CyRecon – Website Security & Risk Scanner

Scan any website for publicly visible security risks and get a clear risk score, grade, severity-ranked findings, and technical context — all from one passive external assessment.

CyRecon is a passive, non-intrusive website security and external risk scanner designed to quickly assess the security posture of any publicly accessible domain.

Enter a domain and CyRecon analyzes externally observable security signals across six risk domains, then returns a structured JSON result containing:

• Overall risk score
• Overall risk grade and risk band
• Score and grade for each risk domain
• Severity-ranked findings
• Finding counts
• SSL/TLS certificate information
• Technology detected
• Open ports and services
• Hosting and ISP information
• Country information
• Mail provider information
• Scan caveats and limitations

No credentials, login, or application access is required.

Why CyRecon?

Security assessment often requires multiple tools, checks, and manual interpretation.

CyRecon brings multiple publicly observable security signals into one standardized assessment.

With one domain input, you get:

Domain → External Checks → Findings → Risk Scores → Structured JSON

This makes CyRecon useful not only for security teams, but also for:

• Vendor risk assessment
• Third-party risk management
• Cyber insurance underwriting
• Due diligence
• Internal IT reviews
• Automated risk pipelines
• Partner and supplier assessment
• Commercial risk workflows

Input

Single field, by design:

Field	Type	Required	Notes
url	string	yes	Target site — accepts a bare domain, a full URL with or without https://, with or without a path, or a markdown-style link. e.g. example.com, https://example.com/, [example.com](https://example.com)

Output (one dataset record per run)

{
  "vendor": "example.com",
  "status": "ok",
  "scannedAt": "2026-09-08T00:00:00Z",
  "riskScore": 88,
  "riskGrade": "BBB",
  "riskBand": "Above Average",
  "domainScores": [
    { "key": "app_sec", "name": "Application Exposure", "score": 79, "grade": "BB" }
  ],
  "findingCounts": { "critical": 0, "high": 0, "medium": 3, "low": 9, "total": 12 },
  "findings": [
    { "domain": "app_sec", "domainName": "Application Exposure", "severity": "MEDIUM", "title": "Missing Header: content-security-policy", "detail": "..." }
  ],
  "context": {
    "certificate": { "notBefore": "...", "notAfter": "...", "daysUntilExpiry": 214 },
    "technologyDetected": ["nginx", "React"],
    "openPorts": [{ "port": 443, "service": "https" }],
    "hosting": "Cloudflare", "isp": "Cloudflare, Inc.", "country": "US",
    "mailProvider": "Google Workspace"
  },
  "caveats": []
}

status is one of:

• "ok" — scan completed, full result as above
• "error" — the domain was invalid, unreachable, or unsafe to scan; see error for why
• "cooldown" — this domain was scanned too recently; see Rate limiting

context is reference data the scan collects but doesn't score (certificate dates, detected tech, open ports, hosting info) — there's no "correct" value to penalize deviation from here, unlike findings. caveats lists any known limitations of that specific run (e.g. a CVE lookup that hit a rate limit), so an incomplete check reads as disclosed, not silently clean.

Rate limiting

The same domain can't be scanned more than once every 15 minutes, to avoid placing repeated load on a target site. A second run against a domain still in cooldown returns immediately with:

{ "vendor": "example.com", "status": "cooldown", "error": "This domain was scanned within the last 15 minutes. Try again in about 9 minute(s)." }

This is scoped per domain — scanning a different domain is never affected by another domain's cooldown.

Scope

Passive, non-intrusive scan and deterministic scoring only — no active exploitation, no authenticated testing, no full port sweep. Every check is an outside-in HTTP/DNS/TCP observation of what's already public; nothing here logs in, submits data, or attempts to access anything not already exposed. This Actor has no external dependencies beyond the scan targets themselves, so it runs identically for anyone.

Limitations

• External and passive only. Everything here is visible from the outside, without credentials.
• A snapshot, not a guarantee. Results reflect the moment of the scan; a clean result today doesn't mean the target stays that way tomorrow, and it isn't a certification that the target is free of risk.
• Some findings carry false-positive risk. A handful of checks are heuristic and are flagged as such in the finding's own detail text. Worth a manual look before treating them as certain.
• CVE lookups are capped at 12 per scan. If a site uses many detected technologies, not all of them may get checked in a single run. See the caveats field in the output for when this happens.

Responsible Use

CyRecon is intended for legitimate security assessment, research, and business purposes. Please scan only domains that you own or are authorized to assess.

CyRecon performs passive, non-intrusive external checks and provides security signals for assessment and prioritization. Results are based on publicly observable information and may not identify every security issue or may occasionally require validation.

By using CyRecon, you are responsible for ensuring that your use complies with applicable laws, permissions, and third-party requirements.

CyRecon is provided as an assessment tool and does not guarantee the security or vulnerability status of any domain.