External360 checks your domains every day from outside, with nothing to install: whether your email can be forged, whether your websites' certificates and security settings are right, and whether Remote Desktop, file sharing or a database has been left open to the internet. Every finding comes with what it means and how to fix it.
Start a free trial Watch how it works See the pricing Sign in to StreamSoft360
External360 is one of the fourteen components of StreamSoft360 - one sign-in, one workspace, one bill.
A walkthrough on the real pages, with captions. Jump straight to the part you need.
Take External360 on its own, or in a StreamSoft360 plan with the components that go with it. Priced per domain - each one covers its website, its mail and every name under it. Monthly in Rands, excluding VAT. No setup fee.
More domains in blocks of 5. See every plan and component on the StreamSoft360 page, or talk to us.
SPF, DKIM and DMARC - the records that stop someone sending a "please pay this invoice" email from your address.
Whether your mail servers offer encryption, with a valid certificate, and whether MTA-STS stops it being downgraded.
Expired, about to expire, not trusted or for the wrong name - on every site under your domain. Cert360 renews them.
HTTPS redirects, HSTS, Content-Security-Policy, clickjacking protection, and servers that announce their software version.
Remote Desktop, file sharing, databases, VNC, Telnet, FTP and SSH answering from the internet on your own addresses.
Every name under your domain that has had a certificate is found in public Certificate Transparency logs - old test sites included.
DNSSEC, and CAA records naming which certificate authorities may issue for your domain.
A finding you've decided to live with is accepted with a recorded reason, and stops counting against your grade.
A grade A to F per domain and for the organisation, a 90-day trend, and every finding as CSV.
Live checks for POPIA, ISO 27001, NIST CSF, CIS, Cyber Essentials and Joint Standard 2 in Compliance360, and a risk in Risk360.
Nothing is checked until you prove the domain is yours with a DNS record - so nobody can point External360 at someone else.
Your data in a database of its own, roles, compulsory two-step sign-in and a full audit trail.
Fixed ones close by themselves at the next check.