Help guide

Everything you need to review firewall rules, share reports and manage your account.

Getting started

1. Create an account on the sign-up page. We create a company for you on the free plan. Confirm your email from the link we send.
2. Open the Workbench and pick your firewall platform, or leave it on Auto-detect.
3. Paste your config or use Open file, then press Analyse (or Ctrl/Cmd + Enter).
4. Work through the findings, starting with High. Each one has a fix.
5. On a paid plan, press PDF report to save a report for your client, auditor or change board.

Press Example at any time to load a sample config for the selected platform. Examples are free, don't count towards your limits, and show the full results.

Exporting configs

Export the running configuration from your firewall in one of these formats. Remove nothing: the tool needs objects, rules and NAT to give accurate results. You don't need to redact passwords, because the config never leaves your browser.

Beta formats vary between versions. If a beta import looks wrong, compare the rule count with your firewall and email us a sanitised sample so we can improve it.

Reading a review

Score and grade

Each finding takes points off a score of 100: 10 for high, 4 for medium and 1 for low. Repeats of the same finding count up to four times, so one noisy issue can't wipe out the score. The grade is A (90+), B (80+), C (65+), D (50+) or F (below 50). Info items don't affect the score.

Severity

• High: likely to be exploited or to defeat a control you think you have. Examples: RDP open to the internet, a block rule that never fires, end-of-support firmware, Telnet admin access.
• Medium: weakens security or breaks good practice. Examples: rules allowing every port, admins without MFA, no remote logging.
• Low: hygiene and visibility. Examples: disabled rules, unused objects, missing comments, no logged deny-all.

Categories

• Vulnerabilities: firmware versions with flaws attackers are known to exploit.
• Exposure: what the rules allow, and how broadly.
• VPN & crypto: weak IPsec proposals, aggressive mode, IKEv1, missing perfect forward secrecy, old TLS.
• Device hardening: how the firewall itself is managed, where the config shows it.
• Rule hygiene: rules that never match, duplicates, leftovers and undocumented rules.
• Logging: whether you'd see an attack or a misconfiguration.

Shadowed and redundant rules

A rule is shadowed when an earlier rule matches everything it would. If the earlier rule allows and the later one blocks, the block never happens. That's a high finding, because the protection you think you have isn't there. Redundant rules are covered by an earlier rule with the same action and can usually be removed.

Rules that aren't fully analysed

Rules that match users, groups or applications (for example Palo Alto App-ID, Check Point access roles, Sophos user rules) can't be judged from addresses and ports alone. They're listed as "partially analysed" and skipped by the exposure and shadowing checks, rather than guessed at. Review them by hand.

Tabs

• Findings: filter by severity, and pick a standard to show only findings that map to it.
• Standards: pass, partial, fail or not assessed for each control in the selected standard.
• Rules: every rule with flags such as exposed, shadowed, all services or no log.

Standards

Every check is mapped to the controls it relates to in 16 standards:

• US: NIST SP 800-53 Rev 5, NIST SP 800-41 Rev 1, NIST CSF 2.0, NIST SP 800-171 r2 / CMMC Level 2, HIPAA Security Rule, SOC 2 Trust Services Criteria, DISA STIG themes
• EU: NIS2 Article 21, DORA, BSI IT-Grundschutz (NET.3.2), GDPR Article 32
• UK: Cyber Essentials, NCSC Cyber Assessment Framework
• International: ISO/IEC 27001:2022 Annex A, PCI DSS v4.0.1, CIS Controls v8.1

A control shows fail if a related check found a high or medium issue, partial if only low issues were found, pass if related checks ran and found nothing, and not assessed if no check could test it from this config.

This is an automated check of a firewall configuration. It helps you find and fix issues and prepare evidence. It is not an audit or certification, and a "pass" doesn't prove compliance. Many controls also depend on processes and systems outside the firewall. DISA STIGs are mapped by theme, not by STIG rule ID. Control references are for orientation; confirm them against the current edition of each standard.

Fix commands

On paid plans most findings have a Fix commands section with the change in your platform's own syntax: FortiOS, PAN-OS, ASA, IOS, Junos and RouterOS CLI, Check Point mgmt_cli, or step-by-step menu paths for SonicWall, Sophos, WatchGuard and pfSense/OPNsense. Rule names, policy IDs, ACL line numbers and interface names come from your config.

• Replace anything in <angle brackets> with your own values, such as the source network a rule really needs.
• Read the commands before you paste them. They're a starting point, not a tested change. Back up first and apply them in a maintenance window.
• Cisco IOS sequence numbers assume the default numbering (10, 20, 30…). Check them with show access-lists.
• On Junos the commands end with commit confirmed 5, so the change rolls back unless you confirm it.

Firmware vulnerabilities

When the export shows the firmware version, it's checked against vulnerabilities in CISA's Known Exploited Vulnerabilities catalog whose exposure a config can reveal. Today that covers FortiOS (SSL-VPN, admin interface, fgfm and FortiCloud SSO flaws), PAN-OS (GlobalProtect and management interface flaws) and MikroTik RouterOS (Winbox). The list date is shown on each review.

• High: the version is affected and the config shows the affected feature exposed, for example SSL-VPN on an internet-facing port.
• Medium: the version is affected and the feature may be exposed, or only a hotfix level the export can't show would fix it.
• Low: the version is affected but the feature isn't enabled. Upgrade anyway, before someone turns it on.

Palo Alto set-format exports and some other platforms don't include the version. Type it in the Firmware box under the score and press Check. For Cisco, Juniper, Check Point, SonicWall, Sophos, WatchGuard and pfSense the review links to the vendor's advisory page instead. This check doesn't replace a vulnerability scanner or the vendor's own advisories.

VPN & crypto checks

For FortiGate, Palo Alto, Cisco ASA, FTD and IOS, Juniper SRX, pfSense/OPNsense and MikroTik, IPsec and TLS settings are checked for:

• DES, 3DES or NULL encryption, MD5 or SHA-1 integrity, and Diffie-Hellman groups 1, 2, 5 and 22–24
• IKEv1 aggressive mode, which lets an attacker crack the pre-shared key offline (on Cisco ASA it's allowed unless crypto ikev1 am-disable is set)
• IKEv1 in use, and IPsec tunnels without perfect forward secrecy
• TLS 1.0 or 1.1 allowed for SSL-VPN or admin access

Change both ends of a tunnel in the same window, or the tunnel will drop.

Comparing changes

Choose Compare changes, paste the current config as Before and the proposed or newer config as After, then press Analyse. You get:

• a verdict: no new high or medium findings, new medium findings to check, or new high findings that should stop the change
• the grade and score before and after
• findings that are new, changed or fixed, with fix commands for the new ones
• rules added, removed, edited or moved
• a plain-text change summary to copy into your change ticket

Change reviews are included in paid plans. Try the example on any plan. Both configs are analysed in your browser; neither is uploaded.

Network review (several devices)

Choose Network review to review your whole network together. Tick which device types to include — Firewalls, Switches, Wi-Fi, NAC, Devices & posture — so you can do just firewalls, firewalls and Wi-Fi, switches only, everything, or any combination. Each device is reviewed on its own and everything rolls into one combined posture score, standards view and ATT&CK map, with a per-device breakdown under Each device and a single PDF.

Firewalls (up to 10, an HA pair counts as 2) are additionally checked against each other; switches (up to 50), Wi-Fi controllers/APs (up to 50), NAC deployments (up to 20) and device/posture checklists — IoT/CCTV plus VPN, ADC and SASE (up to 40) — are each reviewed individually. Paste up to 10 firewall configs, one per box. Give each a name if you like (for example HQ or London). For a cluster, tick HA pair: it counts as 2 of your 10, and you can paste the second member's config to check the two are in sync. Platforms can be mixed. The firewall cross-checks are:

Each firewall is reviewed on its own, as in a normal review, and then checked against the others:

• VPN tunnels: the two ends of each tunnel are matched by peer address (or by protected networks when one end is behind NAT). You'll see tunnels with no other end, IKE versions that don't match, phase 1 or phase 2 proposals with nothing in common, weak settings both ends still accept (3DES, SHA-1, DH group 2), PFS on at one end only, protected networks that don't mirror, aggressive mode, and short or mismatched pre-shared keys where the export shows them
• Access between sites: rules that let another site reach anything over the VPN, and ASA tunnels that skip the interface access lists
• HA pairs: members on different firmware, rules out of sync, unencrypted heartbeat or failover links, and firewalls with HA on that weren't added as a pair
• Addressing: the same subnet at two sites joined by a VPN, and the same interface address on two firewalls
• Consistency: mixed firmware across the same platform, and the same issue found on several firewalls

Fix commands are given for both ends of a tunnel. VPN settings are compared for FortiGate, Palo Alto, Cisco ASA, FTD and IOS, Juniper SRX, pfSense/OPNsense and MikroTik; other platforms are reviewed on their own. Where a setting isn't in an export, the platform's built-in default is assumed. Multi-firewall reviews are included in paid plans; try the example on any plan. All configs are analysed in your browser and none are uploaded.

Reviewing switches

Choose Switches and paste a switch configuration. The platform is detected automatically, or pick it from the row of buttons. Supported exports:

The review covers the management plane (Telnet/HTTP vs SSH/HTTPS, SNMP defaults and SNMPv3, centralised AAA, enable/admin password strength, management ACLs), VLAN and segmentation hygiene (user ports on VLAN 1, native-VLAN and trunk pruning), Layer-2 protections (BPDU guard, root guard, DHCP snooping, Dynamic ARP Inspection), port access (port security, 802.1X, unused ports), and logging, time and firmware. A Posture tab summarises each control as OK or needs-work. Findings map to the same 16 standards and the optional ATT&CK view; everything runs in your browser.

Reviewing Wi-Fi

Choose Wi-Fi and paste a wireless controller or access-point config. The platform is detected automatically, or pick it from the row of buttons. Supported exports:

Each SSID is checked for open or WEP encryption, TKIP/WPA1, 802.11w management-frame protection (PMF), guest isolation, WPS, hidden SSIDs, weak or default pre-shared keys where the export shows them, and management hardening (Telnet/HTTP admin, default SNMP, firmware). The SSIDs tab lists every SSID with its encryption, PMF, guest and VLAN at a glance. Findings map to the same 16 standards and the optional ATT&CK view. Everything runs in your browser; nothing is uploaded.

Reviewing NAC (Network Access Control)

Choose NAC to review a 802.1X / Network Access Control deployment. The platform is detected automatically, or pick it from the row of buttons. Supported exports:

The review covers the parts of NAC that get deployments compromised: weak authentication methods (PAP/CHAP/MSCHAPv1/LEAP/EAP-MD5 vs EAP-TLS), 802.1X left in open/monitor mode so nothing is enforced, MAC Authentication Bypass used as a blanket fallback, missing per-session segmentation (dynamic VLAN, downloadable ACL or SGT), any-to-any authorization ACLs, fail-open/critical-auth that grants access when RADIUS is down, missing Change of Authorization (CoA), no posture (OnGuard) or device profiling, guest without isolation, a weak or plaintext RADIUS shared secret, the management plane (Telnet/HTTP, default SNMP, admin MFA), logging and software version. Because central policy lives in ISE / ClearPass itself, treat this as a strong check of the enforcement points and config export rather than a full audit of the policy engine — the report says so. Findings map to the same 16 standards and the optional ATT&CK view. Nothing is uploaded.

Reviewing Azure NSGs

Choose Azure NSG to review an Azure Network Security Group rulebase the way the firewall review checks rules. Export your NSGs and paste the JSON:

• All NSGs in the subscription: az network nsg list -o json
• One NSG: az network nsg show -g <resource-group> -n <name> -o json
• An ARM template ({"resources":[…]}) or a {"value":[…]} wrapper also works.

The review reads every inbound and outbound security rule and flags the exposures that get cloud workloads compromised: RDP (3389) and SSH (22) open to the internet, Windows/management ports (SMB, WinRM, RPC, NetBIOS, VNC, Telnet, SNMP) and database ports (SQL, MySQL, PostgreSQL, Oracle, MongoDB, Redis, Elasticsearch and more) reachable from any source, any-to-any allow rules, inbound rules sourced from the internet across a wide port range, and unrestricted outbound (egress) — which Azure allows by default unless you deny it. A source of *, 0.0.0.0/0, Internet or Any counts as internet-facing; rules sourced from VirtualNetwork or specific prefixes are treated as internal. Every finding carries the fix (Azure Bastion / Just-in-Time access, Private Endpoints, service tags, Azure Firewall for egress) and maps to the same 16 standards and ATT&CK. The parsed rulebase is shown under Rules, with internet-sourced inbound allows highlighted. Nothing is uploaded.

Reviewing Citrix NetScaler / ADC

Choose NetScaler to review a Citrix NetScaler / ADC configuration. On the CLI run show ns runningConfig, or use the /nsconfig/ns.conf file, and paste it. Keep the leading #NS… line so the software release can be checked.

The review reads the config the way the firewall review reads a rulebase and flags what gets these appliances compromised: the software version against end-of-maintenance trains and CISA KEV (NetScaler is one of the most-exploited edge devices — Citrix Bleed and friends), management access (-mgmtAccess) enabled on a SNIP/VIP rather than confined to the NSIP, Telnet and FTP, weak TLS on SSL vservers/services/profiles (SSLv3, TLS 1.0/1.1, and RC4/3DES/EXPORT/NULL/anonymous ciphers), whether TLS 1.3 is offered, a Citrix Gateway (VPN vserver) with authentication off or no policy bound, clientless VPN mode, admin authentication (external LDAP/RADIUS/SAML vs local-only) and MFA, the built-in nsroot account, default SNMP communities, cleartext HTTP virtual servers and external syslog. Each finding carries the fix in NetScaler terms and maps to the same 16 standards and the optional ATT&CK view. A parsed config summary is under Config. Because policy bound outside the export isn’t visible, treat it as a strong check of the config rather than a full audit, and confirm anything critical on the appliance. Nothing is uploaded.

Reviewing F5 BIG-IP

Choose F5 BIG-IP to review a BIG-IP configuration. Paste the bigip.conf (/config/bigip.conf), or run tmsh -q list / recursive (or show running-config) and paste it. Keep the leading #TMSH-VERSION line so the TMOS release can be checked.

The review walks the brace-nested tmsh config (ltm / net / sys / auth stanzas) the way the firewall review reads a rulebase, and flags what gets BIG-IPs compromised: the TMOS version against end-of-support branches and CISA KEV (BIG-IP is heavily targeted — CVE-2022-1388 iControl REST auth bypass, CVE-2023-46747), the management plane reachable on an external (non-RFC1918) self-IP via allow-service, weak TLS on client-SSL/server-SSL profiles (SSLv3, TLS 1.0/1.1, and RC4/3DES/EXPORT/NULL ciphers — negated ciphers like !RC4 are correctly treated as excluded), TLS 1.3 disabled, the management GUI (httpd) TLS and ciphersuite, forwarding (any-to-any) virtual servers, HTTPS virtual servers published without an ASM/Advanced WAF policy, admin authentication (external LDAP/RADIUS/TACACS vs local-only) and MFA, root login, default SNMP communities and open SNMP, cleartext HTTP virtual servers, remote syslog and NTP. Each finding carries the fix in F5 terms and maps to the same 16 standards and the optional ATT&CK view. A parsed config summary is under Config. Because objects bound outside the export (iRules detail, APM policy, partitions you didn’t include) aren’t fully visible, treat it as a strong check of the config rather than a full audit, and confirm anything critical on the appliance. Nothing is uploaded.

Device, posture & identity reviews

Many things have no exportable config to parse, so choose Devices & posture and work through a short checklist instead. Pick the type and answer what you know — Yes, No, or leave it as not assessed. Every answer is graded and mapped to the same 16 standards and MITRE ATT&CK as a config review, and any of these can be included in the whole-network review.

• Entra ID / Microsoft 365 (cloud identity) — MFA coverage for all users, security defaults vs Conditional Access, legacy-authentication blocking, device-based Conditional Access, privileged-role count and just-in-time elevation (PIM), protected break-glass accounts, external/guest collaboration limits, third-party app-consent restrictions, password protection and sign-in/audit log retention.
• Active Directory (on-prem domain) — tiered admin model and credential exposure, MFA on privileged/remote logons, Kerberoasting-resistant service accounts, LLMNR/NBT-NS, SMB signing and NTLM-relay mitigation, LAPS, domain password policy, Print Spooler on domain controllers, stale accounts and privileged-group review, and a tested offline AD recovery plan.
• IP camera / NVR / CCTV, IoT, network device — default or weak passwords, out-of-date or end-of-life firmware, internet exposure, Telnet and plain-HTTP management, VLAN segmentation, UPnP, cloud/P2P relay, unauthenticated RTSP/ONVIF, default SNMP, MFA, time sync, logging and physical security. Reads Axis parameter lists and UniFi/Protect JSON to pre-fill where available.
• Remote-access / VPN appliance (Ivanti Connect Secure, Citrix NetScaler Gateway, SonicWall SMA, Zyxel VPN) — patch / KEV exposure, management-plane exposure, admin and user MFA, TLS strength, device posture checks, least-privilege admin, central logging, session timeouts and config backup.
• ADC / load balancer (F5 BIG-IP, Citrix NetScaler ADC) — the above plus management/data-plane separation and a WAF on internet-facing published apps.
• SASE / SSE service (Zscaler, Netskope, Cloudflare, Cisco Secure Access, FortiSASE, Microsoft Entra Global Secure Access) — least-privilege ZTNA, TLS/SSL inspection, DLP, agent tamper-protection, admin MFA/SSO and central logging. The cloud service is vendor-patched, so this is a policy-and-configuration posture review rather than a version check.

You get the same graded report, standards mapping and ATT&CK view as a config review. If your device exports a readable config — an Axis parameter list or a UniFi/Protect JSON — paste it under Have a config export? to pre-fill some answers. Nothing is uploaded; the review is built in your browser from what you answer.

Devices & accepted risks

On paid plans each firewall you review gets its own score history. The first time you review a config that includes a hostname, it's added under Account › Devices & risks with a label like "FortiGate 1". Rename it to something meaningful.

To recognise the same device next time, your browser makes a one-way fingerprint from the hostname and a secret value unique to your company. We store the fingerprint and your label, never the hostname. Configs without a hostname are reviewed as normal but not added to the history.

Accepting a risk

Owners and admins can press Accept risk… on a finding when there's a business reason to leave it, for example a legacy system with compensating controls. Give a reason and a date to review it again (up to 12 months). Accepted findings stay visible in their own section but are left out of the score and the standards results until they expire. Apply it to one device or to every device in the company.

We store a one-way fingerprint of the finding, its check type and severity, your reason and the expiry date. Keep IP addresses, hostnames and passwords out of the reason. Revoke an accepted risk at any time from the finding or from the risk register, which you can export as CSV for auditors.

Unused rules (hit counts)

Rules that nobody uses are open doors with no business reason. On paid plans, press Hit counts after a review and paste the counters from your firewall:

• Cisco ASA: show access-list
• Cisco IOS: show access-lists
• Palo Alto: show rule-hit-count vsys vsys-name vsys1 rule-base security rules all
• Juniper SRX: show security policies hit-count
• Check Point: add show-hits true to the mgmt_cli show access-rulebase command
• FortiGate: export the policy list to CSV with the Hit Count column shown
• MikroTik: /ip firewall filter print stats
• Others: a CSV with a rule name (or ID) column and a hit count column

Say how long the counters cover. Rules with no hits are listed with commands to remove them, and the Rules tab gets a Hits column. Counters reset when a firewall reboots or someone clears them, so use a period that covers your quiet seasons, such as month-end or year-end jobs. Hit counts stay in your browser like the config.

Review sign-off & reminders

PCI DSS 1.2.7 asks for firewall rulesets to be reviewed at least every six months, and ISO 27001 auditors want to see regular reviews. On paid plans, after reviewing a tracked device, an owner or admin can press Sign off review…. Add a note (decisions, ticket numbers) and choose when the next review is due.

• The sign-off goes into that review’s PDF as a Review record, and it’s listed under Account › Devices & reviews, with CSV export for auditors.
• Each device has a review cycle (monthly, every 3 or 6 months, or yearly). The device list shows what’s due and what’s overdue.
• Owners and admins get an email 14 days before a review is due, and when it’s overdue. Turn this off on the Devices & reviews tab.

MSP client folders

On the MSP plan, add your customers under Account › Devices & reviews › Clients, then file each device under a client, either there or from the Workbench after a review. You get a summary per client (devices, reviews in the last 90 days, average score, overdue reviews) with CSV export. Reports for a client’s device say “Prepared for” the client, and can carry the client’s logo next to yours.

Cyber Essentials notes

On the Standards tab, press Cyber Essentials notes for draft notes on each firewall topic in the Cyber Essentials self-assessment, such as default passwords, admin access, inbound rules and updates. Each topic is marked looks good, mostly in place, fix first or answer from your records, with the findings behind it. Copy them, or pick Cyber Essentials as the standard and they appear in the PDF. Always check your answers against the current question set.

Refer a company

Owners and admins find the company’s referral link under Account › Refer a company. Companies that sign up with it get a discount on their first payment, and you get a reward once they subscribe. The page shows how many signed up and subscribed, but not who they are.

Assets & vulnerability alerts

Open Assets & CVEs and press Add asset. Choose the platform (the software the device runs, for example Fortinet FortiOS), and type the software version exactly as the device shows it, for example 7.2.5, 10.2.9-h1 or 21.4R3-S5. The model, asset name, external IP and internal IP are optional. The external IP is used by the vulnerability scanner (below) once you’ve verified you control it.

Alongside the firewall and router platforms, you can monitor the remote-access, VPN, ADC and SASE appliances that are the most common targets for mass exploitation — Cisco Firepower (FTD), Ivanti Connect Secure / Policy Secure (Pulse), Citrix NetScaler ADC / Gateway, F5 BIG-IP, Zyxel (ATP / USG FLEX / VPN), SonicWall SMA and Zscaler Client Connector / App Connector. These are monitored by software version against NVD and CISA KEV; they don’t get a rule-by-rule config review (there’s no firewall rulebase to read), but they appear everywhere your vulnerabilities do — in the asset list, the scanner, and the whole-network ATT&CK / threat posture, Reports and Remediation views.

You can also monitor the SASE / SSE endpoint agents, which run with high privilege and do get their own CVEs. The cloud service itself is patched by the vendor, so what you track is the agent / connector version your estate deploys: Netskope Client, Palo Alto GlobalProtect / Prisma Access, Cloudflare WARP, Cisco Secure Client / Secure Access, Fortinet FortiClient / FortiSASE and Microsoft Entra Global Secure Access. Add one like any other asset, with the agent version from the client’s About screen or your management console.

We check the version straight away against the US National Vulnerability Database (NVD), and then every day. Each CVE shows its CVSS score (critical 9 and above, high 7 to 8.9, medium 4 to 6.9), whether it's on CISA's Known Exploited Vulnerabilities list, the release that fixes it where NVD gives one, and links to the vendor advisory. Known-exploited flaws are marked in dark red and listed first: fix those first.

Daily emails. Owners and admins get one email a day when a new vulnerability affects an asset, or an existing one becomes known-exploited. Choose the lowest score you want to hear about, and add up to 5 extra addresses (for example your SOC mailbox). There's no email on days with nothing new.

Cost. £1 per asset per day plus VAT, on paid plans. Each asset is counted once a day, and last month's total is charged to your card early each month. See it under Account › Plan & billing.

Matching is only as good as NVD's data and the version you enter. NVD sometimes lists a whole release train, doesn't track PAN-OS hotfixes, or lags behind a vendor's own advisory, and some flaws only affect certain models or settings. Always confirm with the vendor advisory before acting.

Vulnerability scanner

The Scanner is an optional add-on on paid plans. It scans the IPs and assets you’ve verified you control, finds live hosts, open ports and software versions, and matches them against CVE and CISA KEV data, mapped to MITRE ATT&CK. It doesn’t run exploits.

1. Add and verify a target. On the Targets tab, add a single IP or pull one in from your asset list. Before anything can be scanned you prove you control it, by publishing a token we give you — either a DNS TXT record on the address’s name, or a file at /.well-known/fwb-verify.txt on the host. This is what stops the scanner being pointed at anyone else. Allow-list our scanner source IPs (shown on the page) so external scans aren’t dropped at your firewall.

2. Choose a profile. A profile sets the pace (slow and gentle are paced so a scan won’t overload hosts or trip the target’s own auto-blocking), which ports to check, whether it’s an authenticated internal scan, and what to skip — by machine type (laptops, printers…), by vendor, or by a partial hostname match. A discovery only profile just finds hosts; you can then add what it finds to your asset list in one click.

3. Internal scans. For authenticated scans and hosts you can’t reach from outside, install a scanner agent (Profiles & scanners). It’s licence-locked to your company, only ever scans the targets you’ve verified, and stops working if the add-on lapses.

4. Run or schedule. Scan a single verified IP, all your verified assets, or custom ranges inside verified space. Schedule scans daily, weekly or monthly, and split large estates by IP range or machine type so each run stays light.

Results come back here: hosts and open ports, vulnerabilities with CVE, CVSS, CISA KEV and fix versions, and an ATT&CK view. Export any scan to CSV. Owners and admins start scans; anyone in the company can view results.

Only scan systems you own or are authorised to test. Matching is version/configuration based, so confirm anything important against the vendor advisory before acting.

MITRE ATT&CK mapping

ATT&CK mapping is an optional add-on that adds an ATT&CK tab to firewall reviews, multi-firewall reviews and scan results. It groups findings by the adversary techniques (such as T1190 Exploit Public-Facing Application) they could enable, organised by ATT&CK tactic, and includes them in the PDF. It’s useful for threat-informed prioritisation, purple-team planning and reporting. It shows what a weakness could enable, not that an attack would succeed. Turn it on under Account › Plan & billing.

Free network tools

The Tools section is free and needs no account. It covers:

• Email & DNS: email security check, MX lookup, DNS lookup, SPF, DMARC and DKIM checkers
• IP & network: reverse DNS, blacklist check, IP whois and ASN, what’s my IP, certificate search
• Calculators: subnet, CIDR and range, IPv6, netmask table, MAC formatter, port reference, password and PSK generator, timestamp converter

Each result has its own link (for example tools/mx-lookup.html#mx-lookup/example.com), so you can share it. Lookups go from your browser straight to public DNS-over-HTTPS and registry services, not through us. Spamhaus doesn’t answer public resolvers, so the blacklist check links to Spamhaus’s own checker. Ping, traceroute and port scans can’t run from a browser, so they aren’t included.

PDF reports

On Pro, Team and MSP plans, press PDF report after a review. The report includes:

• a cover page with the device, platform, date, grade, score and top priorities
• all findings with their fix and related controls
• the firmware version and any known-exploited vulnerabilities
• accepted risks with their reasons, and the device's score history
• the review record, if you signed off the review
• an appendix of fix commands for each finding
• a compliance table for the selected standard (or NIST 800-53, ISO 27001 and Cyber Essentials if "All standards" is selected)
• an appendix of every rule reviewed
• a report ID that matches your usage history

The PDF is created in your browser and saved to your downloads. We don't keep a copy. On the MSP plan, add your logo under Account › Company and reports carry your branding instead of ours.

Converting configs (any to any)

1. Switch to Convert, paste the source config and press Analyse. The source platform is auto-detected (or pick it).
2. Choose the Convert to target at the top of the output — any of the 11 platforms: FortiGate, Cisco ASA, Cisco IOS, Palo Alto (set), Juniper SRX (set), MikroTik, Check Point (mgmt_cli), SonicWall, Sophos (XML), WatchGuard or pfSense/OPNsense (XML).
3. Open the Interfaces tab and map each source interface or zone to a name on the target (a FortiGate port, or a zone/interface name). The config updates as you type.
4. Read every item in Review notes — things the converter couldn't decide safely, such as NAT, VPN, zones, user or application rules.
5. Copy or download the config and apply it to a lab or spare device first. Fix anything it rejects, then test traffic before go-live.

Converted for every target: addresses and groups, services and groups, and policies (source, destination, service, action, log, enabled/disabled). Fidelity depends on the target: CLI/set-format platforms (FortiGate, Palo Alto, Cisco ASA/IOS, Juniper SRX, MikroTik) convert most cleanly; XML/GUI/API ones (Check Point, SonicWall, Sophos, WatchGuard, pfSense/OPNsense) come out as a scaffold that needs more hand-finishing. NAT, VPNs, routing protocols, IPv6, security profiles and user identity are flagged for manual work rather than converted.

Every conversion is a draft, not a drop-in. Never paste a converted config straight into a production firewall. Back up the target first and apply changes in a maintenance window.

Plans & billing

• Free: 3 reviews a month, grade, score and top 3 findings.
• Pro: one user, unlimited reviews, all findings, standards, PDF reports and the converter.
• Team: everything in Pro for 5 users, with extra users available.
• MSP: everything in Team for 15 users, cheaper extra users, and your logo on reports.

Paying

Owners and admins choose a plan under Account › Plan & billing. Payments are handled by Paddle, our reseller and merchant of record. We accept credit and debit cards only (no invoices, purchase orders or bank transfers). If you have a discount code, open Have a discount code? above the plans, apply it, then choose your plan: the plan cards show the discounted price, and Paddle’s checkout shows the discount before you pay. Codes are for a company’s first subscription. Paddle charges your card, adds the right VAT or sales tax, and emails a VAT invoice for every payment. Enter your company VAT number at checkout to have it shown on invoices (and reverse-charged where that applies).

Per-device review charges

On paid plans, reviews are also billed per device at a rate that depends on the device type — firewall, switch, Wi-Fi, NAC or IoT/CCTV device (a switch is half a firewall by default). Account › Plan & billing shows a running total of this month's reviews by type under Config reviews. Site admins set the rates, including volume discount bands, under Admin › Pricing, and can change them at any time.

Changing plan or users

Switch plan or change the number of extra users at any time. Changes are prorated: you're charged or credited the difference for the rest of the billing period.

Invoices

Download invoices from Account › Plan & billing, or from Manage billing, which opens Paddle's secure page where you can also update your card.

Cancelling

Cancel from Manage billing. You keep your plan until the end of the period you've paid for, then the company moves to the free plan. See the refund policy.

Failed payments

If a renewal fails, Paddle retries and emails the billing contact. Your plan stays active during this time. Update your card in Manage billing to fix it.

Teams & companies

Inviting: Account › Team › Invite someone. If email is set up, they get an email; otherwise copy the link and send it yourself. Invitations work for 7 days and only for the address they were sent to. Each person uses a seat, and invitations reserve one until they expire.

Several companies: consultants and MSPs can belong to more than one company. Switch with the company menu in the header. Each company has its own people, plan and billing.

Account security

• Forgot your password? Use Reset your password. The link works once and expires after an hour.
• Change password: Account › Profile & security.
• Two-factor sign-in: Account › Profile & security › Set up two-factor. Scan the QR code with an authenticator app and enter the code. We recommend it for every owner and admin.
• Delete your account: Account › Profile & security. If you're the only owner of a company with other people in it, make someone else an owner first. Cancel any paid plan before deleting a company.

Privacy & your data

Firewall configurations are analysed by code running in your browser tab. They are never uploaded, stored or logged by us. The site's security policy only allows it to talk to our account service and our payment provider, and the config is never included in those requests. Closing the tab or signing out clears it.

We store your name, email, company details, team membership, plan, and usage metadata: when a review, change review, multi-firewall review, PDF or conversion ran, and (if you use the scanner) your verified targets and scan results, the platform, rule count, score, grade, number of findings by severity and standard. On paid plans we also store device labels with a salted one-way fingerprint of each hostname, and accepted risks as a one-way fingerprint plus the check type, severity, reason and expiry you enter. We never store the hostnames, IP addresses, rule names or findings in your configs. If you list assets for vulnerability monitoring, we store what you type for them, including IP addresses only if you enter them. See the privacy notice for the full detail.

Troubleshooting

"Couldn't tell which platform this is"

Pick the platform manually. Make sure you pasted the whole export, including the first lines.

Objects "used in a rule but not defined"

Usually built-in objects that the export doesn't include (for example SonicWall "LAN Subnets" or Junos predefined applications). Check they exist on the device and contain what you expect.

Fewer rules than expected

Check you exported the right policy layer, VDOM or virtual system. Rules in IPv6-only policies, VPN-only policies or inline layers are skipped and listed in the review notes.

No confirmation or invitation email

Check spam and quarantine folders and allow emails from our domain. You can resend the confirmation from the sign-up page. An admin can copy an invitation link from Account › Team.

The checkout doesn't open

Ad blockers and strict privacy extensions can block Paddle's checkout. Allow it for this site, or try another browser.

The PDF doesn't download

Check your browser allows downloads from this site. Very large rulebases can take a few seconds to build.

Contact

Email . Include your company name, but never send a real configuration. If you need us to look at a parsing problem, send a sanitised copy with fake IPs and no passwords. Billing questions about a payment can also go to Paddle via the link in your receipt email.