Cybersecurity / Free Vulnerability Assessment
FREE EXTERNAL VULNERABILITY ASSESSMENT
See your school the way an attacker sees it.
We scan everything your school exposes to the internet and send you a plain-English report: what’s at risk, how serious it is, and exactly what to fix first. Free, with no obligation and nothing to install.
2-minute sign-up
Report within 1 week
No passwords needed
Zero downtime
inspiroz@assess:~$ assess --external example-charter.org
Demo scan of a sample school domain. Enter your own domain to check its PHP version live.
inspiroz@watch:~$ threats --sector k12 --sort severity
300+
SCHOOLS PROTECTED
8,000+
DEVICES SECURED
20,000+
THREATS DETECTED IN 2025
1 WEEK
TYPICAL REPORT TURNAROUND
WHY IT MATTERS
Most attacks start with what's already public.
Attackers don’t need to break in when a forgotten portal, open remote-access port or missing email protection lets them walk in. Here’s why that matters for schools right now.
STUDENT DATA
You hold data attackers want
Student records, health and family details, and staff payroll make schools a valuable target. A breach means notifications, legal exposure and lost trust with families.
RANSOMWARE
Attacks stop learning, not just IT
When systems are encrypted, schools lose attendance, SIS access, email and sometimes days of instruction. Most attacks start with something exposed online.
INSURANCE
Insurers ask what you expose
Cyber insurance applications and renewals ask about MFA, remote access, email security and patching. The report gives you evidence and a fix list before you answer.
LEADERSHIP
Boards want proof, not reassurance
Heads of school and boards increasingly own cyber risk. An outside-in view gives them a clear, independent picture they can act on.
Happening now: the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect school websites and portals that run PHP. Our assessment flags exposed, unpatched PHP. Check your website’s PHP version now →
WHAT WE CHECK
Eight checks. Each one tells you why it matters.
A one-time, non-intrusive scan from the outside. No agents, no logins, no access to your internal network.
01
Subdomain discovery
We map every public host tied to your domains, including old sites and portals people forgot about.
Why it matters: Forgotten systems are rarely patched.
02
Email security
We check SPF, DKIM and DMARC records.
Why it matters: Stops attackers sending email that looks like it came from your school.
03
Known vulnerabilities
We match the software you expose against published CVEs.
Why it matters: Shows which systems need patches, ranked by risk.
04
Open ports & services
We look for exposed remote desktop, file sharing, databases and admin panels.
Why it matters: Exposed remote access is a common ransomware entry point.
05
Web applications
We review your public websites and portals for misconfigurations.
Why it matters: Protects the pages families and staff log in to.
06
SSL / TLS certificates
We flag expired certificates and weak or outdated encryption.
Why it matters: Avoids browser warnings and keeps logins private.
07
DNS configuration
We review your domain records for hijacking and misrouting risks.
Why it matters: Keeps your website and email pointing where they should.
08
IP reputation
We check whether your addresses appear on threat blocklists.
Why it matters: A blocklisted address can mean a compromised device and bounced email.
WHAT YOU GET
A report your whole team can act on.
No 200-page scanner dump. You get a short, prioritized report written for school leaders, with enough detail for whoever does the fixing.
- One-page summary for your head of school or board
- Findings ranked by risk: critical, high, medium, low
- Plain-English fix steps for each finding
- Who should fix it: your IT team, your host or a vendor
- Quick wins you can close this week, often at no cost
- Evidence to support cyber insurance and board conversations
HOW IT HELPS
Useful to everyone who owns the risk.
HEADS OF SCHOOL & BOARDS
Clear oversight
An independent, outside-in view of your risk, with a one-page summary you can take to the board and track over time.
OPERATIONS & FINANCE
Better spending decisions
Know which fixes matter most before you spend. Use the findings for insurance renewals, budget requests and vendor conversations.
IT DIRECTORS & SMALL TEAMS
A prioritized to-do list
Validate what you suspected, surface what you missed, and get backing for the fixes you’ve been asking for.
STAFF WHO INHERITED IT
Know where you stand
No jargon. You’ll know what’s urgent, what can wait, and who to call, whether that’s your host, a vendor or us.
HOW IT WORKS
Four steps. About a week.
01 · SIGN UP
Two-minute form
Tell us your school’s website and who should receive the report. You confirm you’re authorized to request the scan.
02 · SCAN
We look from the outside
We run non-intrusive external checks against the domains you give us. Nothing to install, no passwords, no downtime.
03 · REPORT
Delivered within a week
Your prioritized report goes only to the contacts you named on the form.
04 · REVIEW (OPTIONAL)
Walk through it with us
Book a short call to go through the findings and next steps. Only if you want it. No sales pressure.
SCOPE
What it is, and what it isn't.
Clear expectations up front, so your team knows exactly what’s being checked.
✓ INCLUDED
- Everything public on your school’s domains
- Websites, portals, webmail and remote-access services
- Email spoofing protection (SPF, DKIM, DMARC)
- Known vulnerabilities in exposed software
- Certificates, DNS and blocklist status
✕ NOT INCLUDED
- Not a penetration test: we don’t try to break in
- No access to your internal network, devices or student data
- No software, agents or passwords
- Not a compliance audit or certification
- Not continuous monitoring (that’s a separate service)
FOR THE BUDGET CONVERSATION
Questions your board will ask.
Security has to earn its place in a tight budget. Here’s how the assessment helps you make the case.
START WITH FREE FIXES
Many top findings cost nothing to fix
Adding a DMARC record, closing an exposed remote-desktop port or turning off old TLS versions are configuration changes, not purchases.
FIX IN ORDER OF RISK
Spend where it matters
A ranked list lets you fund the critical items first and plan the rest into next year’s budget, instead of buying tools you don’t need.
FUNDING TO EXPLORE
Outside help can stretch your budget
E-Rate Category 2 can cover basic firewall services. Schools in the FCC’s three-year Cybersecurity Pilot can use its funding for eligible security services. Some states also share cybersecurity grant funds with schools, so check with your state’s cyber office.
FREE GOVERNMENT SERVICES
Pair it with CISA
CISA offers free Cyber Hygiene vulnerability scanning to K-12 organizations (email vulnerability@cisa.dhs.gov). We can help you read and act on those results too.
A scan of everything your school exposes to the internet, such as websites, portals, email settings and remote-access services, from the same outside view an attacker has. It finds weaknesses before someone else does.
No. The checks are non-intrusive and run from outside your network. There’s nothing to install and no downtime.
No. We only need your school’s public web address. We never ask for passwords and never access internal systems or student data.
No. A penetration test actively tries to break in and is a separate, scoped engagement. This assessment identifies what’s exposed and vulnerable without exploiting anything.
Only the contacts you name on the sign-up form. Results are treated as confidential.
Your report explains each issue in plain English, how urgent it is and how to fix it. There’s no obligation to work with us, but critical items should be fixed promptly. We’re happy to talk it through.
Yes. An independent outside view is a good check on any setup. Many schools share the report with their provider as a fix list.
Yes. List each campus website or domain on the form and we’ll confirm the scope with you before we scan.
At least once a year, and after major changes such as a new website, new remote-access setup or a move to a new host. Critical new flaws like PHP2Shell are also a good reason to re-check.
Yes. It’s a one-time assessment at no cost and with no obligation to buy anything.
Usually within one week of sign-up, sent to the contacts you named on the form.
MORE FREE RESOURCES
Keep going after the report.
FREE TOOL
PHP2Shell website check
See whether your website reports an unpatched PHP version, in 10 seconds.
FREE TOOL
Cyber insurance gap analysis
Find the gaps insurers ask about before your next renewal.
SERVICE
Threat monitoring & response
Turn a one-time view into 24/7 monitoring and response.
START NOW
Find the gap before someone else does.
Two minutes to sign up. A clear, confidential report in about a week. No cost, no obligation, nothing to install.
Non-intrusive
Confidential
Report in ~1 week
Built for K-12