From free tools to consulting engagements, every service follows the same set of principles: you run it yourself, the source code is readable, nothing is installed and nothing is left behind. Prices are published in full on the pricing page; online ordering requires no contact with us at any step.
View a full sample report → (in Chinese)
No registration, no order code, available any time. These are not trial versions — they are fully functional. Since they never touch your hosts, we have no reason to charge for them.
Upload the contents of sshd_config, nginx.conf, docker-compose.yml, Dockerfile, a Kubernetes manifest or sysctl.conf and get hardening advice immediately. We do not store your files.
The rules come from real operational experience: configurations that actually cause incidents, and settings that look complete but are silently ineffective.
Enter a domain to find out whether others can send mail impersonating it: we check whether SPF / DKIM / DMARC are actually in effect — in particular the cases where they are configured but silently failing.
Only public DNS records are queried. We never connect to your servers, and no credentials are required.
We review the tenant settings attackers actually exploit, not a best-practice checklist: whether legacy authentication can still bypass MFA, whether external auto-forwarding exists, how third-party app consent is controlled, whether unified audit logging is on, and the number and MFA status of admin accounts.
We have no access to your tenant. You run a read-only PowerShell script on your own tenant (complete, readable, unobfuscated source — every call is a Get-*), then decide whether to upload the resulting JSON. No OAuth admin consent, no app registration, and we hold no tokens — nor do we keep your file.
If an item cannot be collected because a module is missing or permissions are insufficient, the report marks it "cannot determine" rather than treating it as a pass. Not collected is not the same as no problem — most automated checkers simply skip what they cannot read, which then looks identical to "checked, no issues".
You download the collector, run it on your own hosts, and decide for yourself whether to upload the results. The assessment report is generated immediately after upload. The order code is issued as soon as payment completes — no contact with us required at any step.
Typical use: confirming whether one or a few servers have been compromised. Compliance-mapped editions are also available: identical examination, with the report adding a mapping chapter for the Taiwan PDPA security maintenance measures, ISO/IEC 27001:2022 Annex A, or the Taiwan government Information and Communication System Protection Baseline — the price difference buys the translation of findings into audit language, not a stronger scan.
A one-off check is a snapshot; continuous monitoring detects change. The first run establishes a baseline of the host's normal state; every subsequent daily run reports only the differences — the baseline stays on your host, and we only ever receive the diff.
If a host that should report fails to do so, we notify you proactively — from where you sit, "monitoring broke" and "all is well" would otherwise look identical.
A host assessment looks inside the system; this one looks at what you expose to the internet — reachable ports, TLS certificate state, DNS records, HTTP security headers, and subdomains found in public certificate transparency logs (including the test sites you may have forgotten). Checked daily, and you are notified only when the exposure changes. Nothing is ever installed or executed on your hosts.
We send no connection to a domain until its ownership has been verified, and we re-verify every 30 days — authorization has to hold continuously, not just once. Scans only open TCP connections and read public responses; no attack payloads, no login attempts.
How attack surface monitoring works → (in Chinese)
Pricing and online ordering → (in Chinese)
A backup that "runs" is not a backup that restores — a truncated database dump or a corrupted archive looks like a perfectly normal file on the backup side. You complete one restore drill; the verification program examines the restored artifacts offline (dump completion markers, full CRC verification of archives) and inventories your backup schedules, offsite and encryption indicators, producing a verification report you can hand to an auditor.
Your backups and data never reach us. The verification program is fully offline, read-only, and readable source; we only receive the verification results. Anything it cannot examine is honestly listed as "undetermined" rather than silently skipped.
How backup verification works → (in Chinese)
Pricing and online ordering → (in Chinese)
Batch collection across multiple hosts, cross-host correlation, per-finding attribution, and a formal assessment report. Interpreted by people, not raw tool output. Suitable for fleet-wide reviews, audit requirements, or situations where a compromise is already suspected. Get in touch →
Prices are public, but we are still gathering feedback from real environments. Customers willing to tell us afterwards which parts of the report helped, which did not, and what price range they would have considered reasonable can write to contact@odysec.org for a discount. Places are limited to the number of reports we can review by hand, one by one.
# 1. Download and verify the hash — confirm you have the version we published $ curl -O https://check.odysec.org/download $ sha256sum odysec-check.py # 2. Review the source before running — this program requires root $ less odysec-check.py # 3. Run the collection (fully offline; connects to nothing) $ sudo python3 odysec-check.py --token ODY-XXXX-XXXX Done (18.9s) Result file: odysec-your-server-20260727.json # 4. Inspect the contents, then upload only if you are comfortable with them $ curl -X POST https://check.odysec.org/api/upload \ -H "X-Odysec-Token: ODY-XXXX-XXXX" --data-binary @odysec-*.json {"ok": true, "report_url": "https://check.odysec.org/r/..."} $