Is Cactus really free?

Yes. Cactus is free to use, with no signup and no credit card required. It is built as a community tool to help defenders and founders get a fast read on their external security posture.

Is it safe to run on production?

Cactus is designed as a passive, browser-based scanner. It does not brute force, exploit, or perform invasive testing against production systems.

Can I scan a domain I do not own?

Cactus should be used only on domains you own, manage, or have permission to assess.

Does it replace a penetration test?

No. Cactus provides a fast external security snapshot, but it does not replace a deeper penetration test or full security assessment.

Do you keep my scan data?

Cactus is presented as a hosted browser-based tool. Review Cyberlinx's privacy policy or contact Cyberlinx for details about scan data handling.

Meet Cactus. The free scanner that shows you what attackers see.

Enter a domain. In minutes, Cactus maps your external attack surface, checks for common web exposures, and hands you a high-level security overview you can act on. No signup. No credit card. No obligation.

Launch Cactus

How It Works

CyberLink Cactus scan shows 37 assets, 11 findings including vulnerabilities and email security risk, medium risk level.

A high-level security  snapshot. In minutes.

Cactus is built by our offensive security team for organizations who want a fast and honest read on where their web assets stand.

Black magnifying glass icon on a rounded white square with light blue background.

Attack Surface Discovery

Subdomain enumeration, DNS records, live hosts, exposed services and stale assets, all mapped from a single root domain.

Icon of an ID card with a ribbon badge on a rounded square background.

TLS & Certificate Health

Expiry, chain issues, weak ciphers, self-signed leaf certs and misconfigured SANs across every live host it finds.

Icon of a pencil drawing a horizontal line on a rounded square background.

Security Headers

CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, graded and explained.

Black envelope icon on a white rounded square background.

Email Auth Posture

SPF, DKIM and DMARC records: is your domain spoofable? Cactus tells you, in plain English, with a copy-pasteable fix.

Black fingerprint icon on a white rounded square background with light blue gradient.

Tech Fingerprint & Known CVEs

Identify web stacks (nginx, Apache, Express, WordPress, Cloudflare, etc.) and flag known, publicly-disclosed CVEs against detected versions.

Icon of a document with a bar chart inside, on a square background with rounded corners.

Shareable Report

Get a clean, shareable report with severity ranked findings. Take it to your dev team or the board.

What Cactus actually checks

No black boxes. Here's the checklist Cactus runs against your domain on every scan.

Three steps. About two minutes.

Cactus is browser-based. Nothing to install, nothing to configure.

Enter your domain

Type your root domain. Cactus handles the rest — subdomains, DNS, certs, headers, email auth, exposed endpoints.

Cactus scans

Purely passive + low-noise active checks. No brute-force, no exploit payloads. Safe to run on production.

Get your report

A severity rated summary. Hand it to your developers, your board or come talk to us for a deeper penetration test.

Frequently Asked Questions

Common questions about Cactus. If yours isn't here, email us at info@cyberlinx.com.au

Meet Cactus. The free scanner that shows you what attackers see.

A high-level security snapshot. In minutes.