Footprint, by OSXP · External exposure monitoring, built in Australia

Every organisation leaves a footprint. See yours before someone else does.

Leaked staff passwords. A forgotten server. A lookalike domain registered last week. Attackers find these in an afternoon; most organisations find out from the breach notification. Footprint shows you what they'd find, in plain language, and Yeti, our AI remediation agent, walks your team through the fix.

See what a report covers
Passive-first by design. No agents, no credentials. Light, read-only checks confirm findings and remove false positives. Data stays in Sydney. AWS ap-southeast-2. Mapped to ASD Essentials and MITRE ATT&CK.

What we found on day one.

Footprint beta · 21 Australian organisations · October 2026

48%

had a validated critical finding on day one.

Confirmed, not dismissed as a false positive.

29.6%

of monitored domains had basic email-security gaps.

DMARC missing or not enforced, so mail can be sent as them.

33%

had discoverable plain-text passwords.

Staff email addresses with a password exposed in clear text in breach data. We never use or store the credentials we find.

What does an attacker see when they look you up?

The same first-pass picture someone planning an attack would build: how easy you are to impersonate, what you've left exposed, and who's already registered domains that look like yours.

We only scan the domain of the work email you verify, so staff credential details are only ever shown to that domain's owner. No credit card needed.

kestrelhealth.exampleExample result
Email spoofing protectionWeak · DMARC p=none
Hostnames in public certificate logs37
Lookalike domains registered4
Remote-access portal identifiedFortinet SSL VPN
Staff credentials exposedVerify ownership to see

Your footprint, mapped.

Footprint follows the same trail an attacker would: leaked staff logins, forgotten servers, lookalike domains, ransomware leak sites. Every stop on the trail becomes a finding your team can act on.

CRITICAL
Remote Desktop open to the internet
legacy-ts.kestrelhealth.example
CRITICAL
Staff login in an infostealer log
captured 6 weeks ago
HIGH
VPN gateway with known exploited CVEs
remote.kestrelhealth.example
HIGH
Forgotten staging server
staging-old.kestrelhealth.example
Kestrel Community Health · demo organisation

Every finding, with the evidence attached.

Findings ranked by what matters, the assets and identities behind them, and an Exposure Rating your leadership can track. This is the demo organisation; yours looks like this within a day.

Kestrel Community HealthDemo organisation kestrelhealth.example · last scan 14 min ago
Exposure Rating
64/100
Up 10 in 30 days
Discovered assets
32
4 new this week
Open findings by severity
3 critical9 high11 medium8 low
Needs attention
CRITICALStaff credential in a recent infostealer log
j.okafor@kestrelhealth.example · captured 6 weeks ago
CRITICALRemote Desktop open to the internet
legacy-ts.kestrelhealth.example · port 3389
HIGHSupplier named on a ransomware leak site
Brightpath Pathology · listed by Qilin 5 days ago
HIGHVPN gateway with known exploited CVEs
remote.kestrelhealth.example · FortiGate SSL VPN

Most tools stop at the alert. Yeti stays for the fix.

Yeti is Footprint's AI remediation agent. It reads each finding, tells you whether it's real, and writes the fix for the systems you actually run, in the order that matters. Nothing runs without your approval.

CRITICAL · Credential exposure

Staff credential in a recent infostealer log

Identity
j.okafor@kestrelhealth.example
Captured
6 weeks ago, from an infected personal device
Also stolen
browser session cookies for 3 work apps
Why critical
recent, current employee, cookies can bypass MFA
Yeti· your Microsoft 365 tenant
  1. Contain now. Revoke all of this user's active sessions, then reset the password. Cookies stay valid after a reset, so do both.
  2. Run this (Detect plan and above, review before running)
    Revoke-MgUserSignInSession -UserId "j.okafor@kestrelhealth.example"
  3. Confirm. Check sign-in logs for the last 6 weeks for unfamiliar locations against the three apps listed.
  4. Prevent. Require compliant devices for work apps, so a personal laptop can't hold work sessions.

A report your board will actually read.

The External Exposure Report scores your exposure across the eleven areas attackers research before they strike, and tells leadership what to fund first.

“I’ve spent 30 years in IT and nearly a decade defending networks. The hardest part was never fixing problems. It was knowing they existed. Footprint shows you what’s exposed, in plain language, and what to do about it.”

— SS, Founder, OSXP.AU

Options for every budget.
No compromise on knowing your footprint.

Four plans along one path: identify what's exposed, detect what's real, protect by fixing it.

Compare plans

Flexible billing: month-to-month, or two months free on annual billing. See pricing.

Know your footprint before someone follows it.

Try the demo