Free Cybersecurity Audit — AET Solutions

We check your domain against seventeen external security tests and ask a few questions about the things no external test can see. You get a scored report in about a minute.

Everything we examine is already public — DNS records, certificate transparency logs, and published scan data. We do not attempt to access, probe, or log into anything you own.

About your organisation

What is your organisation’s main domain name?

The domain your website and email use, for example aetsolutions.ca

Where should we send your report?

We email a link to confirm the address. Your report is not shown until you click it.

Are you authorised to request a security assessment of this domain?

We only assess information that is already public, but we still need your confirmation before we begin.

YesNo

Do you know your public IP addresses? (optional)

If your website sits behind Cloudflare or a similar service, the addresses we can see belong to that provider rather than to you. Telling us your own addresses lets us check them for exposed services and known vulnerabilities. Public addresses only — never internal ones such as 192.168.x.x.

Identity and access

Is multi-factor authentication required for email and Microsoft 365 or Google accounts?

This is the single most effective control against account takeover, and it cannot be observed from outside.

Is multi-factor authentication required for administrator accounts?

Including IT staff, service accounts used by people, and third-party support access.

Do staff connect remotely, through a VPN or remote desktop?

YesNo

When someone leaves, how quickly are their accounts disabled?

Same dayWithin a weekLonger, or not consistentlyNot sure

Operational resilience

When did you last restore from a backup to confirm it works?

An untested backup is a hope, not a control. This is where most ransomware recoveries actually fail.

Within the last three monthsWithin the last yearNever, or longer ago than thatNot sure

Is at least one backup copy offline, immutable, or in a separate account?

Ransomware deliberately targets backups reachable from the network it has compromised.

YesNoNot sure

How quickly are critical security updates applied to servers and workstations?

Within a weekWithin a monthSlower, or only when something breaksNot sure

What endpoint protection is deployed?

Are any systems still running software past its end-of-life date?

For example Windows Server 2012, or an unsupported line-of-business application.

NoYesNot sure

People and preparedness

Do you run simulated phishing exercises?

YesNoNot sure

Is there a written incident response plan that names who to call?

The question that matters at 2am is not whether a plan exists, but whether anyone can find it.

Yes, and we have practised itYes, but never practisedNoNot sure

Anything else you would like us to know? (optional)