Cycling through all six. Tap any point to stop.

Measured on six things

Find out how hackers could get into your website. Free, in 60 seconds.

Speed

Lighthouse mobile 55/100 and desktop 54/100, but LCP 26.6s and FCP 23.4s are severe. CLS 0 and TBT 0ms show the page is stable once it arrives — it just takes far too long to get there.

Screenshots

1 / 1

CyberScore Labs

About this app

Hackers scan business websites every day, looking for an easy way in. CyberScore Labs runs the same check on your site, for free, in 60 seconds. It shows whether scammers can send fake emails from your company address, whether old test sites are still online, and whether your site's encryption is out of date. You get a private report in plain English, with the exact fix for each problem. Most fixes take under an hour and cost nothing. There's nothing to install and no password to share. Need help fixing it? We'll introduce you to a vetted local IT security firm, free.

Key features

1Free 60-second website exposure scan covering email spoofing, stale test sites, and outdated encryption.
2Plain-English private report with severity-coded findings and a specific fix for each issue.
3Free referral to a vetted local IT security firm for remediation help.

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Small Business Owners

Pain points

Limited budget and expertise for security audits.

Primary needs

Affordable, quick assessment to protect business assets.

Scout Review

Written by AI from measured evidence, scored out of 100.

CyberScore Labs takes a genuinely good idea — run the same exposure checks attackers run, then explain the results to someone who has never heard the word 'DMARC' — and ships it with a homepage that mostly delivers on that promise. The report preview is the best thing on the site: color-coded severity rows, plain-English descriptions, action tags. It tells a small business owner exactly what they're buying before they buy anything. The problems are concrete and fixable. The page takes 26.6 seconds to render its largest element on mobile, which undercuts the '60 seconds' pitch in the most embarrassing possible way. The company's own domain has no SPF and no DMARC, which is the exact vulnerability it sells protection against. And the security headers are largely absent — 4 of 12 checklist points. None of this is fatal. All of it is embarrassing for a security product. The growth story is sound: the alternatives listed are reconnaissance tools for practitioners, and this is a translator for everyone else. That's a real gap. Whether the referral-based monetization can carry it is the open question.

Measure by measure

Usability

Two-step hero form, sample report preview, and numbered process cards with time estimates make the flow clear before signup. No password required is a real friction win. Docs and help center depth are not evident from the collected content.

Design

Clean, scannable homepage with strong severity color-coding and consistent card styling. The report preview sells the product well. The threat intel bar above the headline is visually noisy and competes with the main CTA.

Speed

Lighthouse mobile 55/100 and desktop 54/100, but LCP 26.6s and FCP 23.4s are severe. CLS 0 and TBT 0ms show the page is stable once it arrives — it just takes far too long to get there.

Security

HTTPS enforced with HSTS, which is the floor. But no CSP, no frame protection, no X-Content-Type-Options, no Referrer-Policy, and — for a company that scans email spoofing — no SPF or DMARC on its own domain. 4/12 checklist points.

Accessibility

Lighthouse accessibility 94/100 with a single failing audit on color contrast. No WCAG conformance statement or a11y page found. Responsive layout and readable structure are present; multi-language support is not evident.

Growth

Real problem, specific customer (small business owners without security budget), and a genuine wedge: free, 60-second, plain-English results versus Shodan/Censys/Nmap, which assume you already know what a port is. Early stage — domain registered 2026-09-21, one social profile.

Improvement areas

Publish SPF and DMARC records — the product's own domain is currently spoofable.
Add missing security headers (CSP, frame protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
Fix the 26.6s LCP and 23.4s FCP on mobile; the '60 seconds' pitch demands a fast page.
Add a help center or FAQ explaining findings for a non-technical audience.

Design & Usability

The homepage does the hard part well: it makes a security scan feel approachable. The report preview with color-coded severity rows is the strongest asset — it shows a non-technical owner exactly what they'll get before they type a URL. The two-step hero form, the sample report link, and the numbered process cards with time estimates all reduce commitment anxiety. Where it slips: the threat intel bar above the headline uses three different pill treatments and pulls attention away from the CTA, and some finding rows carry descriptions long enough to wrap awkwardly on smaller screens. Documentation depth is unclear from the collected content — there's no visible help center or FAQ, which matters for an audience that by definition doesn't know security terminology. The design is above-average for an early-stage indie tool; the usability is competent but the post-scan experience is where the real test lives, and that isn't visible from the marketing site.

Speed & Security

Speed is the weak spot. Lighthouse mobile performance lands at 55/100 with an LCP of 26.6 seconds and FCP of 23.4 seconds — those are not marginal numbers, they're the kind that lose visitors before the hero renders. The good news: CLS is 0 and TBT is 0ms, so the page is stable and the main thread isn't blocked. The problem is delivery, not execution. For a product whose entire pitch is '60 seconds,' a 26-second largest contentful paint is a credibility problem, not just a performance one. Security is a mixed picture. HTTPS is enforced with HSTS, which is the baseline. But the HTTP probe found no CSP, no frame protection, no X-Content-Type-Options, no Referrer-Policy, and no Permissions-Policy — 4 of 12 checklist points. More pointedly: the DNS probe found no SPF and no DMARC records on cyberscorelab.com. This is a company that scans businesses for email spoofing exposure. Its own domain is spoofable. That's not a nitpick, it's the exact finding it would report to a customer.

Accessibility & Growth

Accessibility scores well on automated checks — Lighthouse 94/100 — with one failing audit for insufficient color contrast. That single failure is worth taking seriously here, because the product's core UI language is color-coded severity (red/orange/yellow/green). If contrast is marginal, the primary information channel degrades for low-vision users. There's no WCAG conformance statement or dedicated accessibility page in the collected content, and no evidence of multi-language support. Growth is the more interesting question. The problem is real: small business owners genuinely don't know whether their email can be spoofed or whether an old staging site is still live, and they genuinely can't afford a $10k audit. The wedge is specific — free, 60 seconds, plain English, no install, no password — and it's a real contrast with the listed alternatives. Shodan, Censys, and Nmap are reconnaissance tools for people who already speak the language; CyberScore Labs is a translator for people who don't. That's a legitimate position. The limit is monetization: a free scan is a lead magnet, and the revenue path runs through referrals to local IT firms. That's a real business model but a slow one, and it depends on a partner network that isn't visible yet. Domain registered 2026-09-21, one social profile — very early.

Conclusion

The honest read: this is a well-positioned early-stage product with a credibility gap it created for itself. A security company that fails its own security checks is a hard sell, and 26.6 seconds of LCP is a hard sell to anyone. But the underlying idea — free, fast, plain-English exposure scanning for businesses that will never open a terminal — is a real one, and the site communicates it clearly. Fix the headers, publish SPF and DMARC, get the LCP under three seconds, and this becomes a product you can recommend without a caveat. Until then, it's a good pitch with a self-inflicted wound.

Suggestions for improvement

Publish SPF and DMARC records for cyberscorelab.com immediately — a security vendor with a spoofable domain is the worst possible look.
Add CSP, X-Content-Type-Options, Referrer-Policy, and frame protection headers; 4/12 checklist points is below category baseline.
Fix the 26.6s LCP — audit image weight, enable proper caching, and consider a CDN; the '60 seconds' pitch demands a fast page.
Add a help center or FAQ explaining the findings in plain English; the target audience won't know what 'unshielded endpoint' means.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	CyberScore Labs	Shodan	Censys	Nmap
Primary audience	Non-technical small business owners	Security researchers and practitioners	Security teams and analysts	Network engineers and pentesters
Skill level required	None — plain-English report	High — query syntax and protocol knowledge	High — certificate and scan data literacy	High — CLI and network fundamentals
Pricing model	Free scan; referral to paid IT firm	Free tier; paid memberships	Free tier; enterprise pricing	Free and open source
Installation required	None — browser-based	None — web search interface	None — web interface	Yes — local software install
Remediation guidance	Specific fix per finding plus IT firm referral	Raw data; no remediation guidance	Raw data; no remediation guidance	Scan output only; no guidance