Business Acquisition Security Scan – A Pre-LOI Red-Flag Screen From Public Records

The public record on a business you are about to buy from, sell to, connect to or acquire — before you sign.

The Business Acquisition Security Scan is a pre-LOI red-flag screen assembled from public records only. It reads the breach indexes, the certificate history, the published email and DNS settings, the lookalike domains registered against their name, the public code repositories and criminal leak listings, and who actually controls the domain you would be buying. It visits their website only as an ordinary browser would, a handful of times, and never scans, probes or tests their systems. It is authorisation-gated: you name the target, type its domain twice, and state your basis — and that is printed on the report.

What's included

• Organizational Breach & Exposure History — public breach indexes, leak listings, certificate and repository history ($149)
• Digital Asset Register & Ownership Check — who controls the domains, expiry, transfer lock, supplier map ($79)
• Domain & DNS Security Check — registrar lock, DNSSEC, dangling subdomains ($39)
• Business Impersonation & Typosquat Sweep — lookalike domains already registered against them, and which can send mail ($49)
• Email Spoofing & BEC Check — SPF, DKIM and DMARC, the best free proxy for operational maturity ($39)
• Certificate & Encryption Check — certificate hygiene, another maturity signal ($19)
• Digital Footprint Report — the public footprint of the business and its principals ($49)

Why it is priced this way

The seven scans inside cost $423 bought separately, and this scan costs more than that on purpose. What you are paying for is not the lookups. It is one deliberate authorisation step recorded on the cover; one target per run, never a batch; every finding carrying its source and retrieval date; any Critical finding held for human review before it is sent; and a red-flag summary ordered by what would change a price or a warranty — a domain about to expire or not transfer-locked, a domain registered to a departed individual, breach history, no DMARC enforcement, live lookalike domains, secrets in public repositories — each paired with the question it should make you ask. Your alternative is an hour of an advisor's time or a third-party risk platform, not a free scanner.

What you get

• One written PDF report emailed back to you, typically within one business day.
• A red-flag summary ordered by what would change a price, a warranty or a decision.
• The question each red flag should generate, which is the thing a screen like this is actually for.
• Every finding with its source and retrieval date; any Critical finding held for human review before it is sent.
• Named coverage gaps for anything that could not be checked — never quietly counted as a pass.
• The authorisation record — target, domain, basis, mode, time and operator — printed on the cover.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Buyers, brokers and diligence advisors, and any business about to give a supplier access to its systems. It tells you whether to commission a full engagement and what to ask in it.

Requirements

• Windows 10 or Windows 11
• No administrator rights needed
• An internet connection
• The target's legal name and main domain, typed twice
• You must own or control the organisation, or hold written authorisation or a signed engagement covering it — you choose one of those two, there is no third option, and your choice is recorded on the report
• About 25 minutes

What this is not

QuickScan is detection and advisory only. In this scan that boundary is structural: the products that scan ports, probe websites or test storage are not in it, and a test fails the build if anything opens a connection to the target beyond three ordinary page requests. It does not assess that organisation's security and cannot tell you whether their internal controls are sound. It is not cyber due diligence and is not a substitute for it. It is not a certification, an audit or an attestation. The report describes what the public record shows, as at the date it was retrieved, from the sources it names.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.