Security Check with a system:
Find vulnerabilities – fix them – prove it

How do I check the security of my website?

The security of your website isn’t decided by the website alone. Anything reachable from the outside can be attacked: web servers, mail servers, open ports, SSL/TLS encryption and DNS. CheckFix checks this entire external attack surface in one run, shows a grade from A to F for each area and delivers a prioritized to-do list for your technician to work through.

How do I find vulnerabilities in my IT infrastructure?

There are two ways to find security gaps: manual security audits or penetration tests – or automated tools that check your IT systematically and regularly for known vulnerabilities.

Proven methods for finding vulnerabilities:

• External assessment from a hacker’s perspective (open ports, SSL/TLS, DNS, email security)
• Matching your software versions against CVE databases for known security gaps
• Checking the configuration of web servers and mail servers
• Identifying outdated or forgotten systems (shadow IT)

The key difference is between the internal and the external perspective: internal audits check your systems from the inside – an external attack surface analysis shows exactly what attackers would see from the outside, meaning the doors hackers actually use to get in. More than 70% of all cyberattacks start from the outside, which is why the external view matters so much.

CheckFix handles this external search for vulnerabilities fully automatically: within 24 hours you receive a complete overview of all security gaps found – including a prioritized to-do list with a concrete fix strategy that your own technician can implement.

What does CheckFix check?

CheckFix analyzes your entire external attack surface: domains, subdomains, email servers, open ports, SSL certificates, DNS configuration, web technologies and mail security (SPF, DKIM, DMARC).

Specifically, CheckFix checks:

• Your email addresses for misconfigurations
• Known vulnerabilities (CVEs) in identifiable technologies
• Open ports and outdated SSL/TLS protocols
• Missing or misconfigured security headers on your websites
• DNS and mail security settings

Everything that can be reached from the outside via your domain(s) is checked – just as hackers would use automated tools.

Important: CheckFix does not replace virus protection; it adds an external perspective to your existing security measures. No tool can detect zero-day vulnerabilities (unknown security gaps) – CheckFix finds known vulnerabilities (n-day) before attackers exploit them.

Who is CheckFix suitable for?

CheckFix is suitable for any company with an online presence: website, email server or publicly accessible APIs. SMEs benefit in particular (professional IT security without five-figure pentest budgets), as do companies subject to NIS2 (technical compliance support and supplier assessment), suppliers to companies subject to NIS2 or ISO 27001 (proof of security for customers) and IT service providers/MSPs (customer assessment and inventory monitoring).

What is the difference between CheckFix and a penetration test?

A penetration test actively attacks your systems and shows which gaps can actually be exploited. CheckFix, on the other hand, analyzes your external attack surface from the outside without penetrating your systems, and delivers a prioritized fix strategy. You can do this regularly at a predictable subscription price. A manual penetration test of comparable scope can easily cost 15,000 euros. We offer active testing as an add-on: the AI Pentest.

What is the difference between CheckFix and the AI Pentest?

CheckFix analyzes your external attack surface passively and delivers a prioritized to-do list with a fix strategy. The AI Pentest builds on this: our own pentest agent on our own hardware actively tests the hosts you approve and shows which gaps can actually be exploited. You book it as an add-on to your CheckFix, in packages starting at 4 runs.

Can my technician fix the security gaps themselves?

Yes! That’s exactly what CheckFix was built for. Every vulnerability is translated into to-dos with a fix strategy – clear to any competent technician. You do need one, though, because it’s impossible to provide a concrete step-by-step guide for every system. Whoever set up your IT can now fix the security gaps too. On top of that, a pre-prompted Markdown file that you can feed into ChatGPT, Claude and co. helps with the implementation in your specific environment (Plesk, cPanel, Azure, AWS etc.). A system administrator is no substitute for a cybersecurity expert – but CheckFix translates security know-how so that your technician can implement it without five-figure consulting costs.

What is the difference between CheckFix and virus protection?

Virus protection (antivirus) protects your devices against malware from the inside. CheckFix analyzes your company from the outside – like a hacker. The two approaches complement each other: antivirus fends off attacks that are already in the system. CheckFix prevents attackers from getting in at all by finding open doors (ports, misconfigurations, outdated software) before you get hacked. Best option: use both!

How often should I run CheckFix?

At least twice a year. Why? New vulnerabilities appear all the time (software updates, new subdomains, configuration changes). After each check, your team needs time to fix things – the re-check shows measurable progress. Semi-annual checks match common compliance cycles (ISO 27001, NIS2) and keep you secure between pentests. This turns security into a routine rather than a chore.

Can I use the report as proof for audits (NIS2, ISO 27001, TISAX)?

Yes. You document open items directly in the to-do list with reason, compensating measure, deadline and owner. This produces a PDF report with an action plan and management response that you can pass on to customers or use for internal audits and documentation under NIS2, ISO 27001 or TISAX®. The report covers the technical part of the external security assessment.

Do I need a penetration test for NIS2 or NISG 2026?

The NISG 2026 does not explicitly require a penetration test. It does, however, require policies and procedures to assess the effectiveness of your risk management measures, and a structured approach to handling vulnerabilities. Essential entities, such as operators of critical infrastructure in energy, health or transport, must also expect audits by an independent body. A penetration test is a common technical proof for this.

Whether you need one depends on your classification and your risk analysis. With CheckFix you know your external attack surface; with the AI Pentest you check what can be exploited.