The automated security advisor for mid-market organisations
External posture assessment across 7 categories. Exact fix commands, board-ready and technical reports in under 90 seconds. The free first step into continuous, prescriptive guidance.
Free. No signup.
Built by the team that managed security operations for Petbarn, IGA, and Australian government agencies. We’ve seen what breaks from the inside.
The Problem
Security for the Australian mid-market runs on annual consultant engagements, a managed SOC retainer, and whatever your engineer can fit between tickets. It adds up to six figures a year, and none of it compounds. Here is where the money goes.
A $52,800-a-year snapshot, stale before the invoice clears.
Threat modelling, posture assessments, compliance evidence, board reporting. All consultant-priced at $200-$500 an hour. The PDF lands, the environment keeps drifting, and next year you buy the same snapshot again.
Your SOC watches. It doesn’t fix.
Managed detection is built for alerts, not advice. No prescriptive hardening, no conditional access guidance, no fix commands. The agreement says monitoring, and that is exactly where it stops.
Three audiences. Three reports. One of you.
The board wants plain language. The broker wants evidence for renewal. The engineer wants the exact record to change. Every quarter someone, usually you, translates one posture into three documents by hand.
The Platform
Prescriptive guidance across your external posture, M365 tenant, conditional access policies, and Essential Eight maturity. Reported for two audiences, mapped to your compliance frameworks, and priced for organisations that aren’t enterprise.
CRITICAL | Subdomain takeover risk
staging.example.com.au CNAME → staging-app.herokuapp.com (NXDOMAIN)
FIX | Remove dangling CNAME or reclaim the Heroku app
VERIFY | $ dig CNAME staging.example.com.au
- Require MFA for all users
- Block legacy authentication
- Require compliant devices for admin
JSON policy templates for Entra ID
Why Kekkai
Insurance-aware
Australian-built
# Fix DMARC enforcement
_dmarc TXT "v=DMARC1;p=quarantine; rua=mailto:dmarc@co.au"
# Enable DNSSEC
Cloudflare > DNS > Settings
Enable DNSSEC > Copy DS record
Dual-layer reporting
“improve your email security configuration.”
_dmarc TXT “v=DMARC1; p=quarantine”
Core difference
No Gates, No tricks
Pricing
External scan
Continuous monitoring
What’s next on the platform
A guided, repeatable Essential Eight self-assessment, mapped to ASD maturity levels with prescriptive remediation.
Get early accessContinuous, prescriptive guidance across your Microsoft 365 and Entra tenant, against CIS, with board reporting.
Talk to usAll prices in AUD, exclusive of GST.
FAQs
Yes, always. No signup, no credit card, no trial that expires. Enter your domain, get a full 7-category assessment with both executive and technical reports. The free scan is the front door to the platform, and it stands on its own.
Email security (SPF, DKIM, DMARC, MX), TLS certificates and configuration, HTTP security headers, DNS configuration, web application exposure, breach database exposure, and subdomain enumeration. 39 security checks across 7 categories, all from publicly available data, plus 4 informational detections such as your mail provider.
No. Kekkai performs passive external reconnaissance only. We analyse publicly visible signals like DNS records, TLS certificates, HTTP headers, and breach databases. No active exploitation, no agents installed, no traffic generated that would trigger your WAF or IDS. Safe to run against production domains.
Kekkai is an automated security advisor for your own environment, not a third-party risk rating. Rating platforms score how risky an organisation looks from the outside. Kekkai tells you exactly what to fix, the DNS record to add, the command to run, the console path to change.
Yes. Managed SOC providers focus on detection, monitoring logs and responding to alerts. They rarely provide prescriptive hardening guidance, conditional access policy recommendations, or compliance-mapped reporting. Kekkai covers the advisory gap that SOC providers leave open. Send them the technical report as a fix list.
Very. The report either validates what your MSP has already done or gives them a prioritised list of what they have not. Either way, you get visibility into your posture without relying solely on your provider to self-report.
CIS Controls v8, plus the relevant PCI DSS requirement on TLS findings. Where a finding maps to a control in one of those, the report cites it. We do not claim conformance with any other framework, because an external scan cannot see the controls other standards actually ask about. A guided Essential Eight assessment is on the platform roadmap.
Partly, and we will not oversell it. An external scan covers the outside-in questions on an insurer's proposal form: email authentication, TLS, exposed services. It cannot answer the questions about backups, MFA coverage, privileged access or staff training, which is most of the form. Use the report as evidence for the questions it actually answers, not as an insurance submission.
Scans run without an account are retained for up to 24 months so you can track how a domain's posture changes over time, then anonymised. If you have an account, your scan history is kept for the life of the account and removed within 30 days of deletion. Full detail is in our Privacy Policy.
No signup. No credit card.
Over 7 categories and 39 security checks. Free, forever.
