Edge shows what the internet can see. Core checks what's behind the firewall, on devices you choose.
Plans from $29 a month. Cancel anytime.
See what the internet already shows about your domain. No account, no scanning of anything but public records.
We read only public DNS, certificate, and header information, exactly what any visitor's browser receives. We never scan a domain you haven't verified.
Shows what the internet can see.
Checks what's behind the firewall, on devices you choose.
Why monthly
When a vendor opens a port for remote support, or a certificate quietly expires, a monthly scan catches it in weeks instead of months. Run an extra scan any time you make a change you want to double-check.
Product tour
How it works
Prove you control it with a DNS record, an uploaded file, or an email to your IT admin address. We only ever scan what you've verified.
_torva.example.com TXT
"torva-verify=7f3a91c2"Edge looks at your systems the way an attacker would: open ports, encryption, web settings, known vulnerabilities, email security, and logins.
Work through the fix list, rescan to confirm, and track your score month over month. Add Core when you're ready to look inside.
What Edge checks
Built on proven, widely used open-source scanning engines, with every result translated into what it means and what to do about it.
Open ports and the services behind them, like Remote Desktop, file sharing, or old admin panels that shouldn't face the internet.
Certificate expiry, outdated TLS versions, and weak ciphers that fail compliance checks and browser standards.
Missing security headers, directory listings, version banners, and cookies sent without protection.
Software versions matched against published vulnerability databases, so you know when something needs patching.
SPF, DKIM, and DMARC records that stop criminals from sending email that looks like it came from you.
Every internet-facing login we find, with an honest read on whether multi-factor authentication protects it.
Built to be trusted
No domain can be scanned until its owner proves control. Free email addresses can't create accounts.
Results are also sent to the address that verified the domain, so the real owner always knows a scan ran.
Scans come from a published list of IP addresses with clear reverse DNS, so your firewall team always knows it's us.
The inside agent never opens a port. It reaches out to us, runs only on devices you approve, and can be paused any time.
Scans are rate-limited and non-destructive. We look for weaknesses; we never try to exploit them.
Payments are processed by Stripe. Torva never sees or stores your card number.
Pricing
One website or office, checked every month.
For IT teams who want to check every change.
Outside and inside, for organizations with more at stake.
Billed monthly. Change plans or cancel anytime from your account.
Questions
No. Torva is automated vulnerability scanning. It finds known weaknesses and misconfigurations quickly and repeatedly. A penetration test adds a human who tries to chain weaknesses together, and many organizations use both: Torva every month, a manual test when compliance calls for one.
Scans are rate-limited and non-destructive. We identify weaknesses without exploiting them, and you can schedule scans outside business hours.
You add a DNS record, upload a small file to your website, or click a link we send to an IT admin address like admin@ or webmaster@ at the domain. Until one of those is done, the domain can't be scanned.
A small agent on a machine you choose. It connects outbound to Torva, so no firewall ports are opened, and it scans only the devices and address ranges you approve. You can pause or remove it at any time.
We publish our scanner addresses so your firewall and monitoring tools can recognize them. You can allowlist them or simply watch for them.
Yes. Cancel from your account and your plan stays active until the end of the billing month.
Start with an Edge scan today. Your first report shows exactly what the internet can see, and what to fix first.
Start with Edge