Sensagraph Capabilities

SSL Certificate Analysis Open Port Detection Web Application Scanning DNS Security Audit HTTP Header Analysis Misconfiguration Detection Software Fingerprinting Subdomain Enumeration
SSL Certificate Analysis Open Port Detection Web Application Scanning DNS Security Audit HTTP Header Analysis Misconfiguration Detection Software Fingerprinting Subdomain Enumeration
Email Security Configuration Analysis

Email Security Configuration Analysis

Sensagraph analyzes your domain's email security configuration including SPF, DKIM, DMARC, and MX records to prevent spoofing and phishing attacks.

Read more
Sample output

What a report looks like

Email Security Configuration Analysis Typical run: ~7 minutes
Summary

Sender records published, but nothing yet tells receiving providers to reject a forgery.

Findings

  • DMARC policy set to none

    High

    dmarc_policy · WARNING

    Forged mail claiming to be from this domain is still delivered; the policy only watches it happen.

  • SPF record ends in a soft fail

    Medium

    spf_all · WARNING

    Mail from senders you never authorised is marked as suspicious rather than refused.

  • DKIM signature published

    Info

    dkim · PASSED

    Outgoing mail is signed, so receivers can confirm it left your servers unaltered.

Example findings, written to show the format. A real run reports what is actually on your domain.

Exposed Credentials & Secrets Detection

Exposed Credentials Detection

Sensagraph automatically detects leaked API keys, passwords, and secrets exposed on your public assets before attackers can exploit them.

Read more
Sample output

What a report looks like

Exposed Credentials & Secrets Detection Typical run: ~7 minutes
Summary

212 public files read, 3 of them carrying a credential that was never meant to ship.

Findings

  • Live cloud access key in a bundled script

    Critical

    AWS · /js/app.min.js · VERIFIED

    The key was tested against the provider and still works. Anyone who views the page source has it.

  • Environment file reachable over the web

    High

    Generic · /.env.bak · UNVERIFIED

    A copy of the server configuration is served to anyone who asks for it by name.

  • Payment provider key inside a source map

    Medium

    Stripe · /js/app.js.map · UNVERIFIED

    Source maps ship the original code, comments and keys included, to every visitor.

Example findings, written to show the format. A real run reports what is actually on your domain.

Web Application Security Test

Web Application Vulnerability Detection

Sensagraph actively tests your web applications to uncover injection flaws, authentication weaknesses, insecure cookies, and OWASP Top 10 risks.

Read more
Sample output

What a report looks like

Web Application Security Test Typical run: ~60 minutes
Summary

48 pages crawled and answered with crafted requests, 3 of them handled input unsafely.

Findings

  • Reflected cross-site scripting

    High

    Confidence: High · /search?q=

    The search term is written back into the page unescaped, so a crafted link runs script in a visitor's browser.

  • Session cookie without the HttpOnly flag

    Medium

    Confidence: High · /login

    Script running on the page can read the session cookie and hand over the account with it.

  • No Content-Security-Policy header

    Medium

    Confidence: Medium · /

    Without a policy the browser will load and execute script from anywhere the page points it.

Example findings, written to show the format. A real run reports what is actually on your domain.

Web Server Vulnerability Scan

Web Server Configuration Analysis

Sensagraph automatically scans your web server for misconfigurations, dangerous HTTP methods, exposed files, and missing security headers.

Read more
Sample output

What a report looks like

Web Server Vulnerability Scan Typical run: ~50 minutes
Summary

6,700 checks run against the web server, 3 issues worth acting on.

Findings

  • Backup copy of a config file left in the web root

    High

    GET /config.php.bak

    The backup is served as plain text, so the database credentials inside it can simply be read.

  • Directory listing enabled

    Medium

    GET /uploads/

    The server prints the full contents of the folder, including files nothing links to.

  • Server version disclosed in response headers

    Low

    GET /

    The exact version tells an attacker which published exploits are worth trying first.

Example findings, written to show the format. A real run reports what is actually on your domain.

SSL/TLS Configuration Analysis

Encryption & Certificate Analysis

Sensagraph automatically inspects your SSL/TLS configuration, certificates, ciphers, and known encryption weaknesses to keep your traffic secure.

Read more
Sample output

What a report looks like

SSL/TLS Configuration Analysis Typical run: ~4 minutes
Summary

Certificate valid, but the server still negotiates protocol versions that were retired years ago.

Findings

  • Certificate expires in 12 days

    High

    certificate_expiry · WARNING

    Once it lapses every visitor gets a full-page browser warning before they reach the site.

  • TLS 1.0 still accepted

    Medium

    tls_1_0 · FAILED

    An attacker between the visitor and the server can force this older version and weaken the connection.

  • Modern cipher suites in use

    Info

    cipher_suites · PASSED

    No weak or export-grade ciphers were offered during the handshake.

Example findings, written to show the format. A real run reports what is actually on your domain.

Technology Fingerprinting

Technology Stack Risk Assessment

Sensagraph fingerprints your website's technology stack, detects outdated software, end-of-life frameworks, and version leakage that put you at risk.

Read more
Sample output

What a report looks like

Technology Fingerprinting Typical run: ~4 minutes
Summary

14 components identified, 3 of them running a version with published vulnerabilities.

Findings

  • Content management system two years behind

    High

    WordPress · 6.1.1

    Several security releases have shipped since this version, and their fixes are public reading.

  • JavaScript library with known issues

    Medium

    jQuery · 1.12.4

    This release has documented cross-site scripting flaws and has been unsupported for years.

  • Web server version disclosed

    Low

    nginx · 1.18.0

    Hiding the version number removes the shortcut an attacker uses to pick an exploit.

Example findings, written to show the format. A real run reports what is actually on your domain.

Open Port Detection

Network Exposure & Open Port Detection

Sensagraph automatically discovers open ports, exposed services, and risky network entry points across your public infrastructure.

Read more
Sample output

What a report looks like

Open Port Detection Typical run: ~3 minutes
Summary

1,000 ports checked, 4 open, 2 of them serving something that does not belong on the public internet.

Findings

  • Database reachable from the internet

    Critical

    Port 3306 · TCP · mysql · open

    Anyone on the internet can open a connection to this database and start guessing credentials.

  • Remote desktop exposed

    High

    Port 3389 · TCP · ms-wbt-server · open

    Remote desktop is one of the most heavily brute-forced services there is. It belongs behind a VPN.

  • Legacy file transfer service answering

    Medium

    Port 21 · TCP · ftp · open

    FTP sends its credentials unencrypted, so anyone on the path can read them.

Example findings, written to show the format. A real run reports what is actually on your domain.

Fully Agentless Security Scanning

Sensagraph runs fully agentless — no installations, no code changes. Scan your systems from the outside, just like a real attacker would.

Downloadable Reports & Cross-Team Export

Download comprehensive Sensagraph security scan reports with clear findings and actionable recommendations. Share results across teams effortlessly.

Scheduled Scans for Continuous Security Assurance

Schedule automated security scans of your websites at any frequency. Sensagraph delivers results automatically and lets you compare changes over time.

Frequently Asked Questions

How does Sensagraph protect you

Everything you need to know about what our scanning checks, how it works, and what you get from each report.

Each scan runs a comprehensive set of checks against your target from the outside — exposed ports and services, web server misconfigurations, SSL/TLS certificate health, web application security issues, and technology fingerprinting. All findings are consolidated into a single prioritized report with AI-assisted analysis.

Sensagraph identifies a wide range of issues — outdated software versions, exposed admin panels, insecure HTTP headers, weak encryption configurations, open redirect risks, and publicly reachable sensitive endpoints. Each finding is classified by severity so you always know what to fix first.

No. Scans run entirely from our infrastructure — no agents, no plugins, no changes on your side. You add your domain and Sensagraph does the rest from the outside, the same perspective an attacker would have.

We recommend scanning after every significant deployment, dependency update, or new service launch. Regular periodic scans — weekly or monthly — also catch configuration drift and newly discovered vulnerabilities before they can be exploited.