Threat Vector Management · Helpful tools

Cool tools we think you'll find useful

Checks we use when a link looks wrong, an email doesn't add up, a site goes dark or a client asks "are we exposed?" One strong pick per job, grouped by discipline. Each opens the provider's own site in a new tab.

Start here · AI discovery

Let AI find your business without handing it the keys

AI assistants now answer "who should I call?" questions. If they can't read your site, you aren't in the answer. Is It Agent Ready is a free scanner built and run by Cloudflare; it is not a Threat Vector Management tool, and we have no affiliation with it. You can open the door for discovery and still keep control.

Open Cloudflare's Is It Agent Ready scanner

Doing it safely

  1. Say who gets in. Publish robots.txt and a sitemap, and name the AI bots you allow. You can allow search and answers while refusing model training; Cloudflare's Content Signals let you state that in robots.txt.
  2. Point agents at public pages only. llms.txt and Markdown versions of pages should list marketing and help content. Never admin panels, staging sites, client portals or internal APIs.
  3. Don't build doors you don't need. Leave out MCP, OAuth and agent-payment endpoints unless you actually offer an API or checkout. An empty door is still a door.
  4. Verify bots; don't trust their names. A bot can claim to be anyone. Use your CDN or firewall's verified-bot controls and rate limits.
  5. Re-scan after every site change, and watch your logs for bots ignoring your rules.

Ten that answer most questions

AI and agent discovery

AI assistants and agents now find businesses the way search engines do. These show what they can read on your site, and what they can't.

From our blog: The Approval Prompt Is Annoying on Purpose: limiting what AI agents can reach · The Insider Risk You Buy Monthly: AI agents as insider risk (talk)

URL, domain and IP reputation

Is that link, sender or IP address known to be bad? Check more than one source; each sees a different slice of the internet.

From our blog: Threat Briefs: indicators from active campaigns, defanged and sourced

Malware sandboxes and file analysis

Run a suspicious file or link somewhere that isn't your laptop and watch what it does. Detonate in two or three; malware that hides from one often shows in another.

Before you upload: Most public sandboxes publish what you submit. Treat every upload as public. Never submit client data, contracts or internal files; submit the file hash first.

Email headers, authentication and deliverability

Read where a message really came from, and check that your own SPF, DKIM and DMARC stop others sending as you.

Website security, TLS and privacy

What your site shows the world: certificate, security headers, trackers and known malware.

Is it down? Uptime and outages

Is it you, your provider, or the internet? Answer that first in any incident.

DNS, domains and network

Who owns it, where it points, and whether the record you changed has actually changed.

Breaches and identity exposure

Find out what is already out there, then shut the doors it opens.

From our blog: PIVCCERL incident response lifecycle, with breach-notification deadlines

Personal privacy and device hardening

Shrink what people can find about you, and turn off what your devices share by default.

Frameworks, standards and attack knowledge

The shared maps of how attacks work and what good looks like. Use them to check a plan against something other than your own judgment.

From our blog: Threat Modeling at Every Pull Request (TIDev) · Prove It, Then Ship It: a secure development standard you can copy

Detection engineering and forensics

Free tools from practitioners the field trusts: write detections, prove they fire, then collect and read the evidence when something gets through.

Before you upload: These tools run with administrator rights or simulate real attacks. Use them only on systems you own or are authorized to assess, test in a lab first, and check each licence: some are free for internal use but not for paid work on client networks.

From our blog: PIVCCERL incident response lifecycle · Threat Briefs: hunt packs for active campaigns

Vulnerabilities, threats and ransomware

What is being exploited right now, and what to patch first.

From our blog: Threat Briefs: what's being exploited and how to hunt for it

Analyst utilities

Decode, unpack and look back in time.