Non-Destructive Continuous Architecture

From exposed to informed in three steps.

HackGuardX is engineered so a non-technical Managing Director can understand business risk in seconds—while giving developers and IT providers the exact technical commands to fix issues fast.

STEP 01

Connect & Verify Your Business Safely

  • Enter your primary domain for an instant passive DNS, TLS, and HTTP header check.
  • Verify domain ownership via a 60-second DNS TXT token or HTML meta tag to unlock active web & API testing.
  • Optionally connect read-only AWS SecurityAudit, Azure Reader, Microsoft 365 Graph Policy Reader, or the HackGuardX GitHub App.
STEP 02

Continuous Multi-Layer Risk Discovery

  • External Attack Surface engine maps subdomains, open ports, and SSL certificates automatically.
  • Safe web & API probes check for OWASP Top 10 flaws without mutating production data.
  • Code, lockfile, and cloud engines evaluate 220+ CIS/NCSC rules, 350+ secret detectors, and reachable CVEs.
STEP 03

Remediate, Retest & Prove Compliance

  • Every finding includes a plain-English impact summary and copy-paste fix snippets.
  • Forward findings directly to your web developer, MSP, or Jira/Linear board.
  • Click 'Verify Fix' to run an instant retest and download your updated Cyber Essentials & UK GDPR Article 32 PDF report.

Interactive Attack Path Simulation

Interactive Attack Chain Explorer
Click any node in the chain below to inspect how small gaps combine into a critical breach—and how HackGuardX breaks the chain.
SIMULATED ATTACK PATH DEMONSTRATION
High ExposureWebsite & Public Edge → staging-portal.company.co.uk

Forgotten Staging Subdomain & Missing Headers

The Weakness & Why It Matters

A 2024 website redesign left 'staging-portal.company.co.uk' publicly resolvable in DNS without IP allowlisting, HSTS, or Content-Security-Policy headers.

Automated reconnaissance bots discover unindexed subdomains via Certificate Transparency logs within minutes and target them because they lack production WAF rules.

How HackGuardX Identifies It

HackGuardX's External Attack Surface Monitoring correlates Certificate Transparency logs and passive DNS records to inventory every subdomain automatically.

Recommended Fix

Decommission unused staging DNS records or place staging origins behind Cloudflare Zero Trust / VPN access and enforce baseline HTTP security headers.

REMEDIATION SNIPPET● VERIFIED FIX
# Remove dangling staging CNAME or restrict behind Cloudflare Access:
staging-portal.company.co.uk -> Protected by Zero Trust Policy (Allow: @company.co.uk)
Step 1 of 4 in simulated path

Explore the Live Command Centre Interface

INTERACTIVE PRODUCT TOUR (DEMO ENVIRONMENT)
Posture Score: 78/100

6-Week Security Posture & Risk Reduction Trend

Continuous automated verification across domains, cloud, and code (Demo Telemetry)

+37 pts improvement

Controls Passed by Security Layer

227 automated controls evaluated continuously

96.2% Passing
All Active Security Findings(8 items)
HighF-101 • Websites(NCSC Email Anti-Spoofing)

DMARC Policy Set to p=none (Domain Spoofing Unblocked)

Target: hartley-group.co.uk (_dmarc TXT)

Plain-English Fix: Set _dmarc TXT record to v=DMARC1; p=quarantine; pct=100;

MediumF-102 • Websites(OWASP Secure Headers)

Missing Content-Security-Policy & HSTS Preload Header

Target: https://portal.hartley-group.co.uk

Plain-English Fix: Add Strict-Transport-Security and Content-Security-Policy headers in Nginx/Cloudflare.

CriticalF-201 • Cloud(CIS AWS 2.1.5 / NCSC Cloud)

S3 Bucket Public Access Block Disabled on Client Uploads

Target: aws:eu-west-2:s3://hartley-client-uploads

Plain-English Fix: Enable BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets.

HighF-202 • Cloud(CIS M365 2.1.3)

Exchange Online External Automatic Inbox Forwarding Permitted

Target: M365 Tenant: hartleygroup.onmicrosoft.com

Plain-English Fix: Set AutoForwardingMode to Off in Exchange Online Outbound Spam Filter Policy.

CriticalF-301 • Code(OWASP A03 Injection)

Unparameterised SQL Query in Legacy Invoice Export Route

Target: github:hartley/billing-service (src/routes/export.ts:48)

Plain-English Fix: Replace template string interpolation with parameterised prepared statements ($1, $2).

HighF-302 • Code(GitHub Actions Hardening)

GitHub Actions Workflow Running with Default Write-All Token

Target: github:hartley/portal-web (.github/workflows/deploy.yml)

Plain-English Fix: Add explicit 'permissions: contents: read' block at workflow root.

HighF-401 • Dependencies(Cyber Essentials 14-Day Patch SLA)

Reachable SSRF in Image Processing Transitive Package (CVE-2026-2140)

Target: package-lock.json -> sharp / libvips

Plain-English Fix: Upgrade sharp to >= 0.34.2 to pull patched transitive binary.

MediumF-402 • Dependencies(Container Base Hygiene)

Outdated Node.js Runtime Image in Production Dockerfile

Target: Dockerfile (FROM node:18-alpine)

Plain-English Fix: Update base image to active LTS node:22-alpine.

Start With Your Free Exposure Check