Free Network Scan

A free network scan probes the public-facing IP address you provide for the open ports and services exposed to the internet. The scanner is the same class of tool an attacker uses on day one of a reconnaissance phase: nmap-style port enumeration, banner grabbing on responding services, and a check for the most common misconfigurations on each (default credentials on admin interfaces, expired or self-signed certificates on HTTPS endpoints, deprecated TLS versions still negotiating).

What you learn from a network scan is the size of your external attack surface. Most UK SMEs have one of three results. The first is a small, intentional surface (just web traffic on 80/443, mail on 25/465/587). The second is a medium surface with one or two unintentional things exposed (an admin panel that should only be reachable on the internal network, an old service running on a forgotten subdomain). The third is a sprawling surface where servers, devices, or developer environments have been published to the internet without anyone realising.

Cyber Essentials does not strictly require an external port scan, but the firewall control asks that only the ports your business needs are reachable from the internet. The free scan is the cheapest way to find out what those ports actually look like from outside. Anything you cannot explain on the result list is the next thing to investigate.