Toolkit library.Every check in one place.
Free checks and threat toolkits for small businesses. Pick a country in the top bar to see what applies to you.
26 results · All countries
Out-of-date iPhones, iPads and Macs are being attacked
A 2024 Apple flaw that helps attackers get past a built-in protection is now being exploited. Updating fixes it.
WordPress sites can be taken over while they update
A flaw in how WordPress installs core updates lets attackers run code on your server. Update to WordPress 7.1.4.
Office VPN gateways are being taken over
Attackers are chaining three Ivanti Connect Secure flaws to run commands on VPN gateways. Update, and check for signs of a break-in.
Cisco firewalls can be crashed through their VPN
A flaw in Cisco ASA and FTD firewalls lets anyone on the internet make the device restart through the VPN service. Update to a fixed release.
Online shops on Magento and Adobe Commerce need the July update
Adobe fixed critical flaws in its shop software in July. One is now being exploited, so any shop that skipped the update is exposed.
Two PHP flaws let attackers run code on web servers
Two critical PHP flaws let anyone on the internet run code on a server that runs PHP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Backup servers (AhsayCBS) are being broken into
Two critical AhsayCBS flaws let attackers bypass login and run commands on backup servers. Update, and rebuild if you may have been hit.
A Windows security feature can be bypassed, and attackers are using it
Microsoft's October update fixes a Windows Shell flaw that attackers are already exploiting. Install the October 2026 updates.
Business email gateways (FortiMail) are under attack
A critical Fortinet FortiMail flaw lets attackers write files to the server with no login. Update to 8.0.2, 7.6.7 or 7.4.9.
Office routers (MikroTik) are being taken over through SSH
Attackers are taking full control of MikroTik routers that expose SSH to the internet. Update RouterOS and close remote access.
Staff approving login prompts they did not start
Attackers who have a password send login prompts until someone taps Approve. Number matching and passkeys stop it.
Fake invoices from suppliers you really use
Criminals take over or copy a supplier's email, then ask you to pay a new bank account. A phone call before paying stops it.
Email domain check
See if criminals can send email that looks like it came from you. Checks SPF, DKIM, DMARC and more.
Password check
Find out if a password has appeared in a data breach. It never leaves your device.
Email breach check
See which known breaches include your work email address. We confirm it is yours first.
Cyber Essentials readiness
Twelve plain-English questions across the five Cyber Essentials controls. Know your gaps before you apply.
Website security check
Checks HTTPS, certificates and security headers on any website you run.
Domain ownership check
Prove you own a domain with a DNS TXT record. Unlocks checks for every address on it.
Spot the phishing email
Ten real-world examples. Learn the signs your team should look for.
Office Wi-Fi and router check
Default passwords, old firmware and open admin pages, in one checklist.
Backup readiness
Could you recover from ransomware by Monday? Find out in five minutes.
Data breach: who to tell
When you must report to the ICO, who to notify, and the 72-hour clock.
Does NIS2 apply to you?
Check if the EU NIS2 Directive covers your business or your customers.
Essential Eight self-check
Score yourself against the ASD's Essential Eight maturity model.
Notifiable data breaches
When the OAIC scheme requires you to tell customers and the regulator.
Small business security basics
The CISA starter checklist, rewritten for teams with no IT department.