Available
Attack Surface Scan
Passive checks of TLS and certificates, security headers, leaked software versions and exposed admin paths, run only on domains you've verified you own.
Cloud & AI Security Platform
Know your external risk in minutes.
Run a free assessment and get a risk score with prioritized findings across TLS, security headers, email authentication (SPF/DMARC) and exposed files. Passive, non-intrusive, and limited to domains you have verified.
- ✓ Ownership-verified scans
- ✓ Non-intrusive by design
- ✓ Talk to sales
Platform
One platform for cloud and AI-era risk
Available today: attack surface scanning, an executive risk score, cloud posture scanning, continuous monitoring, Breach Watch, Vendor Risk, Compliance Mapping and AI security.
Available
Executive Risk Score
A single 0–100 risk score and grade, severity-ranked findings, and clear remediation steps for each. Every report is Ed25519-signed and tamper-evident.
Available
Cloud Posture Scanning
Find misconfigurations across AWS, Azure and GCP, including public storage, over-permissive IAM and exposed services, using read-only access.
Available
AI Security
Inventory Bedrock, SageMaker, Azure OpenAI and Vertex AI, flag public model endpoints, leaked AI API keys and over-broad AI permissions, and safely test your own LLM endpoints for prompt injection. Mapped to OWASP LLM Top 10 and NIST AI RMF.
Available
Breach Watch
See which staff emails on your domain show up in known data breaches, with alerts when new exposures surface.
Available
Continuous Monitoring
Scheduled rescans by plan (monthly, weekly or daily) with instant in-app alerts on new or critical findings and a live next-scan schedule on your dashboard.
Available
Vendor Risk
Assess the external security posture of suppliers and SaaS vendors before their weak spot becomes yours. Passive HTTPS checks, clearly labeled as not owner-verified.
Available
Compliance Mapping
Map findings to SOC 2, ISO 27001 and PCI DSS controls, with a hash-chained audit trail you can hand to auditors.
Product
Executive-ready reports. Engineer-ready remediation.
Every finding states the business impact, shows the evidence, and lists precise remediation steps. Leadership tracks one risk score; engineering gets an actionable, prioritized checklist.
- 0–100 risk score with an A–F grade
- Severity-ranked findings across TLS, headers, software and exposure
- Remediation guidance for Nginx, Apache, WordPress and CDNs
- Ed25519-signed for verifiable report integrity
Security report · your-company.com
38
risk / 100
Grade C
Several issues require remediation
- highCertificate expires in 9 days
- mediumNo Content-Security-Policy
- mediumServer version revealed: nginx/1.18.0
- lowWordPress admin login is public
✓ Ed25519 signature verified
Trust
Built to the standard we assess you against
Drovantra is engineered with the same controls we check for in your environment.
Ownership verified first
Every domain must prove ownership by DNS TXT record or meta tag before a single request is sent.
Strictly non-intrusive
HEAD and GET requests only, rate limited, with timeouts. Sensitive paths are checked by status code alone and their contents are never downloaded.
SSRF-hardened scanner
Targets that resolve to private, loopback, link-local or reserved addresses are refused, and connections are pinned to the IP we vetted.
Tamper-evident by design
Reports are signed with Ed25519, and every action lands in a hash-chained, append-only audit log.
Tenant isolation
Customer data is partitioned per organization, and every query is scoped to your org.
Built to our own standard
Strict nonce-based CSP, HSTS preload, no production source maps, secrets kept in the environment, and automated dependency audits in CI.
Compliance roadmap: SOC 2 Type II and ISO 27001 certification are planned and not yet achieved. Read how we scan and protect your data →
Pricing
Transparent pricing
Start with a free assessment. Scale to continuous monitoring as your coverage grows.
Free
$0
Baseline assessment for a single verified site.
- 1 site
- Manual scans only
- Prioritized findings summary
Starter
$49/mo
Continuous coverage for one critical web property.
- 1 verified site
- 1 vendor assessment
- Automatic scans every month
- Remediation guidance + signed, executive-ready reports
Most popular
Business
$199/mo
For security teams managing multiple web properties.
- Automatic scans every week
- Instant in-app alerts for new or critical findings
- Up to 5 verified sites
- Up to 5 vendor assessments
- Team members & roles
- Audit log
Enterprise
Custom pricing
For organizations with a broad external attack surface.
- Everything in Business
- Up to 25 sites (higher on request)
- Up to 25 vendor assessments
- Bulk add via list or CSV
- Root-domain verification covers subdomains
- Automatic scans every day
- Instant in-app alerts
- Priority support
Protecting a larger organization?
Talk to us about multi-domain coverage, custom site limits and a rollout plan for your security team.
For individuals & families
Drovantra Personal checks texts, emails, links and phone numbers for scams, and alerts you and your family to data breaches.