No break-in attempts. No password guessing. I only read what your server already announces to the public internet: the same information a hacker can see from their desk.
The free security check only reads what your business already shows the public internet. It never tries a single door.
Scouts go out first, so you only walk into ground that has already been checked.
Where that comes from
Every finding is checked against live public records, with a control check first.
MEASURED
6,314 test cases
in the main TITANOS engine, plus automated safety suites on the control layer
A pilot's pre-flight checklist, run before every take-off instead of once.
Where this number comes fromCount of test functions in the main engine, 9 October 2026, via lib/ledger.json
Method: one full pass of our own test suite, recorded 8 October 2026. The same habit applies to the security check: every finding is checked before it reaches you. Before you ask, it reads public records only, touches nothing of yours, replaces nobody, leaves your IT provider in charge, and costs nothing.
If nothing is touched, what exactly gets read?
The rule this whole practice runs on
I read what the internet already broadcasts. I never try a single door.
Everything below is the same rule written out in detail: what gets read, what gets left alone, and how you check I kept my word. Worth asking: could a stranger run the same checks on your own site right now?
01 / 09
What I Check · What I Never Do
Public-facing information only. I read what the open internet can already see: nothing private, nothing that requires a login.
What I Scan
✓Open ports on your domain (standard 15-port sweep: what services are publicly listening)
✓Service banners (the version information your software announces when a connection is made)
✓TLS/SSL certificate validity, expiry, and protocol versions (encrypted connection check)
✓DNS records (publicly resolvable subdomains and email security records)
✓Known software vulnerabilities matching the reported service versions (CVE database)
What I Don't Do
✗Authentication attempts (no password guessing, no credential stuffing)
✗Exploit attempts (I never try to use a vulnerability I find)
✗DoS / DDoS / brute force / aggressive scans
✗Data exfiltration (I never read DB contents, file contents, email contents)
✗Phishing of staff (I do not email or call your team to test them)
✗Physical / social engineering tests
02 / 09
Tools Used
Industry-standard open-source security tooling: the same tools your auditors and threat-modellers use.
›nmap with banner detection (-sV): port + service identification
›openssl s_client: TLS validation
›curl with custom headers: HTTP response inspection
›dig + crt.sh: DNS + certificate-transparency lookups
›NVD CVE database (publicly licensed) for version → known-vuln mapping
No proprietary black box · every tool here is public and inspectable
And if something is found, who hears about it first?
03 / 09
Your 90-Day Window to Fix Before Anything Is Published
Every Titanos finding ships with a 90-day responsible disclosure window. If a recipient needs more time to remediate, I extend it. I do not publish, sell, or share findings with third parties during that window.
This is the same 90-day window followed by national security agencies (AustCERT, CERT NZ, CSA Singapore) and security researchers worldwide. It gives your business time to fix the issue before anyone else knows it exists.
04 / 09
Scope
I only scan a domain you or your authorised representative asks me to check. Outside that, I read public DNS records only. I do not scan:
›Companies that have asked to be removed (suppression list honoured forever)
›Domains that don’t resolve or have no public services
05 / 09
What You Get
The standard external scan output:
›Findings ranked by severity (Critical, High, Medium, Low, Info)
›For each finding: the evidence, the affected port/service, and a remediation step
›For each finding: reproduction command (so your engineering team can verify independently)
›Summary suitable for sharing with auditors, insurers, or your board
06 / 09
How I Deliver
Free protective disclosure: a plain-text report emailed direct to your inbox from kyle@titanos.tech within 2 business days. No signup. No portal to log into. Reply to the email if you need the findings in a different format for your auditor.
Every finding ships with the exact nmap -sV {target} -p {port} command I ran. Copy it, run it yourself, and you will get the same result. Independently verifiable in 30 seconds.
III
Email Kyle directly
Email kyle@titanos.tech directly to confirm any communication is genuine. (This is the footer/about contact mention. Not a scan request route. Use the form on /scan for that.)
08 / 09
Questions I get
No. I only read what your server already broadcasts to the public internet: no login attempts, no password guessing, nothing invasive. See "What I Never Do" above.
Scan results are kept to track exposure trends over time. Your email is only used for the contact list, never sold, and suppressed immediately if you reply "remove".
Kyle Deligny, one operator, Brisbane. ABN 34 318 502 254, verifiable on the Australian Business Register. Every finding ships with the exact command used to find it.
09 / 09
Removal
Reply remove to any email from me and your domain is suppressed permanently. I honour the request immediately. And would it be okay if I ran the free check on your domain? A no is welcome.
ΩNine sections. Every commitment reproducible. Nothing here moves for a sale.
Straight answers, before you ask
Yes, and here is how. Nothing we build goes live until it passes thousands of automated checks, like a pilot's pre-flight checklist, every single time. Anything important (money, legal, anything sent out, anything that cannot be undone) needs a person's tap first. Everything the system does is recorded.
No. Nobody gets replaced. Think power steering, not a self-driving car: you still drive, it takes the strain off your arms. Your people stay and get their hours back from the repetitive parts.
The industry-standard COCOMO model sizes the TITANOS build at about 24 engineers for about 31 months (MODELLED). One person built it in about 5 months, with 6,314 test cases guarding it. The method is shown in full on the Engineering page, so you can check it yourself.
The first conversation and your report are free. After that the prices are published and you know yours before anything starts: Titanos Monitor AU$149/mo, the Privacy Act compliance pack AU$5,997, and AI retainers from AU$1,500/mo (3-month minimum). You pay for the result, not an open taxi meter.
Right beside you. This sits next to your IT provider, nothing goes live without passing the checks, and you keep control of every change. If it helps, I am happy to talk to them directly.
1. You message me. 2. We have a free half-hour where you tell me what is slowing you down. 3. I send you a free report on your business, so you can see what I see. 4. If you like it, you get a price before anything starts. If it is not for you, that is completely fine and the report is still yours.
Start with a free consultation and a free report on your business
I am Kyle, the founder of TITANOS. If you like me, you like the business and you like the offer, or we can shape it into something that works for you, would you be happy to start with a free half-hour? You leave with a clear picture of what you could do next and a report of your own. A no is welcome.