ReadySECURE™ Scanning Service

What ReadySECURE webscan is

ReadySECURE webscan is an authorized vulnerability scanning service for websites, APIs and internet-facing hosts you control. You add a domain, confirm in writing that you are authorized to have it tested, and we scan it with six industry-standard scanners on your schedule — returning a prioritized report of what was found, how serious it is, and how long it has been open.

It is built for people who want the real scanners — not a lightweight imitation of them — run continuously, with the authorization record kept alongside every result.

What do you scan for?

Six scanners, and every plan runs all six. Withholding one would mean telling you we found nothing on a class of problem we never looked for.

What is included in a free scan?

One full scan of one target, with any of the six scanners, and the complete report that comes with it. No card, no plan, no call. A free scan is not a cut-down preview — it is the same scanner, the same depth and the same findings a paying customer gets.

What you do not get for free is repetition: scheduling, history and trend need a plan, because the cost of this service is the machine time it takes to run scanners over and over.

What assets can I scan?

• Websites and web applications — including specific paths, so a single host can be scanned at more than one entry point.
• APIs and webhook endpoints — anything that answers over HTTP or HTTPS.
• Hosts and services on non-standard ports — port, service and version detection is part of every plan.
• TLS endpoints — protocols, ciphers, certificates and expiry, on any port.

The one rule: it has to be something you are authorized to have tested. That is a legal boundary, not a technical one, and it is the reason this service asks a question before it scans anything.

Is authorization required?

Yes, and it is enforced rather than assumed. Every target carries its own authorization record naming the person who approved it, the exact text they agreed to, and the date and time they agreed to it. A target without a current record cannot be scanned — the gate refuses it, and there is no setting that turns the gate off.

This matters more than it sounds. Unauthorized scanning is a legal problem in most jurisdictions, and "the tool let me" has never been a defence. When a complaint arrives about traffic to a host, the answer here is a signed record rather than a shrug.

How long does a scan take?

Most scans finish in a few minutes. Deep network scans can run for an hour or more, and are capped at three hours.

• Nmap, TestSSL, ZAP passive — usually a few minutes.
• Nuclei — minutes, depending on how much answers.
• ZAP active, OpenVAS — the deep ones. Tens of minutes to hours on a large estate.

Scheduled scans run overnight on your clock, and can be told to spread across several nights rather than piling into one window.

How are results delivered?

1. A report per scan — everything that run found, with severity, location and description.
2. A risk register across every target — one list, with status you set yourself: open, accepted, mitigated, false positive.
3. Aging — how long each finding has been open, and how the estate has moved month over month.
4. Spreadsheet export — the whole thing as XLSX, whenever you want it.
5. API and webhooks — pull results into your own tools, or be told the moment a scan finishes.

Findings are yours. Cancel a plan and your reports, history and exports stay available — scanning stops, the record does not.

How does it work?

1. Add a target. A domain, host or URL you control.
2. Authorize it. Read the statement, put your name and title to it. Bulk import takes one acceptance for a whole spreadsheet.
3. Pick the scanners and, if you want them repeated, a schedule in your own timezone.
4. Read the findings and set their status as you work through them. Re-scan to confirm a fix.

How is this different from a free online scanner?

Free one-off web tools are useful for a single look at a single page. They are a different kind of thing to this, in four ways:

• Full scanners, not lite versions. The same OpenVAS, ZAP, Nmap, Nuclei and TestSSL you would run yourself.
• Continuous, not one-off. A scan is a photograph. A schedule is a record of whether things are getting better or worse.
• State that persists. Accepting a risk, marking a false positive, and knowing something has been open for ninety days all require memory between scans.
• An authorization trail. Nobody hands you a signed record of who approved the test.

If you only want to look at one page once, use a free tool — that is what they are good at. This is for an estate you are responsible for.