Buteo
External attack-surface auditing
What the internet knows about your domain, before somebody uses it against you: scored findings with evidence, every scan compared with the last, and an assistant that explains what each finding means and proposes what to do.
Get in Touch See All ProductsWhat appeared, what went away, what changed severity. Recorded as events with a history.
What each finding means for your domain, the next step suggested, the change proposed. You apply it with one click.
The outside view
Buteo reads what your domain already publishes to the internet, from the SPF record to the certificate, from forgotten subdomains to missing headers, and turns it into scored findings with evidence and a lifecycle. Then it scans again and tells you what changed, and an assistant inside the product explains what each finding means for you and proposes the next step. Nothing to install, no agents. It scans only domains whose ownership has been proven, it reads what is public, and it goes one step further, to a short list of well-known paths, only under your written authorisation.
Ibex is the inside view, the sealed appliance on the network the cloud cannot reach. Buteo is the other one: your domain as anyone on the internet sees it. A buteo is a buzzard, the hawk that circles high and reads the ground below, which is exactly the vantage point it takes.
The surface nobody reviews
Most organisations know what runs inside their infrastructure, and far less about what their infrastructure tells the world. An SPF record ending in a soft fail that was never corrected. A subdomain from a 2019 campaign still pointing at a service that was cancelled. A certificate expiring on a Saturday. A security header lost in a migration.
None of it shows up in an internal inventory, and all of it is visible to anyone who cares to look. When it is found, it is usually found by the wrong person first.
Problems, not reports
Buteo asks what the domain publishes and evaluates it the way a receiving server or a browser would: not whether an SPF record exists, but whether it stops a forged message; not whether DMARC is set, but whether it is rejecting or merely observing.
Every finding carries a severity, an explanation, its evidence and a lifecycle of its own. Run it again and Buteo shows what changed between the two, which is the question that actually matters from the second week onward.
Proven first, and never past what you authorised
Two rules separate Buteo from a scanner you can point anywhere.
The engine refuses to scan a domain until its ownership is proven: a TXT record, a file at a well-known location, or an email challenge. And by default it reads only what the domain publishes: it never tries credentials, never constructs a request for a path the domain never advertised, and never confirms a weakness by exploiting it. A dangling CNAME is reported, never claimed. A weak cookie is reported, never replayed.
There is one controlled exception. Three checks ask for well-known paths, the admin panel, the API documentation and the files that should not be reachable, and they run only for a domain covered by a written authorisation recorded in your account: who gave it, when, which document, and until when. Even then nothing is exploited, and no content of an exposed file is ever copied, only the fact that it answered. Guessing subdomain names is off until you turn it on. Every report says which of these happened, so it never claims a restraint the scan did not keep.
AI in the analysis and in the decision
Teo, the assistant inside Buteo, knows your account and the product's own help. It reads your findings, explains what each one means for your domain, suggests what to do next, the keywords a project is missing, a scan schedule, an alert channel, a colleague to invite, and proposes the change.
You apply it with one click, and nothing in the account changes without that click. It answers about your account and about Buteo and nothing else, under the permissions of the person asking.
Open to your own agents
The agents your organisation already runs can ask Buteo the same questions, through a remote MCP server with OAuth. One organisation per connection, the same tools and the same permissions as the person who connected it, and every question recorded in the account's activity.
An agent can read your domains, the latest scan and its findings, and propose a scan or a change of state. Like Teo, it proposes; a person applies.
Key features
Ownership proven first
A TXT record, a well-known file or an email challenge. Until one succeeds, the engine refuses to scan.
Email posture that works
SPF resolved in full with its lookup count, DMARC checked for whether it rejects, the DNSSEC chain followed to the root.
TLS, headers and cookies
Protocols and ciphers graded, the certificate chain and its time left, each missing header with what its absence permits.
The perimeter you forgot
Subdomains, dangling CNAMEs open to takeover, reachable ports, IP ranges and ASNs, and lookalike domains registered by others.
What changed since yesterday
Every scan is compared with the last. Alertable change is separated from recurring noise, the events feed a history, and the alert goes by email, Slack, Teams, Jira or ServiceNow.
Findings with a lifecycle
Severity, explanation and evidence per finding, and a state of its own: new, acknowledged, resolved, accepted risk. An accepted risk records why, who and until when, and its review date returns it to new.
An assistant in the analysis
Teo reads your findings, explains what each one means for your domain, suggests the next step and proposes the change. You apply it with one click; nothing changes without it.
Reports someone can read
PDF, Word or PowerPoint from the same data and the same charts, per domain, per project or for the whole organisation, under Buteo's identity or your own.
One step past public, only authorised
By default nothing is requested that the domain never advertised. Three checks for well-known paths run only under a written authorisation recorded in your account, and no weakness is ever confirmed by exploiting it.
How it works
Prove the domain
A TXT record, a well-known file or an email challenge. Until one succeeds, nothing is scanned.
Buteo reads what is public
DNS and email posture, mail transport, DNSSEC, subdomains, ports, TLS, headers, cookies, technologies, IP and ASN. Under your written authorisation, a short list of well-known paths as well.
Findings, with a lifecycle
Severity, explanation and evidence per finding, and a state you own: new, acknowledged, resolved, accepted risk. Teo explains the finding and proposes the next step.
The next scan says what changed
Scheduled or on demand. Alertable change is separated from noise and goes by email, Slack, Teams, Jira or ServiceNow to whoever needs to know.
A report someone can read
PDF, Word or PowerPoint from the same data and charts, per domain, per project or for the whole organisation. On demand, or on a schedule on the higher plans.
Three plans
The three plans run the same audit, every check on every plan. They differ in how many domains they hold, how often each is scanned, and what happens between scans. Tell us how many domains you answer for and we will say which one fits.
| Plan | Who it is for | What it adds |
|---|---|---|
| Freeone domain | The full audit of one verified domain, once, with the tools. | Every check, the PDF report, the DNS record validator, the connectivity test and the CSR toolkit, and Teo's hints and setup list. |
| Proup to ten domains | Anyone who needs to know what changed since yesterday. | A weekly scan per domain, continuous monitoring, alerts by email, Slack, Teams, Jira or ServiceNow, scheduled reports, Word and PowerPoint, the conversation with Teo, access for your agents, and the written authorisation for the three extra checks. |
| Enterpriseup to a hundred domains | A group, a portfolio of brands, or auditing third parties. | Daily scans, your own branding on the reports, and a scanning address of your own. |
The rules that define the product
Verified domains only
There is no way to scan a domain you have not proven from your account. It is a legal and abuse boundary, not a formality.
An honest scanner
Every host Buteo touches can see who is asking and where to write. It honours opt-outs and answers abuse reports.
A score that says what it is
The risk score is an indicative heuristic, and the report labels it as one rather than dressing it up as a standard it is not.