What we call your exposure surface
Your company continuously publishes information on the internet, without anyone having decided to do so. This is not negligence, it is how the network itself works. For your customers to reach your site, the domain name system must publicly announce which machine hosts that site. For your e-mails to arrive, it must announce which server receives your mail. For your page to display, your server must respond to requests coming from anywhere.
All this visible information forms your exposure surface. It exists whether you monitor it or not. The only useful question is to know what it says about you, and whether it says things you would have preferred to keep quiet, such as the exact version of a piece of software that has not been updated in three years.
Why an attacker always starts there
Contrary to what films suggest, an attack almost never begins with a technical feat. It begins with reading. This phase has a name in the trade, reconnaissance, and it often represents the bulk of the work.
The reason is economic. A criminal group targeting SMEs does not relentlessly pursue one particular company: it examines hundreds of them, automatically, and concentrates its efforts on those that present the most flaws for the least effort. A domain with no protection against e-mail spoofing makes it possible to send a credible fake invoice the very next day. A server that announces an obsolete version indicates which known flaw to try first. In both cases, the attacker forced nothing: they read what you publish.
This is also the logic behind supply chain attacks: a poorly protected SME becomes the shortest path to a bigger, better-defended customer. And it is often the first link in a data theft, which begins with a plausible impersonation rather than a break-in.
Security headers, explained simply
When a browser requests your home page, your server returns the page, but also a series of invisible instructions, called headers. Some of these instructions tell the browser how to behave in order to protect your visitor. They cost nothing, slow nothing down, and many Swiss sites simply do not send them, because no one took care of it.
| Header | What it asks the browser to do |
|---|---|
| Strict-Transport-Security | Use only the encrypted connection, even if the visitor types the address without "https". |
| Content-Security-Policy | Load only the scripts and images coming from the sources you have authorised. |
| X-Frame-Options | Refuse to have your pages displayed in a frame on someone else's site. |
| X-Content-Type-Options | Do not guess the nature of a file, and therefore do not mistakenly execute what should be displayed. |
| Referrer-Policy | Do not reveal to other sites the full address of the page the visitor comes from. |
| Permissions-Policy | Deny access to the camera, the microphone and the location for third-party content. |
None of these headers on its own prevents a determined attack. Their absence signals something else, and that is what interests an attacker: it indicates that no professional has looked at this configuration in a long time. A site that sends them all is a monitored site. A site that sends none is an invitation to look further.
What this tool does not test, and why
An exposure analysis tool could go much further. It could scan the open ports of your server, guess your subdomains by trying thousands of names, attempt to access administration paths, or send malformed requests to see how your site reacts. These techniques exist and are legitimate as part of a penetration test, that is, with a written mandate.
This tool does not use them, for three reasons. They are intrusive, and nothing proves that the person entering a domain into a form is responsible for it. They are slow and noisy, whereas the point of an online tool is to give an answer in a few seconds. And on a system you do not control, they become legally questionable in Switzerland as elsewhere.
The result is a limit that must be accepted: a good score here does not mean that your information system is secure. It means that the shop window is properly kept. Your backups, your access rights, your workstations and your internal behaviours are not in scope, and that is precisely what the cyber check-up covers.
What to do with the results
Deal with the findings in the order of severity shown. High-severity points almost always concern e-mail, because e-mail spoofing is the most profitable attack vector against an SME. Medium-severity points concern encryption and server configuration. Low points are useful hardening, not emergencies.
Almost nothing can be fixed from your desk. These settings live with your host and your IT provider. Pass the result on to them as it is: the header and record names used here are the exact technical terms, which they will recognise immediately. A precise request usually gets a fix within the day.
Finally, run the analysis again after fixing things, then once a quarter. A configuration degrades over time: a certificate expires, a migration wipes headers, a new e-mail sending provider breaks an SPF record. The site's other free tools usefully complement this diagnosis.