Questions people actually ask.

SMB Scanner Lite is an evidence-first external security posture assessment for small and medium businesses. It evaluates 22 publicly observable security controls on a domain, produces a 0–100 posture score and an A–F grade, and attaches the observation behind every conclusive finding.

Small business owners, the IT administrator or managed service provider who looks after their infrastructure, cybersecurity consultants who need a defensible starting point, and defensive security practitioners who want a tool that refuses to overstate what it saw.

No. It is a configuration and exposure assessment. It does not run exploit code, it does not authenticate, and it does not enumerate shares or directories. A failed control means a published expectation was not met - not that an exploitable vulnerability was proven.

No. A penetration test tests whether a weakness can actually be exploited, with authorisation to attempt it. SMB Scanner Lite observes what is visible from outside and reports that. The two are complementary, and the assessment page says so plainly.

HTML for reading and sharing, JSON for machine processing, CSV for spreadsheet review and TXT for pasting into a ticket. A sanitised sample of each format for the recorded example.com assessment is available on the sample report page.

The methodology page covers measurement, scoring, evidence handling and limitations. The capability catalog documents all 22 controls, and the validation page publishes the reproducible test record.

It is a weighted summary of the controls that completed: pass earns full credit, warning partial credit, fail no credit, and inconclusive results are excluded entirely. It exists so an owner and their IT helper can agree on priority. It is a communication aid, not a certificate.

A is 90–100, B is 80–89, C is 65–79, D is 50–64 and F is below 50. The bands are documented on the methodology page and are applied identically to every target.

No conclusive answer arrived before the timeout. It is reported separately and excluded from the score, so a silent or filtering target can neither inflate nor deflate a result.

Not on this public site. The published edition is hard-locked to five free-to-use testing domains - example.com, example.org, example.net, scanme.nmap.org and badssl.com - and every other name is rejected before a network request is made. To assess a domain you own, request an assessment or run the sandbox locally.

Because a scanner that can be pointed at any host is a weapon, not a demo. The allowlist is enforced inside the runtime rather than in the interface, so it cannot be bypassed with a flag, a setting or an edited form field.

The demo on this site is a recorded assessment: stored output from a genuine run against example.com on 28 October 2026, with the timestamp, report ID, scanner version and consent receipt shown alongside it. Nothing you enter triggers a scan from your browser.

Your request is reviewed manually. Nothing is scanned automatically. If the domain and authorisation check out, you are contacted to agree scope, written authorisation and delivery format before any assessment runs. If it does not check out, you receive a reply saying so.

Yes. You must own the domain or be authorised to request an assessment of it. The request form asks you to confirm this, and authorisation is verified before work starts.

This website has no analytics, no advertising pixels and no tracking cookies. It sends no scan data anywhere. If you submit an enquiry form, the fields you type are used to reply to you and nothing else - see the privacy policy for exactly what is collected and how long it is held.

No. External observation cannot establish compromise. It can show the exposure that often precedes one - missing mail authentication, an open remote-access service, weak transport configuration - and that is the honest limit of what it claims.

The complete project - private engine, source history, documentation and website - is offered for acquisition as a documented software project, not as a revenue-generating business. Details, terms and the price are on the acquisition page.