NIS2 asks for evidence of effectiveness
Read more
Security you can prove.
Continuously.
More than a vulnerability scan: Tracer finds the ways into your systems and proves which ones really work.
Then we make sure every fix holds — documented in an evidence dossier your auditors can use.
Auditors ask for evidence.
Do you have it on file?
Annual snapshot
One test, once a year.
Findings rated in isolation.
No proof the fix worked.
Evidence stale by the next release.
With Tracer
Only what is really exploitable.
Linked the way an attacker would.
Proof for every finding.
Every fix re-tested.
When was your surface last checked?
For most companies, months ago.
An annual pentest or audit proves what was true on the day it ran. Every release, dependency and new vulnerability after it goes unchecked until the next one.
Annual pentest
Days since the last check
Dozens of releases since. None of them checked.
With Tracer
Days since the last check
Re-checked on a fixed cadence — and after every release.
Tracer finds the way in before attackers do.
Then proves it’s closed.
Tracer runs on AI models trained for offensive security work. It uses purpose-built tools, remembers every earlier cycle and learns from each result — and a certified tester reviews everything it finds.
01
Find every way in
Domains, subdomains, logins, APIs and third-party code — everything reachable from outside, mapped again every cycle so nothing new slips through.
02
Prove what really works
Weak spots are linked into attack paths, and each path is validated with a controlled exploit. You get proof and a clear priority — never a guess.
03
Make sure the fix holds
After your fix, the same attack runs again. A finding only closes when it no longer works — with the result in your dossier.
Tracer finds what’s there.
And never invents what isn’t.
Three Tracer runs on three very different systems. Each took minutes, every result came with evidence, and on live systems a person approved every intrusive step.
Live application
3
findings on a hardened live application: 1 medium, 2 low
Everything else was tested and recorded as clean. No inflated alerts, no padding.
Hardened server
9
findings in a vulnerable application, 1 of them critical
The well-configured server underneath was correctly rated clean — strong parts and weak ones told apart.
Test system
Minutes
from first look to full evidence on a deliberately weak test system
When a path exists, it goes all the way, end to end, with proof for every step.
What a real run looks like.
Every finding, with proof.
23
findings after consolidation
13
positive controls verified
17
prioritised measures, P1–P3
100 %
of findings backed by evidence
Reference finding 01
CONFIRMED · MEDIUM
Incomplete certificate chain
The server sends only the leaf certificate. Clients that don’t fetch intermediates themselves fail validation — integrations break.
3
client families fail validation
Reference finding 02
CONFIRMED · MEDIUM
Payment script without integrity check
The checkout loads a third-party payment SDK without Subresource Integrity — a supply-chain path to card skimming.
0
integrity checks on the payment script
Reference finding 03
LEAD · NOT VALIDATED
Admin API in scope
Public metadata reveals an admin API scope on the identity provider. Only an authenticated test can confirm or rule it out.
T3
handed to human-led testing
Everything else we tested held — and the dossier lists exactly what was tested. The next questions sit behind the login: payment status, authorisation, admin access. That is where Tracer Deep Dive goes.
A scanner tells you what might be wrong.
Tracer proves what is.
Scanners match software versions against lists. An annual pentest goes deep — once. We go deep every cycle and back every finding with proof.
Question
Vulnerability scanner
Annual pentest
Tracer
How often you are tested
Continuously, but shallow
Once or twice a year
Every cycle — and after every release
Is the risk proven?
No, it is a guess
Yes, on the day it ran
Yes, with a validated exploit
Weak spots linked together
No
Sometimes
Yes, into real attack paths
What lands with your team
Thousands of alerts
A long report
A short list, ranked by real risk
Is the fix checked?
Not really
At the next test
Re-tested, then closed
Evidence for auditors
Raw exports
One report a year
A dossier that stays current
See the difference on your own domain.
Start free.
Go as deep as you need.
Each tier builds on the one before: Tracer Check shows what is visible, Tracer Continuous proves what is exploitable, and in Tracer Deep Dive our testers go as far as an attack can.
T1
Free
Tracer Check
The outside view: what anyone on the internet can see about your domain. No effort on your side.
TLS, certificates and cryptography
Security headers and CSP
Exposed hosts and services
Login and identity surface (passive)
Free · one domain · one-off
T2
Continuous
Tracer Continuous
Tracer tests your surface on a fixed cadence, validates what is exploitable and re-tests every fix.
Exploits validated, with proof
Measures ranked P1 to P3
Re-test after every fix
Evidence dossier, every cycle
Monthly or quarterly · fixed price
T3
Human-led
Tracer Deep Dive
Our certified testers take the deepest paths further: payment flows, authorisation and business logic, end to end.
Authenticated testing
Business logic and payment integrity
Full attack chains, end to end
Signed report for auditors
Scoped per project
Fix what matters first.
Prove the fix worked.
See how we prioritise findings and verify fixes on your own domain.
Findings · ranked P1–P3
3 ranked
P1
Payment script without integrity check
Card data path through third-party code
P1
Incomplete TLS certificate chain
Integrations fail validation
P2
Legacy OAuth flows enabled
Wider token exposure
01
Start with what is most exposed.
Every finding is ranked P1 to P3 by what is actually reachable — not by a generic severity score.
Confirmed findings and leads are never mixed
Each finding carries the evidence behind it
A priority you can defend to management
Measure · TLS chain
Fixed
ssl.conf
41
SSLCertificateFile shop.crt
42
+ SSLCertificateChainFile chain.crt
43
SSLProtocol -all +TLSv1.2 +TLSv1.3
Owner · IT provider
Scope · one host
02
The exact fix, in plain words.
Every priority ships with a concrete measure your team or IT provider can act on: the setting, the header, the certificate.
Written for whoever owns the system
Fix P1 first — the list says what is next
Your team makes the change — we don’t change your systems.
Re-check · same test, repeated
Chain verified
Same check
Chain check
Dossier entry
Re-checked after the fix:
full chain served.
Finding closed, evidence logged.
03
Closed means the re-check passed.
Not that the ticket was closed. We run the same check against the fixed system and record the result in your evidence dossier.
The same check, repeated after the fix
Result and date logged, tamper-evident
A finding closes only when the re-check passes
Every surface you expose.
Checked on your schedule.
Pick the cadence. Every release, infrastructure change and fix is re-checked on top.
What we check
Web applications
Identity & login
TLS & certificates
Headers & CSP
DNS & subdomains
Third-party scripts
When we check
On your schedule
Monthly
Quarterly
Custom
And on every change
Every release
Every infrastructure change
Every fix, re-checked
Autonomous testing.
Inside the lines you draw.
Authorised scope
Domains and boundaries confirmed in writing before the first request.
The agreed scope, in writing
Human sign-off
Every report is reviewed by a certified security professional.
Reviewed findings, signed off
Auditable evidence
Every check, finding and fix logged in a tamper-evident dossier.
A record you can hand an auditor
Controlled exploitation
Exploits run only inside the agreed scope, step by step and logged. No denial-of-service, nothing left behind.
Proof, without lasting changes
Verified remediation
A fix counts once the re-check passes — not when a ticket closes.
A re-check result for every fix
Who is behind it
Led by David Lott
OSCP-certified penetration tester, lecturer at Harz University of Applied Sciences and ISO 27001 CISO. The people who build Tracer test by hand in Tracer Deep Dive.
01
Is this just a vulnerability scan?
No. A scanner compares software versions with a list of known issues and stops there. Tracer, our AI system, is trained for offensive security work: it links weaknesses into attack paths, validates each one with a controlled exploit, remembers what earlier cycles found and re-tests every fix. A certified tester reviews every result before it reaches you.
02
What do you need from us for the free Tracer Check?
03
Can the analysis disrupt our systems?
04
How does this help with NIS2?
05
What does our team receive?
06
What does it cost?
See what the internet sees.
Free, for one domain.
Name your domain. Within a few working days you receive a short report with your top findings and the first measures to take — without obligation.
No installation, no credentials, no network access
One domain, analysed from the outside only
Reviewed by a certified tester before it reaches you
Nothing runs until your authorisation is verified
Point Tracer at your domain.
See what an attacker would find.
Continuous security assurance, shaped around your systems. Start with the free Tracer Check — then we talk about scope and cadence.