Services

Digital Trust Snapshot

A point-in-time review of visible digital trust signals across selected domains, email, DNS, certificates, and web surfaces. The right starting point before deciding what to fix.

An independent view from the outside, before you decide what to fix

Most organisations do not have a clear picture of what their public-facing digital systems are currently signalling. The Digital Trust Snapshot provides that picture: a structured, evidence-based review of observable trust signals across agreed surfaces, translated into findings and prioritised actions that are designed to be understood by technical and non-technical stakeholders alike.

It is the right entry point before an incident, before a launch, before a board needs to understand risk, or when leadership needs clarity over a fragmented digital estate.

Best for

Organisations that need an initial view of their digital trust posture before deciding what to address first. The Snapshot identifies what is present, what is missing, and what is most urgent — without requiring the organisation to already know what the problem is.

What is included

Typical areas of assessment

  • Domain registration and expiry posture
  • Registrar and DNS provider visibility
  • DNSSEC posture where relevant
  • Email authentication signals: SPF, DKIM, DMARC, MTA-STS, TLS-RPT
  • Certificate and HTTPS posture
  • Visible web trust signals
  • Ownership and operational accountability indicators
  • Identity and authentication signals
  • Third-party and delegated trust signals

Not in scope

  • Penetration testing or active exploitation
  • Full compliance audit or certification
  • Implementation or remediation delivery
  • Internal or authenticated surfaces
  • Mailbox, user, or identity platform configuration

Scope is agreed upfront and confirmed before the engagement begins. For a targeted email-only review, see Email Trust Review. For a focused domain estate review, see Domain Governance Review.

Outputs

  • Executive summary with overall trust posture interpretation
  • Findings and evidence pack with source references
  • Trust interpretation — what each finding means operationally and in governance terms
  • Prioritised action list with sequencing and ownership guidance
  • Readout session to walk through findings and answer questions

Four steps, defined timeline

Step 01 Scope

Agree primary domains and surfaces. Capture known concerns or planned changes.

Step 02 Assess

Observable signal collection across agreed surfaces. All assessment is conducted from publicly observable data — no internal access required.

Step 03 Interpret

Findings translated into operational and governance terms. Evidence compiled, actions prioritised.

Step 04 Readout

Findings presented to your team. Questions answered. Next steps confirmed.

Most Snapshots complete within two to three weeks of scope confirmation.

Fixed fee, no surprises

Scope is agreed upfront. No hourly billing.

From AUD $7,500 + GST · fixed fee · scope confirmed before engagement begins

Final pricing is based on the number of surfaces in scope. A short scoping conversation confirms fit and cost before you commit.

What the output looks like

De-identified and simplified examples below.

Executive summary extract De-identified

Overall trust posture: Amber

Meaningful gaps in email authentication and operational transparency. Domain and DNS posture are generally sound. Three issues warrant priority attention — two are low-effort, one requires a governance decision before technical remediation can begin.

Findings extract De-identified
DMARC policy not enforced
A DMARC record exists but is set to p=none. Email from this domain cannot be rejected by receiving mail servers. Spoofing risk is visible to external observers with basic tooling.
High
No public status surface
No status page or service communication surface exists. During service issues, there is no channel for operational transparency — a trust and governance gap.
Medium
HTTPS posture sound
Primary domain and key subdomains enforce HTTPS with valid certificates. HSTS is in place on the primary domain.
Satisfactory
View more examples →

Ready to start?

A short enquiry is all it takes. Scope and cost can be confirmed from there.