50 domains
- Everything in Pro
- Priority support
- Multiple organizationsComing soon
- White-label client reportingComing soon
- Client managementComing soon
- Team managementComing soon
- Bulk managementComing soon
- Advanced reportingComing soon
- API and integrationsComing soon
Every paid plan starts with a 14-day full Pro trial. No credit card required. When it ends you move to Free automatically; nothing is deleted. 4 paid plans, one product: pick the size that fits.
Prices exclude any applicable taxes. Annual billing saves 20%. Full plan comparison
Frequently asked questions
How does the 14-day free trial work?
Sign up with your email and you immediately get 14 days of full Pro: up to 25 domains, daily monitoring, continuous Brand Shield, the AI Copilot, Data Exposure checks, email alerts and reports. No credit card is requested. When the trial ends your account moves to the Free plan automatically; you keep your data and can subscribe whenever you want to keep the Business features.
Is PixelPrivate a vulnerability scanner or penetration test?
No. PixelPrivate performs passive checks of publicly visible configuration — DNS, email authentication, HTTPS and certificates, security headers — and monitors for lookalike domains. It explains each finding and how to fix it. It does not exploit anything, and it does not claim to find every vulnerability.
Will PixelPrivate change my DNS, email or website?
Never. It generates the exact configuration (for example the DMARC record) and step-by-step instructions. You or your IT provider apply them, then PixelPrivate re-checks to verify the fix.
What happens after the trial if I do not subscribe?
Nothing is deleted. Your account continues on the Free plan: 1 domain, weekly monitoring, the Security Score, core findings and fix steps, and the free tools. You can choose Starter, Business or Pro at any time to restore daily monitoring, alerts and reports.
What does the PixelPrivate Security Score mean?
It is our own 0–100 indicator based on the checks currently available, with published weights. It is not an industry-standard rating and not a guarantee of security. Every point deducted is explained by a specific finding.
Do I need technical knowledge?
No. Findings are written in plain English with the business impact first, then the technical detail. The AI Security Copilot can explain any finding, prioritise what to fix first, or draft a message to your IT person.
Is it safe to scan my domain?
Yes. Scans are low-impact: a small number of ordinary DNS and HTTPS requests, identified as PixelPrivateScanner. Only scan domains you own or are authorized to assess.
How is my data protected?
Each customer is a separate organization with server-side access control. We never ask for your passwords or access to your systems. See the trust center for retention periods, subprocessors and what we do not claim — PixelPrivate holds no security certifications today.
Start protecting your business today
Run the free check in 30 seconds, or start your 14-day trial for continuous monitoring and Brand Shield.
No credit card · Cancel anytime · Reverts to the Free plan automatically