United States · for small businesses
What attackers, insurers and your biggest customer can already see.
grc-scan is free cyber security for US small businesses, in plain English. The US has no Cyber Essentials, but insurers, banks and bigger customers all ask about the same baseline — MFA, backups, updates, email that can't be spoofed. Answer the questions, name your website, and we check your answers against what the internet can actually see.
Every line is labelled — verified by a scan, contradicted by it, or taken from your answer — and every gap comes with the fix. A security check for the business that can't justify a penetration test.
free · no sign-up · nothing of yours stored
Passive scanYou said HTTPS everywhere with old encryption off — your website still accepts TLS 1.0/1.1.
Email DNSYou said your domain can't be spoofed — there's no DMARC record, so anyone can send email as you.
Passive scanCertificate trusted, and HSTS is set.
Your answerMFA on email, remote access and admin accounts — you said yes. We can't see it from outside, so it stays your word.
—Backups live inside your business; no outside scan can see them.
Scan your domain
FreeGrade your domain's public security A–F: headers, TLS, email anti-spoofing, DNS, reputation.
Which of your services answer to the open internet — remote desktop, databases, admin panels — seen the way an attacker sees them.
Can criminals send email as you? Business email compromise starts here. An SPF/DMARC traffic light.
Paste a suspicious link instead of clicking it — a plain-English verdict.
Full nmap + nuclei scan of a website you prove is yours. Deleted after about three days.
Check your readiness
FreeThe baseline insurers, banks and bigger customers ask about — MFA, backups, updates, email spoofing — checked against your website.
Take cards? Find your self-assessment form — and whether you still qualify for SAQ A after 2025, checked against your website.
The controls carriers ask about on the application — MFA, backups, EDR, exposed RDP, wire-transfer callbacks — checked against your scan.
The US government's own cyber security framework. Rate the practices only you can see, function by function.
Raising? The gaps an investor's technical due diligence finds — IP assignment, MFA, SOC 2 — before the data room opens.
Which rules apply?
California's privacy law, in five questions — and whether its 2026 cybersecurity-audit rule applies too. Most small businesses are outside it.
Tax preparers, auto dealers, mortgage brokers, lenders: the nine elements, the under-5,000 exemption, and your website's encryption checked.
Covered entity, business associate or neither — then what the rule in force asks, the 60-day breach clock, and the pending overhaul.
Who you'd have to tell, and by when, in every state your customers live in — 30, 45, 60 days or "as fast as possible".
Stay current
FTC, state regulators and HHS OCR — who was ordered, why, and the cheap lesson. Twice a month — 1st and 15th.
CISA's Known Exploited Vulnerabilities list, in plain English: what attackers are using right now and what to update. Every Monday.
The week's stories that matter to a small business, and what to do about them. Every Friday.
Has your address appeared in a known breach? Via Have I Been Pwned.
Who uses this
The owner
A restaurant, a store, a dental office, a small agency. You want to know where you stand without paying for a penetration test to find out.
Check your security baseline→Your IT provider
A managed service provider, or the one person who handles the computers. Check as many client domains as you like and hand over a PDF in plain English.
Check a client's email→Anyone filling in an insurance application
Carriers ask about MFA, backups and exposed services — and can deny a claim if the answers weren't true. Check yours against what a scan sees before you sign.
Check insurance readiness→Founders and investors
Founders: the technical gaps a fund's due diligence will find. Investors: an outside-in read of a company's domain — the posture and email checks read only what it already publishes; the exposure and in-depth scans need the company's permission.
Tech-DD readiness→
Latest briefings
US enforcement roundup
This month’s cases all started with something ordinary: a vendor, a phishing email, and a pile of data nobody needed to keep. - Write down every vendor that holds your customers’ data, and what you would do if they were breached tomorrow. - Turn on MFA on email and admin accounts, and take away access the day someone leaves. - Keep only the personal data you still need, and write down when you delete the rest.
What to patch now
This week's additions lean heavily on the appliances sitting at your network's edge — VPNs, firewalls, email gateways, remote-support tools — the exact systems built to face the internet directly. - Run a VPN, firewall or email-security appliance (Ivanti, Palo Alto, Fortinet, Cisco)? Check with whoever manages it that this month's patches are on. - Use an outsourced backup or IT-support provider? Ask whether they run Ahsay or BeyondTrust, and whether it's fixed. - Running Windows or a self-hosted Atlassian tool? Update now — both are widely deployed, so both get attacked fast.
Cybersecurity news
Almost every flaw attacked this week was in something sitting at the edge of a network — a VPN, a firewall's admin page, an email gateway, the remote-support tool an IT provider signs in with. - Take admin and management pages off the public internet: require the office network or a VPN. - Don't wait for a CVE or a news story — follow your key vendors' own security advisories. - Walk the building and list the network devices nobody owns; update them or unplug them.
Free scans and readiness reports to help you prepare — not legal or insurance advice, not a quote, and not an audit, assessment or certification of any kind. The posture and email checks read only what a domain already publishes; the in-depth scan runs only on a website you prove is yours. Findings reflect what we could observe at the time of the check. How we test, and why you can trust it →