The internet-facing surface, the internal network, Microsoft 365 and leaked staff passwords in one console. ARIA tests serious findings live, and you see the verdict with the evidence.
Give us one domain and we find the rest, then keep hunting. It all runs from our cloud, with nothing to install.
Subdomains from certificate logs and DNS, validated and resolved to hosts and open services.
Exposed remote access, databases and file sharing. Certificates and TLS configuration.
Security headers, exposed admin pages and files, and the software versions a site gives away. Checked in a real browser too.
SPF, DKIM and DMARC, the records that stop others sending mail as you. Plus MTA-STS, DNSSEC and CAA.
One finding per software install, not one per CVE, with vendor patch data so a backported fix isn't reported as a hole. Known-exploited flaws go to the top.
API keys, tokens, private keys and database credentials left in the JavaScript your site serves, and the source maps that expose your code.
Dangling DNS records that would let someone else serve content from your subdomain.
Whether your domain's Microsoft 365 tenant can be discovered and its sign-in federation host is disclosed, and the mail records it needs to send as you: SPF, DKIM, DMARC and MTA-STS. No connection to your tenant needed.
New names, changed records and new exposure are picked up between scans, not at next year's audit.
The addresses we can find for your domain are checked against breach, paste-site and infostealer data. An infostealer hit means malware stole saved logins straight off a device, so it is ranked near the top. Flagged address by address.
Infostealer credentials
a.l•••@example.se
Malware stole saved logins from a device where this address was used.
Password exposed
ekon•••@example.se
Address and password leaked in a breach of a service it was registered with.
Address in a public paste
supp•••@example.se
Dumped in the open: raw material for credential stuffing and phishing.
Historic password exposure
j.b•••@example.se
Older breaches, rolled into one finding instead of ten.
The stolen password itself is never collected.
A small sensor on your network maps the devices it can reach and tests what it finds. One per site, and it reaches routed VLANs too.
Found on the wire and classified by type where the device tells us: servers, printers, cameras, NAS, network gear, OT.
Per device with the Standard profile, with service detection and known-vulnerability matching. The Sensitive and OT profiles scan a shorter list.
SMB, SNMP, LDAP, out-of-band management (BMC/IPMI), printers, remote desktop and more.
Passive monitoring flags ARP spoofing, rogue DHCP and IPv6 router adverts, LLMNR/NBT-NS poisoning, cleartext logins on the wire and anyone sweeping the network, plus new devices as they appear.
An OT profile for industrial networks, not a single byte to a printer's raw print port, and scanning only inside the range you set.
Decoys are fake servers on your network. Nobody legitimate has a reason to touch one, so a hit is a real signal.
Credentials tried on a decoy BACKUP-FTP
AI analysis
A host on the office LAN tried a login on a file server nobody has a reason to use. It swept three other machines first, which an ordinary workstation does not do. Check what is running on 10.20.4.66.
The AI saw the shape of the credential, never the value.
Email sent · Critical
SMB, RDP, MSSQL, WinRM, VNC, HTTP and FTP, with server names nobody will question.
The FTP, Telnet and HTTP decoys show a login and keep what was tried. Masked, revealed only by an admin, wiped after seven days.
Decoys are refused on industrial networks. They run on the on-site sensor.
We scan your Microsoft 365 tenant and Entra ID for vulnerabilities and misconfigurations, every day. One admin consent and you are connected, in a few clicks.
MFA is required for every user, and every admin has MFA registered.
The old sign-in protocols that bypass MFA are blocked.
No inbox rule forwards mail outside the company. Needs the optional mail permission.
Not too many Global Administrators, admin accounts that live only in the cloud, and no guest holding a directory role.
Users Microsoft rates as high risk, where your Entra ID P2 licence lets us read it.
No app has more access than it should, and no risky app was approved by an ordinary user.
See all 37 checksSome checks need Microsoft Entra ID P1 or P2; we tell you which.
When we find something serious, ARIA goes back to the target with real tools and shows you what it saw. Real? You get the proof. False? It is closed with the reason, after a second review.
High and Critical findings, where a test can settle the question. Findings a test cannot settle are marked as such.
Every quote in a verdict must match what the tool actually returned, or it is flagged.
Nothing is closed as a false positive without contact with the target and a separate review.
A finding that turns out wrong leaves your history, so your numbers aren't padded with our errors.
How ARIA decidesTechnical evidence mapped to NIS2 Article 21(2) and ISO/IEC 27001:2022 Annex A, as PDFs. Evidence, not a certificate.
NIS2 evidenceSend a customer an expiring, revocable trust report instead of filling in another questionnaire. Counts only; hostnames only if you choose.
0 to 100 per finding: severity, exploit likelihood, exploitation in the wild, exposure and asset importance.
An executive summary for the board and a remediation plan for the person doing the fixing.
Fixed something? Re-test that single finding from the console.
Email alerts, plus your ticketing and chat tools through integrations and webhooks.
We'll map a live surface with you and walk through what ARIA makes of it.
Book a demo