Know what’s exposed — and how to fix it
External black-box assessment of the domains you own and authorize. Paid findings include evidence and what to fix — Full Surface adds step-by-step remediation detail where available.
Scan at ragnarok.svalbard.ca — or book a manual pentest when you need hands-on work.
NotarawCVEdump.Rankedfindingswithevidenceandafixpath—andarescanwhenyouwanttoconfirmachange.
How Ragnarøk runs
Order an external assessment of an authorized target yourself. Findings appear once the assessment is published, and paid tiers unlock deeper writeups and more rescans.
What’s covered
One subscription per target. Start free, then choose the depth you need.
- External scanningExternal black-box assessment of your authorized target, with rescans included on paid plans.
- Application & surface testingWeb apps and exposed services — and on Full Surface, a subdomain inventory — with evidence attached to paid findings.
- Vulnerability managementRanked findings with what to fix, optional step-by-step remediation, and a retest path on paid plans.
What a finding looks like
Written for the engineer who has to fix it and the leader who has to understand the risk.
Ragnarøk finding · example format
CriticalAdmin portal accepts default vendor credentials
- What’s wrong
The administration portal on an internet-facing host accepts the vendor’s published default username and password.
- Why it matters
Anyone on the internet can sign in as an administrator, change configuration, and read the data the portal manages.
- Evidence
POST /admin/login → 302 /admin/dashboard Session issued for role: administrator
- How to fix
- Set a unique administrator password and rotate any shared credentials
- Restrict the portal to your VPN or an IP allowlist
- Enable MFA for administrator sign-in if the product supports it
- Verify
Request a retest from the finding. Confirm the default credentials are rejected.
Illustrative format. Findings are specific to your authorized target and never published.
Vulnerability coverage
FromCA$1,891/ month
Continuous, per target. Free Overview available.
Questions teams ask first
Overview is free: severity counts, finding titles, one sample writeup and a PDF. Continuous (CA$1,891/month per target) unlocks critical and important findings with evidence, TLS/header analysis, a credential-exposure section and up to four scans a month. Full Surface (CA$2,947/month) adds a subdomain inventory, all severities, step-by-step fixes and up to six scans a month.
Yes — go to ragnarok.svalbard.ca, verify a domain you own and request a free Overview. Findings appear in the report once the assessment for that domain is published; then unlock Continuous or Full Surface when you want the full writeups and rescans. No sales call required to start.
When you need hands-on testing beyond the automated assessment — deeper application logic, staged intrusive checks, or people to remediate findings. That work is quoted separately from your scan subscription.
A domain you own and written authorization to test. At ragnarok.svalbard.ca you verify ownership and request a free Overview; the report fills in once the assessment for that target is published. Unlock Continuous or Full Surface when you’re ready.
Assessments are external and scoped to the target you authorize. Anything more intrusive is scheduled with you first as a separate manual engagement.
Yes. Reports are written to be shared with auditors and customer security reviews, with remediation status updated after rescans.
See what an attacker sees first
Request a free Overview at ragnarok.svalbard.ca anytime; results appear once the assessment for your domain is published. Book a manual pentest when you want hands-on work beyond the scanner.