Scan your website and cloud, then fix what turns up
Netwarden scans your live website for exposed services, weak TLS, missing security headers, and known vulnerabilities, and scans your AWS, Azure, GCP, or Vercel accounts for the misconfigurations that lead to breaches. It also watches the Linux hosts you run, from CVE matches to SSH posture. Every finding arrives with a plain explanation and an AI-written fix, so you are not left with a severity score and a link to go read about it.
What Netwarden scans and watches
Your website and your cloud accounts are scanned from the outside for the problems attackers look for. The Linux hosts you run are watched from the inside by the same agent that reports CPU and disk. Findings from all of it land in one place, each with a fix.
Web application scanning
Netwarden scans your live site the way an attacker would. It inspects TLS configuration, HTTP security headers, exposed admin panels and services, and runs a large, current library of vulnerability checks against what it finds. Anyone can run a free scan before signing up, and connected sites get a deeper scan on a schedule.
- TLS and certificate analysis, HTTP security headers, and exposed-service checks on every scan.
- Thousands of vulnerability checks, kept current from the community templates the security industry already relies on.
- Findings map to CVEs and CVSS where they apply, so severity stays consistent instead of guessed.
Directory listing is enabled on /backups
Cloud posture scanning
Connect an AWS, Azure, GCP, or Vercel account with read-only access and Netwarden checks it against hundreds of security best practices: public storage, over-broad IAM, unencrypted volumes, open security groups, and more. It runs on a schedule, so configuration that drifts open next month gets caught, not just the state on day one.
- Read-only access. Netwarden reads your cloud configuration and never changes it.
- Hundreds of checks per provider, covering the misconfigurations behind most cloud breaches.
- Runs on a schedule, so a bucket someone opens later shows up too.
S3 bucket acme-backups is publicly readable
CVE alerts on the packages you actually run
The agent inventories installed packages on every host. The platform pulls Ubuntu USN, Debian DSA, and Red Hat OVAL feeds, enriches each advisory with NVD CVSS for sharp severity routing, and joins the two. When a fixed version ships and you haven't applied it, a finding fires with the CVE, the affected package, and the version you need.
- Coverage: Ubuntu, Debian, RHEL, Rocky, AlmaLinux, CentOS, Amazon Linux. Fedora installs match against Red Hat advisories where applicable.
- Severity is routed via NVD CVSS (not just the upstream vendor severity), so the same CVE doesn't get different importance depending on whose feed you read.
- Auto-resolves on the next package snapshot once the upgrade lands. You don't manually clear a CVE you've already patched.
openssl 3.0.2-0ubuntu1.10 is affected by CVE-2023-0286
SSH posture audit on every connection
The agent reads sshd_config and the live algorithm advertisement. Eight finding types catch the settings that turn an SSH server into a brute-force target, plus the legacy crypto that lets old clients downgrade you.
- PermitRootLogin yes: high. PermitEmptyPasswords yes: critical.
- PasswordAuthentication yes: medium. Protocol 1: critical.
- Weak KexAlgorithms (SHA-1 family), Ciphers (CBC, RC4, CAST), MACs (MD5, 64-bit truncated). Flagged per category.
- X11Forwarding yes: low, but worth knowing on production servers.
SSH allows direct root login
Public-bind audit on management ports
The agent enumerates every listening socket. The platform flags management or database ports bound to a public address (0.0.0.0 or ::). Postgres, MySQL, MongoDB, Redis, Elasticsearch, the Docker daemon, RDP, MSSQL, Memcached. There is also a coarser anomaly: more public binds than loopback binds is unusual on a server.
- Per-port findings, not aggregated. Fix the Redis exposure without losing the open Mongo finding behind it.
- Service restarts don't duplicate the finding: PID and process name are stored but not part of the dedupe fingerprint.
- many_public_bindings fires when public binds exceed loopback by more than five. A coarse hint at an over-exposed host.
Management port 5432/tcp is exposed publicly
GeoIP-aware failed-login monitoring
The agent samples failed SSH logins from auth.log, journal, and equivalents on a 60-second window. Every source IP gets enriched against MaxMind GeoLite2. Two findings ride on top: a country-watchlist alert and a country-anomaly alert tied to the host's own 30-day baseline.
- High-risk countries (RU, CN, KP, IR, BY) trigger a high-severity finding once a country crosses 20 failed attempts in the window.
- Country anomaly fires when a host sees sustained failed-login traffic from a country it has never logged before in the prior 30 days.
- The dashboard surfaces sample IPs, country flags, and a 30-day prior distribution so operators can triage without leaving the page.
Failed SSH logins from Russia (47 in last minute)
TLS certificate expiration
Agentless. The platform reuses your existing HTTPS uptime checks: when it dials the host, it captures the peer certificate. A finding fires when the certificate is within 14 days of expiry and is escalated to critical at 3 days.
- No extra collector to install. Runs on the same dial used for HTTPS uptime.
- Issuer, subject, and notAfter are stored on the finding so you don't need to re-run openssl s_client to triage.
- Auto-resolves the next time the dial sees a renewed certificate. Renewals are detected without operator intervention.
TLS certificate for app.example.com expires in 2 day(s)
Severity-routed, three channels, one digest
Findings are tiered critical / high / medium / low and dispatched across email, mobile push, and outbound webhook. You decide which severities open which channel. You can also opt into a single weekly digest as a low-noise alternative.
Severity-routed dispatch
Every finding lands in one of four buckets: critical, high, medium, low. Per-tenant preferences decide which severities go to email, which to push, and which to your webhook. No noisy lows in your inbox unless you ask for them.
Auto-resolution
When you fix the misconfig, the next snapshot closes the finding on its own. Auto-resolved findings are tagged distinctly from user-resolved ones, so you can tell who did the work: you, or the platform recognizing your fix.
Time-to-resolution metric
Every finding tracks first_seen, resolved_at, and who closed it. The dashboard rolls those up into a time-to-resolution chart, so you can prove your security posture is improving instead of just feeling like it might be.
| Severity | Push | Webhook | Example finding | |
|---|---|---|---|---|
| Critical | default on | default on | default on | Empty SSH passwords, SSHv1 enabled, 2-day cert |
| High | default on | default on | default on | Public Postgres, root SSH, weak ciphers, RU brute force |
| Medium | default on | off by default | off by default | Password SSH auth, country anomaly, weak MACs |
| Low | off by default | off by default | off by default | X11 forwarding, hmac-sha1. Weekly digest only. |
Every finding comes with the fix
Each finding ships with a plain explanation and an AI-written fix for the exact issue in front of you, not a link to someone else's blog post. Apply it, mark the finding resolved, and move on.
Disable direct root SSH
# /etc/ssh/sshd_config — set PermitRootLogin nosudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' \ /etc/ssh/sshd_configsudo sshd -t && sudo systemctl reload sshd
Patch a flagged package
# Debian / Ubuntusudo apt updatesudo apt install --only-upgrade openssl# RHEL / Rocky / Alma / Fedorasudo dnf update openssl
Renew an expiring certificate
# Let's Encrypt — certbot renewalsudo certbot renew --dry-runsudo certbot renewsudo systemctl reload nginx
What this is not
We would rather tell you up front where the edges are. Netwarden finds and helps you fix a wide range of real problems, and there are still things it is not meant to replace.
Not a pentest
Netwarden runs automated scans on a schedule, which catches the common, high-value problems fast. It does not replace a human pentester chaining exploits by hand for a one-off engagement.
Not an EDR
No kernel-level threat detection, no behavioural process anomaly, no signed-binary attestation. If you need runtime malware detection on each host, pair us with an EDR.
Not a SIEM
We do not aggregate every log line in your fleet. Failed-login monitoring uses sampled top-IP windows, not full ingestion. Bring a SIEM if you need long-term log search.
Not a compliance auditor
We do not certify you against PCI, HIPAA, or SOC 2 controls. Our findings (disabled root SSH, patched CVEs, public-port exposure) are useful inputs to those audits, but the framework itself isn't our product.
GeoIP needs your own MaxMind license
MaxMind's terms require each operator to hold their own GeoLite2 license. It's free at maxmind.com; you mount the .mmdb into the platform pod. Without it, every other security finding still fires.
Linux first today
SSH posture, listening-port audit, and CVE matching require the Linux agent. Windows and macOS hosts are inventoried but don't yet emit security findings beyond TLS expiration on monitored hostnames.
The whole security wedge ships in the self-hosted binary
CVE feeds, SSH posture audits, port-exposure findings, GeoIP failed-login monitoring, TLS expiration. Every capability on this page is in the same Bun-compiled binary you'd run yourself. Same evaluator, same remediation snippets, same dashboard. No feature gate.
Install the agent. Start finding things.
One install gets you uptime, metrics, and the security posture checks on this page. Free tier covers three hosts; paid plans add longer retention and unlimited webhooks.