Find answers in our FAQ

A “hack test” is an informal umbrella term for any proactive security check from an attacker’s perspective – the attempt to find vulnerabilities before real hackers can exploit them. Both classic penetration tests and CheckFix are forms of a hack test, but they differ significantly in depth, effort, and cost.

The key differences:

• Penetration Test (Pentest): Manual, in-depth security analysis by IT security experts who actively look for vulnerabilities and attempt to exploit them. Can also examine internal systems. Cost: typically €5,000–15,000 per assessment, usually once per year.

• CheckFix Security Check (free): Automated analysis of your external attack surface – everything publicly accessible via your domain. No manual effort, no active intrusion into your systems. Delivers an A–F rating within 24 hours.

• CheckFix Basic / Premium (€490–950/year): Extends the Security Check with a prioritised to-do list with a fix strategy showing which findings to fix and where. Costs a fraction of a classic pentest and can be carried out regularly.

Which option fits whom?
Pentests are suitable for in-depth audits of individual systems or specific compliance requirements. CheckFix can be used as a prelude to a pentest to quickly identify the biggest entry points that a professional can then examine more thoroughly.

For small and medium-sized businesses that want to review their external attack surface regularly – to close vulnerabilities before hackers find them – CheckFix is the right choice.

For supply chain reviews under NIS-2, DORA, or ISO 27001, there is a dedicated variant: the CheckFix Risk Manager.

⇥ Start now with the free Security Check

CheckFix analyzes your IT infrastructure from an external perspective – exactly as hackers would see your company.

Step 1 – Discovery:

• Automatic scan of all publicly accessible systems based on your domain. We extract this from your email address. You can subsequently have 2 additional domains checked.
• Identification of servers and mail infrastructure
• Detection of open ports and services

Step 2 – Vulnerability Assessment (automated):

• Cross-reference with CVE database (known vulnerabilities)
• Check of SSL/TLS certificates
• Analysis of mail security (SPF, DKIM, DMARC)
• Security header check

Step 3 – Report & Dashboard:

• Clear dashboard with A-F rating
• PDF report with all technical details
• Unique: ToDo checklist with prioritization for your designated technician to work through the tasks

Important: CheckFix works non-invasively – no attacks are simulated, only publicly available information is analyzed.

Free Security-Check:

• Assessment and rating of your external attack surface based on the domain of your email address
• A–F rating in 5 assessment categories (mail security, secure communication (TLS/SSL), known vulnerabilities (CVEs), security headers, internet interfaces)
• Non-binding and immediately available

CheckFix Basic: €490/year

• Once a year: complete external security assessment
• A–F rating overall and per assessment category
• Full ToDo list with fix strategy, prioritised by criticality (Critical → High → Medium → Low)
• Re-check after remediation
• Audit-ready report with action plan and response per finding
• Dashboard with user management and all technical details
• Assessment of up to 3 domains
• Markdown file with all finding details for Claude or ChatGPT
• Compliance questionnaires by standard with PDF export
• Usable as proof of security for clients and audits
• Cancel anytime

ROI calculation: A single security incident costs small businesses around €40,000** on average. CheckFix costs less than €50/month.

⇥ Choose from our plans now

CheckFix is suitable for any company with an online presence – from sole proprietorships to corporations.

You benefit from CheckFix if you have:

• Website(s), online shop, or web applications
• Email communication (own server or cloud like Microsoft 365/Google Workspace)
• Optional: Remote access (VPN, RDP) or APIs

CheckFix examines your systems from an attacker’s perspective from the outside – where most attacks originate.

For SMEs: Professional IT security without five-figure pentest budgets. Vulnerabilities are explained so your technician can fix them themselves.

Typical scenario: Website by agency, mail server set up by a “tech-savvy friend” – CheckFix shows whether everything is secure. Because a system administrator doesn’t replace a cybersecurity expert (and vice versa).

For larger companies: Quick external security checks for management and IT leadership. Uncover forgotten open ports, outdated systems, or configuration errors.

Typical scenario: Management receives an objective overview of security status – independent of internal or external IT service providers.

For critical companies: CheckFix covers the external security assessment, including an action and response plan and an audit-ready report.

Typical scenario: The company has to regularly prove the security of its publicly accessible systems to auditors and customers. The CheckFix report documents findings, measures and progress after the re-check.

Yes. When companies review their supply chain, they usually request two types of evidence: a technical audit and an organisational self-assessment. You can create both with CheckFix.

Technical audit: CheckFix performs a comprehensive analysis of your external attack surface, which is exactly where most cyberattacks start. For most suppliers, this evidence is sufficient. Only for particularly critical suppliers do customers usually require an additional, more in-depth assessment, such as a penetration test.

How it works:

• Select a questionnaire by standard in the CheckFix dashboard
• Answer it once and export it as a PDF
• Present it in audits or share it with customers, together with the report from the external security assessment (A–F rating and fix strategy)

Why this matters for suppliers: NIS2 (Art. 21) and ISO 27001 (supplier relationships) require companies to manage the security of their supply chain. That is why your customers ask how you handle IT security, both technically and organisationally. With CheckFix you have a ready-made document for these requests that builds on the common standards and is sufficient in most cases. Ideal if you supply critical infrastructure (KRITIS) operators or companies subject to NIS2.

Do you assess suppliers yourself? With the CheckFix Risk Manager you send questionnaires and see the technical ratings of all partners in one dashboard.

⇥ Learn more about the CheckFix Risk Manager

CheckFix performs regular external security checks – from the perspective of an attacker on the internet. Around 70%* of cyberattacks are carried out by external attackers. They target what can be reached from outside: your external attack surface.

Everything accessible via your domain(s) on the internet is checked:

• Servers & Hosting: Open ports, outdated software, known CVEs
• Domains & Subdomains: Automatic detection of subdomains
• Mail Infrastructure: SPF, DKIM, DMARC configuration (spoofing protection)
• SSL/TLS Certificates: Validity, encryption strength, configuration
• Web Services: Security headers (HSTS, CSP, X-Frame-Options)
• Warning for publicly accessible critical services
• Check for known vulnerabilities

Not checked:

• Internal networks without internet access
• Systems behind firewalls without external exposure
• Social engineering or physical security

Why external? The external attack surface is the largest entry point for cybercriminals. Those who are secure here eliminate the most common attack vector.

Scope: You can monitor up to 3 domains per CheckFix subscription. For larger infrastructures or individual requirements, contact us – we’ll find a suitable solution!

Depending on the selected package, CheckFix performs 1-2 comprehensive security checks per year:

• Basic: 1 CheckFix per year + 1 re-check
• Premium: 2 CheckFix per year + 2 re-checks

Why this rhythm?

Annual or bi-annual checks are the standard for professional security audits and correspond to common compliance cycles (ISO 27001, NIS2, KRITIS). Between checks, your IT team has time to systematically address the vulnerabilities found.

CheckFix delivers prioritized, actionable recommendations instead of a daily flood of alerts. This allows you to use resources efficiently and achieve measurable improvements.

Your advantage: You receive focused reports with clear to-dos – not thousands of unfiltered alerts like with continuous monitoring tools. You can decide the timing yourself through our practical dashboard.

Need more frequent checks? Contact us for a customized quote.

CheckFix works exclusively with publicly accessible information:

• No login attempts or brute force
• No exploitation of vulnerabilities
• No data manipulation
• GDPR-compliant data processing in Austria
• Only external scanning (as hackers would do)

CheckFix shows you what attackers can see – without attacking itself.

The scoring system is based on school grades:

• A (Excellent): No critical vulnerabilities, best-practice configuration
• B (Good): Minor optimization potential
• C (Action needed): Medium risks should be addressed
• D (Critical): Serious gaps present
• E-F (Acutely vulnerable): Immediate action required

Important: The better your rating, the less interesting you are to hackers who usually look for “low-hanging fruit”.

The ToDo checklist is the heart of CheckFix – and unique in the market:

Instead of abstract reports, you receive an interactive dashboard where:

• Concrete tasks are sorted by priority
• A fix strategy is provided for every finding
• Affected systems, IPs, and domains are clearly identified
• Technical details are available for IT service providers
• Understandable explanations are available for decision-makers

AI-powered implementation support: You receive a prepared Markdown file with all finding details. Paste it into Claude or ChatGPT and ask how to implement the fix strategy in your system (Plesk, cPanel, Azure, AWS …).

Teamwork made easy:

• Invite colleagues, IT service providers, or external technicians
• Everyone sees the current to-dos and can check them off directly
• Work through the list together – everyone at their own pace
• At the next check, you’ll see the improvement in black and white

Example from the report:
“CS3: Configure SPF record for odoo.example.com” → Fix strategy: which DNS entry needs to be set where. Unsure about implementation in your system? The Markdown file for Claude or ChatGPT helps.

Bonus: In addition to the dashboard, you receive a detailed PDF report for documentation and compliance evidence.

The good news: Your technician can do it!

CheckFix was developed precisely so that any competent technician can implement the to-dos – without external security consultants or specialized pentesters. Whether you’re a one-person startup or a large corporation.

Why this works:

• Every vulnerability is translated into clear, actionable to-dos that the technician responsible for your system should understand.
• If system-specific questions (Plesk? cPanel? AWS?) remain open, clarify them with the prepared Markdown file in Claude or ChatGPT.

Typical scenarios:

Small business:
Website by agency, server maintained by an external system administrator → They can close all security gaps themselves with CheckFix

Medium/Large company:
Own IT department or external IT service provider → Gets a clear task list and can start right away

What’s special: A system administrator doesn’t replace a cybersecurity expert – but CheckFix translates security expertise so that any competent technician can implement it. Without five-figure consulting costs.

Ideally twice a year (included in CheckFix “Premium”) – for these reasons:

• New vulnerabilities: New CVEs are published daily
• System changes: New servers, services, domains
• Certificates: Expiration dates are often overlooked
• Compliance: NIS2 requires regular checks
• Employee turnover: New admins, forgotten access
• Before audits and certifications – CheckFix can be used as evidence

CheckFix makes security a regular routine instead of a one-time mandatory exercise.

Currently, the firewall undergoes a basic check. Specifically, 1,000 ports are examined.

No. Only those IP addresses connected to the domain name (company name) are found. For example, if a server is rented that neither uses an SSL certificate from the company nor has a DNS entry with the company name, it will very likely not be found by CheckFix. This is due to CheckFix’s fundamental principle of working like a hacker does. If a server/IP address is not connected to the company name, the hacker cannot associate it with the company, and therefore it is not typically at the center of a hacker attack.

User errors are one of the biggest problems in IT security. Most commonly through opening phishing emails or clicking on an untrustworthy link in an email. Of course, an automated tool can never prevent human error. However, if your email settings are perfect, fewer risky emails will get through to you. Therefore, work through the open to-dos from your CheckFix security check to protect yourself as best as possible. Nevertheless, it remains essential to train your employees well.