For UK businesses without a security team
You are probably exposed to more on the internet than you realise.
Type your domain. SurfaceLoop finds every subdomain, port, certificate and mail record attached to it -- then watches them, every day.
Free scan of your own domain · No card · Set up in one call
Assets discovered
0
Illustrative scan of a typical SME estate.
Trusted to watch the attack surface of
Cyber EssentialsCertified -- AMVIA
Almost every small business has something exposed. Most don't know what.
In September 2026 we scanned 1,083 internet-facing assets of UK SMEs (778 apex domains, 305 IP addresses). These are the headline results. Read the full snapshot →
95.4%
of UK SME domains scanned by SurfaceLoop in September 2026 had at least one open, externally visible security finding.
73.9%
of scanned UK SME domains carried a spoofing-relevant gap in SPF, DKIM or DMARC.
58.4%
of scanned UK SME domains had at least one finding rated high or critical severity.
37.8%
of scanned UK SME domains had an exposed web admin panel or CVE-flagged software.
Source: SurfaceLoop UK SME External Exposure Snapshot, September 2026 · 1,083 internet-facing assets of UK SMEs (778 apex domains, 305 IP addresses)
The report
Findings you can act on, not a 90-page PDF.
Each finding says what's wrong, where, and how serious it is. Switch categories and filter by severity -- this is a real example report.
open-ports · example.com
One screen tells you whether you're okay today.
The SurfaceLoop app, on a live estate
Seven checks, on every asset, every day.
All features →Open Ports & Services
Discover and monitor open TCP ports and exposed services across your external attack surface.
Exposed Web Panels
Detect admin panels, management interfaces, and login pages exposed to the public internet.
TLS & Certificates
Monitor TLS configuration, certificate expiry, weak ciphers, and chain-of-trust issues.
Security Headers
Check HTTP security headers including CSP, HSTS, X-Frame-Options, and Permissions-Policy.
Known Vulnerabilities (CVEs)
Scan for known CVEs and exploitable vulnerabilities using thousands of detection templates.
DNS & Email Spoofing
Validate SPF, DKIM, and DMARC configuration to prevent domain spoofing and phishing.
Subdomain Enumeration
Discover subdomains, shadow IT, forgotten services, and development environments exposed to the internet.
Run all seven on your own domain.
Get a free scan →The gap between audits is where breaches happen.
A quarterly pen test sees your estate four days a year. New exposures appear on the other 361. SurfaceLoop checks daily, so a problem is found the day it appears.
Illustrative: six new exposures over a year, and how long each stays open.
7
scan categories, one view
0
agents or firewall changes
1 day
typical time to first findings
Add a domain. See what's exposed. Fix it.
01 · 2 minutes
Tell us your domain
Domain and work email is the whole signup. No card, no agents, no firewall changes.
02 · within a working day
We map your estate
Discovery finds every subdomain and internet-facing asset, then scans all seven categories.
03 · every day after
Fix what matters first
Findings ranked by severity, in plain English. Alerts by email, Slack or webhook when something changes.
One plan, everything included
£149 /month
12-month agreement, billed monthly. Invoiced by AMVIA — no card details, no new payment platform.
- Automated discovery of every domain, subdomain, and internet-facing asset
- Continuous scanning across all seven risk categories
- Findings prioritised by severity, in plain English
- Change tracking — see what opened, closed, or changed between scans
- Alerts by email, Slack, or webhook when something new appears
- Dashboard, issue tracking, and full REST API access
Attackers can already see your attack surface. Now you can too.
Prefer a walkthrough first? Book a demo