Run a free, non-invasive perimeter scan of your company domain in under a minute. No jargon, no sales call required — just a clear picture of your risk and what to do about it.
Everything is external and non-invasive — public DNS records, response headers, your SSL certificate, public certificate logs, and standard port checks. No exploitation, no logins, no meaningful load on your systems.
Most UK insurers now expect evidence of basic controls before they'll bind or renew a policy. We show you exactly what's missing, in the language insurers use.
See how you measure up against the UK Government-backed Cyber Essentials framework, and get a prioritised list of what to fix first.
Most breaches start with a person, not a firewall. Ongoing phishing simulations and training keep your team as sharp as your systems.
Start free. Upgrade when you need something you can hand to your insurer or broker.
A fast, non-invasive perimeter check so you know where you stand today.
A pre-audit and insurance gap report — exactly what most UK insurers now expect before binding a policy.
Tomasz Mickiewicz — Founder & Lead Security Analyst
40and4 Security Solutions is a specialist practice, not a call centre. The person who runs your scan is the person who writes your report and sits on the walkthrough call — so you get straight answers about what actually matters for your insurance renewal, without being handed between account managers.
The things UK business owners actually ask us before booking an audit.
It is a review of the security controls UK insurers ask about on their proposal forms — email authentication (SPF, DKIM and DMARC), multi-factor authentication, patching, backups, and remote access exposure. You get a written gap report mapped to those questions, a prioritised fix list, and a 30-minute call to walk through it. The output is designed to be handed straight to your broker or insurer.
DMARC tells receiving mail servers what to do with email that fails authentication checks, which is what stops criminals sending convincing invoices and payment requests that appear to come from your company. Insurers ask because email impersonation drives a large share of the fraud claims they pay. Fixing it means publishing an SPF record, enabling DKIM signing with your mail provider, then adding a DMARC record and moving its policy from p=none to p=quarantine or p=reject once you have confirmed legitimate mail passes.
Cyber Essentials is a UK Government-backed certification covering five basic technical controls: firewalls, secure configuration, user access control, malware protection and patch management. It is mandatory for many public sector and MoD-linked contracts, and a growing number of insurers price it into their premiums or require it outright. For most SMEs it is worth doing on commercial grounds alone, because it unlocks contracts and reduces premiums.
Yes. Every check is non-invasive reconnaissance: public DNS records, your website response headers, your SSL certificate, public certificate transparency logs, and simple connection checks on common ports. It is the same information any visitor, browser or search engine can already see. Nothing is exploited, no login is attempted, no form is submitted, and there is no meaningful load on your systems or staff.
The domain exposure scan is free, with two scans per business per month. The Cyber Insurance Readiness Audit is a one-off £200. Continuous monitoring with staff phishing simulations and security awareness training is £150 per month.
It is a 0 to 100 score where higher is safer, weighted towards the gaps UK insurers scrutinise most during underwriting. Missing or monitor-only DMARC and exposed remote access ports such as RDP and FTP carry the heaviest deductions, because those are the two findings most likely to affect a quote or a claim.