The automated security advisor for mid-market organisations
External posture assessment across 7 categories. Exact fix commands, board-ready and technical reports in under 90 seconds. The free first step into continuous, prescriptive guidance.
Free. No signup.
Built by the team that managed security operations for Petbarn, IGA, and Australian government agencies. We’ve seen what breaks from the inside.
The Problem
Security for the Australian mid-market runs on annual consultant engagements, a managed SOC retainer, and whatever your engineer can fit between tickets. It adds up to six figures a year, and none of it compounds. Here is where the money goes.
A $52,800-a-year snapshot, stale before the invoice clears.
Threat modelling, posture assessments, compliance evidence, board reporting. All consultant-priced at $200-$500 an hour. The PDF lands, the environment keeps drifting, and next year you buy the same snapshot again.
Your SOC watches. It doesn’t fix.
Managed detection is built for alerts, not advice. No prescriptive hardening, no conditional access guidance, no fix commands. The agreement says monitoring, and that is exactly where it stops.
Three audiences. Three reports. One of you.
The board wants plain language. The broker wants evidence for renewal. The engineer wants the exact record to change. Every quarter someone, usually you, translates one posture into three documents by hand.
The Platform
Prescriptive guidance across your external posture, M365 tenant, conditional access policies, and Essential Eight maturity. Reported for two audiences, mapped to your compliance frameworks, and priced for organisations that aren’t enterprise.
CRITICAL | Subdomain takeover risk
staging.example.com.au CNAME → staging-app.herokuapp.com (NXDOMAIN)
FIX | Remove dangling CNAME or reclaim the Heroku app
VERIFY | $ dig CNAME staging.example.com.au
- Require MFA for all users
- Block legacy authentication
- Require compliant devices for admin
JSON policy templates for Entra ID
Why Kekkai
Insurance-aware
Australian-built
# Fix DMARC enforcement
_dmarc TXT "v=DMARC1;p=quarantine; rua=mailto:dmarc@co.au"
# Enable DNSSEC
Cloudflare > DNS > Settings
Enable DNSSEC > Copy DS record
Dual-layer reporting
“improve your email security configuration.”
_dmarc TXT “v=DMARC1; p=quarantine”
Core difference
No Gates, No tricks
Pricing
External scan
Continuous monitoring
What’s next on the platform
A guided, repeatable Essential Eight self-assessment, mapped to ASD maturity levels with prescriptive remediation.
Get early accessContinuous, prescriptive guidance across your Microsoft 365 and Entra tenant, against CIS and Essential Eight, with board and insurer reporting.
Talk to usMulti-tenant dashboard and white-label dual-layer reports for partners, billed per tenant.
Talk to usAll prices in AUD, exclusive of GST.
FAQs
Yes, always. No signup, no credit card, no trial that expires. Enter your domain, get a full 7-category assessment with both executive and technical reports. The free scan is the front door to the platform, and it stands on its own.
Email security (SPF, DKIM, DMARC, MX), TLS certificates and configuration, HTTP security headers, DNS configuration, web application exposure, breach database exposure, and subdomain enumeration. 40+ individual checks across 7 categories, all from publicly available data.
No. Kekkai performs passive external reconnaissance only. We analyse publicly visible signals like DNS records, TLS certificates, HTTP headers, and breach databases. No active exploitation, no agents installed, no traffic generated that would trigger your WAF or IDS. Safe to run against production domains.
Kekkai is an automated security advisor for your own environment, not a third-party risk rating. Rating platforms score how risky an organisation looks from the outside. Kekkai tells you exactly what to fix, the DNS record to add, the command to run, the console path to change, mapped to the frameworks your board and insurer ask about.
Yes. Managed SOC providers focus on detection, monitoring logs and responding to alerts. They rarely provide prescriptive hardening guidance, conditional access policy recommendations, or compliance-mapped reporting. Kekkai covers the advisory gap that SOC providers leave open. Send them the technical report as a fix list.
Very. The report either validates what your MSP has already done or gives them a prioritised list of what they have not. Either way, you get visibility into your posture without relying solely on your provider to self-report.
Essential Eight (ASD maturity levels), CIS Controls v8 (implementation groups), ISO 27001 (Annex A controls), ASD ISM (security guidelines), and CPS 234 (APRA Section 26). Every finding is automatically cross-referenced so you know exactly where you stand before your next audit or insurance renewal.
That is one of the primary use cases. Findings are flagged for insurance relevance. The executive report is formatted for board packs and broker submissions. The PDF includes compliance mapping and posture scoring that underwriters can reference directly. Several findings map to the specific technical questions insurers now ask about email authentication, encryption, and access controls.
Scans run without an account are retained for up to 24 months so you can track how a domain's posture changes over time, then anonymised. If you have an account, your scan history is kept for the life of the account and removed within 30 days of deletion. Full detail is in our Privacy Policy.
No signup. No credit card. No sales follow-up
Over 7 categories and 40+ checks. Free, forever.
