Your security posture changes without you touching anything — a dependency gets a CVE, a certificate lapses, someone ships a config change on a Friday. Monitoring checks every site hourly, re-runs the full check suite on a schedule that follows your risk, and tells you when something moves.
Set up monitoring →A fixed weekly scan is wrong in both directions: too noisy for a site that is fine, too slow for one that is not. After every scan, the next one is scheduled from the grade it produced.
A CVE match against your stack overrides all of this and queues a rescan immediately, whatever your grade.
One request and one TLS handshake per monitored URL. Records whether the site answered, how fast, which security headers it sent and when its certificate expires — then alerts if it stops responding, or if something changed that weakens it: a security header gone, HSTS switched off, a redirect that now ends somewhere else. A header being added is not an alert.
Finds every subscription whose next full scan is due and queues it. The due date was set by the grade of the last scan, so the schedule tightens on its own when a site gets worse. A deep scan is expensive enough to schedule in days, which is why the hourly check above exists to cover the gap.
Reads CVEs the NVD has newly published or newly analysed, and matches them against the software detected on your last scan using the NVD’s structured affected-product and version data, not keywords in the description. When the scan read a version, it must fall inside an affected range; when it did not, only high and critical CVEs alert, and the alert says the version is unknown. Each match gets an EPSS exploitation-probability score, an immediate rescan and one alert per site. Hosting platforms such as Cloudflare or Vercel are not matched: their CVEs concern products you do not run.
Reads the TLS expiry from the live handshake the hourly check already makes, and fires at 30, 14 and 7 days remaining — each threshold once per certificate, so a renewal resets it and a stalled one keeps escalating. A daily job repeats the check from your last scan report, for a site the hourly check cannot reach.
A CVSS score says how bad a vulnerability would be if exploited. It says nothing about whether anyone is actually exploiting it. Sort a CVE feed by CVSS and you get a list topped by theoretical 9.8s that no one has ever weaponised, while the 6.5 being sprayed at every host on the internet sits halfway down.
EPSS — the Exploit Prediction Scoring System — estimates
the probability that a given CVE will be exploited in the wild in the next
30 days. SecScan pulls it from api.first.org for every match and
ranks your alerts by severity and that probability together, so what
surfaces first is what is most likely to actually happen to you.
Alerts arrive by email, and by webhook if you configure one. The webhook payload is Slack-compatible, so a Slack incoming webhook URL works with no adapter in between — paste it in and alerts land in a channel.
Deep rescans never use up your free scans or credits — the scheduler queues them itself. They do count toward your account's daily scan limit, so a long list of monitored sites leaves less room for manual scans that day. Creating a subscription goes through the same rate limit as launching a scan. The hourly check is not a scan and counts against nothing: it is one request, and it grades nothing.
Each monitored site has a Pause button. While it is paused there are no scans, uptime checks, CVE alerts or emails for that site, and nothing is deleted: the history stays readable and Resume carries on. Use it while you redesign a site or migrate hosts, instead of cancelling and starting over. A paused site shows a Paused badge so it is never silently unwatched. A manual "Scan now" still works.
Monitoring re-runs the same black-box checks on a schedule. It does not watch your source repository, your CI pipeline, or your dependency manifests — if a vulnerable package is installed but never reachable from the outside, an external scanner will not see it, and neither will this. It is the outside view, taken repeatedly.
SecScan Unlimited is $19 a month: unlimited full scans (fair use) and up to 5 sites watched around the clock. Cancel any time. The paid plan opens soon; it is not purchasable yet. Every account already gets 3 free scans every month, and your first site is watched free.
Run a free scan →