Know where you’re exposedbefore your insurer asks.
External posture assessment across 7 categories. Exact fix commands. Board-ready and technical reports in under 90 seconds.
Free. No signup.
Built by the team that ran managed security operations for Petbarn, IGA, and Australian government agencies. We’ve seen what breaks from the inside.
Everything about mid-market security is manual
$200-$500/hr. Point-in-time. Stale in weeks.
Threat modelling, posture assessments, compliance evidence gathering, board reporting. All done by consultants or not done at all.
They watch your logs. They don't harden your environment.
Managed SOC products focused on detection, not guidance. No prescriptive hardening. No CA policy recommendations. Alert fatigue, poor reporting.
Three audiences. Nobody's tool serves all three.
The board wants plain language. The engineer wants commands. The broker wants evidence. CISOs end up manually translating between all of them.
Your buyer needs an advisor, not another tool.
Prescriptive guidance across your external posture, M365 tenant, conditional access policies, and Essential Eight maturity. Reported for two audiences, mapped to your compliance frameworks, and priced for organisations that aren’t enterprise.
Provider detected: Heroku. Fix steps are platform-specific.
Scored gap analysis with prescriptive remediation playbooks. Already required for government. Increasingly expected by enterprise supply chains. Your Essential Eight assessment was a 3-month consulting engagement. This takes an afternoon.
Not “your conditional access is misconfigured.” Here are the 6 policies you should have based on your licensing and size, here is the JSON template to import, and here is how to test it safely.
Shows how individual findings connect. Legacy auth enabled means MFA can be bypassed, which means the 3 mailboxes with external forwarding rules are an active exfiltration risk. Context, not just findings.
Every finding automatically cross-referenced. The evidence your auditor asks for and your broker needs at renewal, generated in seconds instead of weeks.
Built for how Australian security teams actually work
“Improve your email security configuration.”
_dmarc TXT "v=DMARC1; p=quarantine"
Exact DNS records. PowerShell commands. Admin console paths. Provider-specific fix steps for Cloudflare, Microsoft, Google, AWS, and more.
Every competitor gates their product behind a form, a call, or a trial. We let you scan and decide.
Not an American product with NIST swapped out.
Essential Eight alignment built in from day one. ASD ISM and CPS 234 mapping. Australian data residency. Built by people who understand ACSC guidelines, not just the acronyms.
Findings flagged for cyber insurance relevance.
Premiums are climbing. Underwriters are asking harder questions. Kekkai generates the evidence you attach directly to renewal applications. Send the report to your broker.
One scan, two audiences.
Executive summary your CFO can read. Technical playbook your engineer can act on. Both generated automatically, both exportable as PDF. Stop manually translating between the two.
Transparent pricing. No sales call required.
Every competitor hides their pricing behind a demo form. We don’t.
No signup. No credit card. No trial period.
1 tenant. Monthly scans.
1 tenant. Weekly scans.
Hybrid environments.
Multi-tenant dashboard. White-label dual-layer reports. All Professional features per tenant.
Questions we hear from CISOs, brokers, and IT managers
Yes, always. No signup, no credit card, no trial that expires. Enter your domain, get a full 7-category assessment with both executive and technical reports. The free scan is not a teaser. It is the complete product.
Email security (SPF, DKIM, DMARC, MX), TLS certificates and configuration, HTTP security headers, DNS configuration, web application exposure, breach database exposure, and subdomain enumeration. 40+ individual checks across 7 categories, all from publicly available data.
No. Kekkai performs passive external reconnaissance only. We analyse publicly visible signals like DNS records, TLS certificates, HTTP headers, and breach databases. No active exploitation, no agents installed, no traffic generated that would trigger your WAF or IDS. Safe to run against production domains.
They are $25,000+/year vendor risk platforms designed for enterprises managing hundreds of third-party vendors. Kekkai is $149-$599/month and focused on helping you fix your own environment. They give you a score. We give you the exact DNS record to add, the PowerShell command to run, and the admin console path to change.
Yes. Managed SOC providers focus on detection, monitoring logs and responding to alerts. They rarely provide prescriptive hardening guidance, conditional access policy recommendations, or compliance-mapped reporting. Kekkai covers the advisory gap that SOC providers leave open. Send them the technical report as a fix list.
Very. The report either validates what your MSP has already done or gives them a prioritised list of what they have not. Either way, you get visibility into your posture without relying solely on your provider to self-report.
Essential Eight (ASD maturity levels), CIS Controls v8 (implementation groups), ISO 27001 (Annex A controls), ASD ISM (security guidelines), and CPS 234 (APRA Section 26). Every finding is automatically cross-referenced so you know exactly where you stand before your next audit or insurance renewal.
That is one of the primary use cases. Findings are flagged for insurance relevance. The executive report is formatted for board packs and broker submissions. The PDF includes compliance mapping and posture scoring that underwriters can reference directly. Several findings map to the specific technical questions insurers now ask about email authentication, encryption, and access controls.
Australia. Scan results are stored for historical comparison and posture trending. Data is never sold, never shared with third parties, and never used for purposes beyond your account. Results are automatically deleted after 30 days if you do not create an account.
Under 90 seconds for most domains. The scan runs all 7 categories in parallel with per-check timeouts. Large domains with many subdomains may take slightly longer. Results are available immediately on completion, no email delivery delay.
Run your first scan. It takes 90 seconds.
No signup. No credit card. No sales follow-up.
Over 7 categories and 40+ checks. Free, forever.