FAQ
CyberEnforced FAQ
Short answers on domain scans, cyber insurance, questionnaires, MSP workspaces, pricing, and privacy.
Scanning
What does the free domain security scan check?
The preview looks up SPF, DMARC, seventeen built-in DKIM selectors, one optional selector you type, MTA-STS, TLS-RPT, and the TLS certificate on port 443. It also glances at four HTTP response headers on the first response and does not follow redirects. That glance is not part of the score and is not the saved scan. The preview score is out of 100: SPF 20, DMARC 20, DKIM 15, MTA-STS 12, TLS-RPT 8, and TLS 25. In place scores the full weight, needs review scores half rounded down, and a gap or an unknown scores 0. That number is not the saved-scan score. A saved scan on a free account also covers DNS, HTTP security headers, open ports, WHOIS expiry, and subdomain discovery. DKIM, MTA-STS, and TLS-RPT findings on a saved domain are Pro checks.
Do I need an account to run the preview?
No. Enter a public hostname and the preview runs. An account is how you save the domain, run the fuller scan, and share a report. Free accounts can run Scan now once per domain per day. Pro adds a daily schedule.
Is the public preview safe to run on a domain I administer?
It reads DNS records that are already published. When MTA-STS is published, it reads the policy file from a public address for the mta-sts hostname and does not follow redirects. It does not contact a TLS-RPT report address. It opens one TLS connection to port 443 and sends one HTTPS GET for a header glance. It does not follow redirects, sign in, change DNS, try other ports, or guess subdomains. Run it on a hostname you are responsible for.
Does the preview save my results?
The preview does not add the domain to an account. After a check you can create a 24-hour link. That link is a signed snapshot, not a saved report, and it stops working after 24 hours. It cannot be turned off from a dashboard. Create an account for CSV, PDF, or a revocable report link.
Why might DKIM say a key was not found when my provider signs mail?
The preview checks google, selector1, selector2, default, k1, s1, s2, dkim, mail, k2, k3, fm1, fm2, fm3, protonmail, zoho, and selector. You can type one more selector. It is looked up only as that label under _domainkey. "Not found" means the names that were checked had no usable DKIM TXT record. It is not proof that DKIM is absent. A selector you did not enter can still be valid. The sample illustration does not look up a selector you type.
How is the preview different from Scan now?
Scan now queues the full domain scan for an organization you belong to. The preview is a smaller no-account check of mail authentication and TLS, with a score out of 100 for that check only. It does not create findings or a saved account score. An optional 24-hour link is a signed snapshot of that preview. It is not the revocable report link from an account.
Can I paste a URL or an IP address?
A URL is reduced to its hostname. IP addresses are refused on the public preview. After you sign in, an organization can add public IPv4 addresses under IP scans.
What does DMARC p=none mean?
The domain publishes DMARC in monitor mode. Receivers are not instructed to quarantine or reject mail that fails authentication. p=none is not the same as having no DMARC record, and it is not the same as p=quarantine or p=reject.
Cyber insurance
Will this check get my company cyber insurance?
No. Carriers decide coverage, price, and which evidence they accept. CyberEnforced does not quote, bind, or guarantee a policy. The readiness page maps common application questions to checks we can actually show.
Which application questions can a domain scan support?
Email authentication and TLS on the hostname you check. SPF and DMARC are on the preview and on free saved scans. The preview checks built-in DKIM selectors, one optional selector you type, MTA-STS, and TLS-RPT. Saved DKIM, MTA-STS, and TLS-RPT findings are Pro checks. The scan does not prove that every message is signed.
Does CyberEnforced prove we use MFA?
It can show opt-in TOTP on CyberEnforced accounts. It does not read Microsoft 365, Google Workspace, a VPN, or any other identity provider. Answer the MFA question from those systems.
Can I attach a CyberEnforced report to a renewal?
After you save the domain on an account, you can download CSV or PDF findings or send a revocable report link. The recipient does not need a login. Turn the link off when the review is done. Do not send the sample illustration.
Does staff training show up on the domain scan?
No. Training & Awareness is a separate add-on on Pro. It assigns catalog courses and records who passed. A carrier may still want its own course, or a longer history than you have.
What will a domain scan not answer on an application?
Backups, endpoint detection, office firewalls, MFA on other systems, and whether a carrier will bind a policy. GRC evidence is a notes field, not an automated pull from AWS, Okta, or GitHub.
Questionnaires
Can CyberEnforced fill out a security questionnaire?
No. It gives you evidence for technical rows such as SPF, DMARC, TLS, headers, ports, and expiry on a saved scan. You still write the answers. Policies, risks, vendors, and training are add-ons when the form asks for them.
What should I send the customer?
A current findings export or a revocable report link, plus the policy or training evidence the form actually requests. Send the sample illustration to nobody. It is not a scan of a real customer.
Do subdomains count against the free domain limit?
No. Free includes 2 domains. Subdomains discovered under them stay free and uncounted. Pro includes unlimited domains, and subdomains still do not count against a limit.
Are shareable report links public?
Anyone with the link can view that report until you revoke it. The recipient does not need a CyberEnforced login. Send it only to the reviewer who needs it.
MSPs
Can an MSP keep each client separate?
Yes. Use one organization per client. Pro includes unlimited domains, daily scans, alerts, and read-only API access. Shareable reports are what you hand a client at a review. Compliance and training can be added for the client that needs them.
Does the public preview create a client workspace?
No. The preview does not create an organization or store the domain. Open an account, create the client organization, and add the domain there.
Pricing
What does Free include?
Up to 2 domains and 2 public IPv4 addresses, a manual scan once per domain per day, a score, findings, remediation guidance, and CSV, PDF, or shareable report links. No credit card.
What does Pro cost?
Pro is $29 per month, or $290 per year. It adds unlimited domains, up to 25 public IPv4 addresses, daily scans, extra mail and web checks including DKIM, alerts, and read-only API access. Billing is by invoice.
What do the add-ons cost?
GRC is $49, $99, or $179 per month by framework count. Vendor Security is $19 per month. Training & Awareness is $19 per month for up to 10 seats, then $2 per seat. The Compliance Suite is $229 per month for Pro plus all-12-framework GRC, Vendor Security, and Training at the included 10 seats. Add-ons sit on Pro.
Is there a self-serve card checkout?
No. Plans and add-ons are quoted and invoiced. A staff member enables paid access on the account. Free scanning does not ask for a card.
Privacy
Who operates CyberEnforced?
Cloudappsolutions Inc, in Lawrenceville, Georgia. The product site is cyberenforced.io.
Do you sell personal information?
No. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Does the public preview create a profile of me?
No account is created. The hostname is used to run that check and is not added to an organization. The network address is used to rate-limit the check and any 24-hour link. That link is a signed snapshot, not a profile.
Who can create an account?
People who are at least 18 and are creating a business account, or an account they are authorized to create. Signup asks you to confirm that and to agree to the Terms of Use and Privacy Policy.
How do I ask for deletion?
Use the data deletion page, or email privacy@cyberenforced.io. That covers account and organization data. A preview check is not stored as a domain on an account. A 24-hour preview link stops working after that time and is not an account record.