PortWarden
Network vulnerability scanning that runs in the browser, for companies without a security team.
Small and mid-sized companies run servers on the internet but have nobody who runs OpenVAS or Nessus. PortWarden scans a verified domain or IP like an attacker would: it finds open ports, fingerprints the software and version behind each one, matches them against the NIST National Vulnerability Database and flags anything on the CISA list of actively exploited vulnerabilities. Every finding has a plain-English explanation and fix.
- Stage
- Live beta, free
- Launch market
- Danish and Nordic SMBs and IT partners
- Revenue
- Monthly subscription per asset bundle
- Price
- Planned 490 to 1.990 kr a month
- Buyer
- IT managers, managed service providers, agencies
- Stack
- PHP · SQLite · nmap · NVD · CISA KEV
The problem
- Exposed databases, remote desktop and old software versions are the most common way ransomware gets in.
- OpenVAS needs its own server and feed maintenance; Nessus and Qualys are priced and built for enterprises.
- NIS2 and cyber insurers now ask smaller companies to show regular vulnerability scanning.
The product
A hosted scanner with an nmap engine and a curated rule set. After ownership proof, PortWarden scans the top 200 or 1000 TCP ports, identifies services and versions, matches them to CVEs with CVSS scores via the NVD API, marks CISA KEV entries, checks for 30 dangerous exposures (Redis, MongoDB, Docker API, SMB, RDP and more), weak SSH algorithms and expiring certificates, and grades the asset A to F.
- Add a domain or IP and prove ownership with one DNS TXT record or a file.
- Run a quick or deep scan; results arrive in 1 to 10 minutes.
- Fix the top findings with the plain-English instructions.
- Schedule weekly rescans and watch the new / fixed diff.
- Share the read-only report with a developer, auditor or insurer.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Free | 0 kr | 20 scans a day, quick scans, share links. |
| Business | 490 kr a month (planned) | 25 assets, daily scheduled scans, deep scans, alerts. |
| Partner | 1.990 kr a month (planned) | Unlimited client assets, white-label reports, API. |
Market and targets
External vulnerability scanning is a mature market dominated by enterprise tools. NIS2 brings thousands of Danish companies under formal security duties, and cyber insurance questionnaires ask for regular scanning. The gap is a simple, Danish-priced tool an IT generalist can run.
Targets and prices are planning assumptions. Payments are not switched on yet.
Go-to-market
Beta
- Live product with demo (done)
- 20 beta companies from our own network
- Danish texts and email alerts
Partners
- MSP partner program and white-label PDF
- Insurance broker partnership
- Payments and plans
Compliance
- NIS2 evidence pack export
- Authenticated scans via SSH
- Annual external pen-test of PortWarden itself
Channels
| IT partners and MSPs | One partner brings many small clients. |
|---|---|
| Cyber insurance brokers | Need a cheap way for clients to prove scanning. |
| Free SiteSentry scans | Website owners who scan their site are offered server scanning. |
Competition
| Alternative today | Why we win |
|---|---|
| OpenVAS / Greenbone | Free and deep, but needs a server and expertise. |
| Nessus, Qualys, Rapid7 | Excellent, but enterprise pricing and complexity. |
| Online port scanners | Show open ports, but no CVE matching, history or ownership checks. |
What we measure
- Verified assets per customer
- Critical findings fixed within 30 days
- Weekly active schedules
- Trial to paid conversion and churn
Status and roadmap
- nmap TCP connect scanning with service and version detection
- CVE matching via the NVD API with caching and rate limiting
- CISA KEV and ransomware flags
- 30 exposure rules, end-of-life detection, SSH and certificate checks
- One login across PortWarden, SiteSentry and PatchPilot
- Ownership proof by DNS TXT or /.well-known file before intrusive scans
- Queued scan workers, live progress, A to F grading with a 100-point score
- Share links, JSON export, print-to-PDF reports, new / fixed diff against the previous scan
- Scheduled daily or weekly rescans, daily refresh of the CISA KEV catalogue
- Installable PWA, demo account, rate limits and private-network blocking
- Authenticated scans over SSH for exact package versions
- Email and Slack alerts
- UDP checks for SNMP and DNS
- Payments and plans
Risks
| Risk | How we handle it |
|---|---|
| Scanning without permission | Ownership proof is required, private networks are blocked and scans identify themselves. |
| False positives from distro backports | Reports say so clearly; authenticated scans will remove the guesswork. |
| NVD rate limits and delays | Results are cached and an API key raises the limit tenfold. |
Want a product like this?
We build version one of products like PortWarden from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.