See what attackers see.
Every night between 01:00 and 05:00 your time, Noctis hunts your website for the bugs attackers look for.
A live map of where it is currently night. Green areas are inside the 01:00 to 05:00 scan window right now. Click the globe to check a location. Use arrow keys to rotate, Enter to select the center point, and Home to reset the view.
UTC --:--:--
Window 01:00 to 05:00
Target
/
What we hunt for
The same open-source tools security professionals use, run on a schedule and translated into a report you can act on.
Known vulnerabilities and leaked files
Thousands of Nuclei checks for published CVEs, outdated software, open admin panels and files that should never be public. Updated daily as new issues are disclosed.
TLS and HTTPS
Certificate validity and expiry, outdated TLS versions, and whether plain HTTP is redirected to HTTPS.
21 days
Our early warning before a certificate expires.
Headers and cookies
The browser protections that stop clickjacking, XSS and session theft.
Strict-Transport-Security: max-age=31536000
Full-site crawl
OWASP ZAP maps your pages and inspects every response for information leaks, insecure forms and revealing error messages.
Attack simulation
Monthly on Starter, weekly on Business and Agency: an active scan tests your forms and parameters for SQL injection, cross-site scripting, path traversal and command injection.
Opt-in per siteWhile your team sleeps, Noctis walks every page of your site, tests every header, checks every certificate and hunts down the bugs attackers love. By morning, you know exactly what to fix.
Set up in five minutes. Protected by tonight.
No software to install, no code changes and no access to your server.
Add your website
Enter your domain. That's all we need to start.
Prove it's yours
Add one DNS record or upload one file. Your first scan starts right after.
Wake up to answers
We scan overnight in your timezone and only email you when something new shows up.
We only hunt on land you own.
Security testing someone else's website is illegal. Our safeguards make sure that never happens through us, and that we never put your site at risk.
Ownership checked before every scan
If your verification record disappears, scanning pauses and we let you know.
Attack scans are opt-in
Active testing only runs after you explicitly enable it for a specific site.
Gentle on your server
Rate-limited requests, one scan per site at a time, and only at night when traffic is low.
Your results stay private
Reports are visible only to your account. We never share or publish findings.
Simple pricing per website
Every plan includes nightly scans, full reports and email alerts. Cancel anytime.
- 1 website
- Nightly passive scan
- Email alerts on new issues
- Full reports with fixes
- Monthly attack simulation
- Up to 5 websites
- Nightly passive scan
- Email alerts on new issues
- Full reports with fixes
- Weekly attack simulation
- Up to 25 websites
- Everything in Business
- One dashboard for all client sites
- Priority support
Prices exclude VAT.
Questions
Is this a penetration test?
No. It's continuous automated vulnerability scanning. It catches the common, known problems every night, which is where most real-world breaches start. A human penetration test goes deeper into business logic and is still worth doing once a year if you handle sensitive data.
When exactly do scans run?
Scheduled scans start between 01:00 and 05:00 in your own timezone, which we detect when you sign up and you can change anytime. You can also start a scan manually from your dashboard.
Will scanning slow down or break my website?
The nightly scan only reads what your site already serves, at a limited request rate, so it's safe for live sites. The attack simulation does submit test input to your forms, which is why it's opt-in. We recommend pointing it at a staging copy if you have one.
Why do I need to verify ownership?
So nobody can use our service to scan a website they don't own. It takes one DNS record or one uploaded file, and we re-check it before every scan.
Can you scan pages behind a login?
Not yet. Scans currently cover everything a visitor can reach without logging in. Authenticated scanning is on our roadmap.
Let Noctis take the night shift.
Add your site tonight. Your first report is waiting when you wake up.
Start scanning