ThreatVector · TommyGun

See TommyGun before you install it.

Every screen of the real application, in order, from opening the library to reading the report — plus the anatomy of the PDF that lands in your inbox. These are screenshots of the shipping build, not mock-ups.

Download it free Browse the scans

Part one — the app

The Scan Locker

One window holding the whole library. Scans you own are live. Scans you do not own stay visible and dimmed, so you can always see what else is there and what it checks.

01

The whole catalogue, on one screen

Every scan in the library as a card — name, what it checks, what it needs from you, and its price if you have not bought it yet. Nothing is hidden behind the purchase; you can read what a scan does before you decide.

02

Grouped by what it protects

Cards are grouped by category — this computer, network and Wi-Fi, website and domain, email and identity, data and cloud. The Coverage Level in the header is computed from categories covered, not from how many scans you own, so a shelf full of network scans will not read as full protection.

03

Bundles and quarterly plans

Full Service and Quarterly packages run every scan they contain back to back and produce one combined report — including how an attacker could chain findings from different scans together into a single route in.

04

Your history, on the card

After a run, each card carries its own history — when you last ran it and how it went — so you can see at a glance what has gone stale.

Part two — running a scan

The same five steps, every single scan

There is no command line and no configuration file. Learn the wizard once and every scan in the library works identically — a single endpoint check and a twelve-scan quarterly bundle included.

Step 1

Consent — before anything runs

Every scan opens by telling you exactly what it will look at, what leaves your machine, and what it will not touch. Nothing starts until you agree. This screen is also where a scan admits what it cannot do.

Step 2

Details — in plain language

The scan asks for what it actually needs and nothing else: a domain, an email address, a folder. Each field explains itself. Anything sensitive is masked as you type and is deliberately kept out of the technical log.

Step 2b

It catches your typos, not the scanner’s

Fields are validated before the scan starts, so you find out you mistyped your domain immediately — not eight minutes later in a report full of nothing.

Step 3

Review — last look

A summary of everything you entered and everything about to run, with secrets shown masked. This is the last point at which you can change your mind.

Step 4

Scan — with the receipts on show

A progress bar and a plain-English status line, over a collapsible technical console carrying the raw output if you want it. Stop at any point and nothing is sent.

Step 5

Results — and where the report went

Severity tiles, the top findings in summary, and an explicit statement of what happened to your report — emailed, or saved locally, and where.

Part three — the part most tools hide

When something fails, it says so

A security tool that reports a failure as a clean result is worse than no tool at all, because you stop looking. TommyGun is built so that cannot happen quietly.

A failed delivery looks like a failed delivery

If the report could not be emailed, the app tells you, tells you where the file was saved instead, and gives you a button to open that folder. It will never print “your report is on its way” over a send that did not happen.

An unreadable result is not a clean result

If a scan finishes but its output cannot be read, you are told the output could not be read. You are never shown “0 findings” for a file nobody successfully opened.

Stopping is not passing

Press Stop and the results screen says the scan was stopped. It does not quietly report on the partial data it happened to collect.

A skipped check is listed as skipped

Every report ends with a coverage ledger naming each check that ran, could not run, or was skipped, with the reason. Gaps are visible, not absent.

Part four — two real scans

What a scan actually asks you

Internet Exposure Scan — EXPOSURE-06

Give it a domain you own. It finds what of yours is reachable from the public internet — open services, forgotten subdomains, admin panels that should not be answering the door.

Code & Secrets Scanner — SECRETS-27

Point it at a project folder. It looks for API keys, passwords and tokens committed into source code — one of the most common ways small businesses lose control of a cloud account.

Part five — the deliverable

Anatomy of your report

Every scan produces the same document structure, whether you ran one check or a twelve-scan bundle. It is written to be read by the business owner first and the technician second.

01

Cover

Report title, the product that produced it, who it was prepared for, the target, scan and report dates, a scan reference, the framework badge, and the confidentiality, AI-production and no-conflict-of-interest statements.

02

Contents

A real table of contents with page numbers, plus PDF outline bookmarks so you can jump straight to a section in any reader.

03

Executive summary

Plain English, business impact first, your score and band, and an “if you fix only these things, fix these” shortlist you can act on today.

04

Your security snapshot

The visual page: a risk-score gauge, a coverage dial showing how much of the intended scan actually ran, a severity distribution bar and a breakdown of where the risk sits by category.

05

Framework alignment

Findings mapped to NIST Cybersecurity Framework 2.0 by default, with coverage shown by function — and a clear statement that a mapping is not an audit.

06

How the scan was performed

Phases, tools and techniques, the safeguards applied, and the standards the work was written to. What was in scope, and explicitly what was not.

07

Detailed findings

A summary table, then one block per finding in a fixed structure: what it is, why it matters to you, evidence, severity, and how to fix it.

08

How an attacker could chain these

Entry, movement, objective — with a diagram on bundle reports. Individually minor findings are often a route in when combined, and this is the section that shows it.

09

Your action plan

Priorities P1 to P4, each with the action, a fallback mitigation if you cannot do the main fix, and the class of control it belongs to.

10

Coverage — what ran and what did not

A per-check ledger: ran, could not run, or skipped, each with its reason. A check that failed appears here rather than disappearing into a silent pass.

11

Limitations and assumptions

What this scan could not tell you, and what it had to assume. Written to be read, not buried.

12

Technical appendix

The complete finding log, how severity and the score are calculated, scan metadata, and where to send questions.

Sample report

Read a full report before you buy a scan

A complete, unedited sample report — run against a fictional company on a test network, with every section, chart and framework mapping intact. Ask and we will email it to you.
Request the sample report

Ownership and attribution

TommyGun is developed by ThreatVector LLC.

Reporting mechanisms and cybersecurity customer service are powered by ThreatVector LLC.

ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.

Use of TommyGun and the QuickScan scan products is governed by our Terms of Service. Scans may be run only against systems you own or are authorised in writing to test.

Seen enough

The app is free. Start there.

Install it, look around the library, read what each scan checks. Buy one when you know which one you want.
Download TommyGun free What TommyGun does