Cidvise
Cidvise · Continuous exposure management

Attackers already know
where you are vulnerable
Do you?

cidguard, the Cidvise platform, scans your assets the way an attacker sees them, computes an auditable risk score and shows exactly where to act, before someone exploits it.

Scan for free

Free diagnostic, no signup. Results on screen in seconds. See plans →

cidguard
PRO
EA
Dashboard
67
-4%
Total Org Risk
(0–100)
2
2 ativos afetados
CISA KEV ·
exploradas ativamente
You
Incident Risk
CTEM Pipeline
Continuous Threat Exposure Management · estado atual em 5 fases
01
Scoping
Superfície de ataque
ATIVOS
3/25
COBERTURA
12%
02
Discovery
Achados e ameaças
ABERTOS
26
CRIT/HIGH
3/7
03
Prioritization
Score e classificação
RISK SCORE
67
URGÊNCIA
3C · 7H
04
Validation
Exposição potencial
BLAST MÉD.
58
MAIS EXPOSTO
acme.com
05
Mobilization
Remediação e progresso
REMEDIAÇÃO
42%
CORRIGIDAS
8
Exposure Benchmark
General Industry · Verizon DBIR 2025
58Sector67Jan 15Feb 20Mar 27May 1
Now
67
Sector Ref
58
Your Median
71
Open Vulnerabilities
By Severity
26
Critical
3
High
7
Medium
12
Low
4
Security Pillars
Achados por pilar · clique para detalhar
C
26Records
3Crit
7High
12Medi
4Low
Security Pillars
Peso efetivo
Application Security
C
Network Resilience
B
Identity & Trust
A
Compromised Systems
D
Mean Time to Remediate
Dias médios por severidade · vs. benchmark
Critical
22dias
benchmark: 15d +7d acima
High
28dias
benchmark: 30d 2d abaixo
Medium
55dias
benchmark: 90d 35d abaixo
Low
120dias
benchmark: 180d 60d abaixo
Fora do Prazo (Abertas)
Critical
3 vulns
avg 22d

Teams already measuring their exposure with Cidvise

Logo fairjob, cliente da CidviseLogo fairhealth, cliente da CidviseLogo fairedu, cliente da Cidvise
The problem

Your attack surface
changes every week. Who is watching?

A new subdomain, an expiring certificate, an outdated library, a CVE published yesterday. Every change can open a door, and nobody warns you when it happens.

01 / 03

A yearly assessment describes a single day

Between one audit and the next, new services go live, certificates expire and libraries fall out of date. Each change alters what is exposed, and none of it is recorded until the following assessment.

Point-in-time assessment
02 / 03

Anything exposed is found within hours

Automated tools sweep the entire internet and catalog services, subdomains and vulnerable versions. A new asset enters those catalogs the same day it becomes reachable, whether or not the company knows about it.

Continuous reconnaissance
03 / 03

When a flaw is discovered determines what it costs

An exposure found during routine work is a fix with a deadline. The same exposure found during an incident, an audit or a due diligence brings notification duties, contracts and reputation into play.

Cost of discovery
Who we are

Cidvise is a Brazilian security company with a simple thesis: you cannot protect what you cannot see

We built cidguard so any company can see its own exposure the way an attacker sees it, continuously, and turn that view into fixes, evidence and peace of mind.

Who it is for

For those who need answers, not another dashboard

Companies that need clear answers about their own security, with or without a dedicated team.

  • IT teams that also carry the security function
  • Companies under pressure from clients and audits
  • Teams that already exist and want continuous coverage
What we do

We watch your exposure the way an attacker sees it

External, continuous monitoring of your digital exposure, with an auditable score and evidence ready for board, clients and auditors.

  • Continuous discovery and watch over exposed assets
  • An auditable risk score, updated every cycle
  • Findings tied to LGPD and ISO 27001 controls
What we believe

Security that explains itself is security you can trust

No black box and no vanity seal: we show what we found, how we score it, and also what we do not cover.

  • Every finding comes with evidence and a path to fix it
  • The score calculation is open and can be audited
  • We say what we do not do: no pentest, no seal
How it works

Domains, findings and evidence,
in one dashboard

01 · Discovery

You give us one domain. We find the rest.

Starting from the root domain, we map subdomains, applications, APIs and mail services exposed on the internet.

Coverage

Know first

Your attack surface scanned and monitored, with nothing to install.

Four fronts cover everything your company exposes to the internet. The whole reach in one place, reassessed every cycle.

01

Application

What your software exposes to the world.

Everything published and reachable without a login, followed through every new production release.

02

Network

The infrastructure that keeps the operation running.

The services and connections facing the internet, seen the way an attacker sees them.

03

Identity

Whether someone can pose as your company.

The ability of third parties to send email, speak or present themselves on behalf of your domain.

04

Threats

Signs that you are already being targeted.

Indications that an asset has been compromised or is being targeted right now, even with no change on your side.

35 daysper full cycle
4 frontsone single surface
0 agentsnothing to install
Score

One number that says
more than a thousand reports

The score is made up of the active findings in each pillar and can be broken down to the item that originated it. This makes it possible to track progress between cycles and to stand behind the number in front of auditors, the board or a customer.

Org Risk Score
67
C
-4% vs. last month0 to 100 · A to D
Application Security

What your software exposes to the internet.

We cover security at the application level. This includes everything your software makes publicly available on the internet and that can be reached without authentication, which is the most exposed part of the surface and the most common origin of incidents.

Coverage is continuous. Every new version in production is reassessed, and the pillar records what appeared, what was fixed and what came back.

C
80/100
Grade C
ABCD
Continuous monitoring

cidguard works
while you sleep

Security is not an event, it’s a continuous process. While your team focuses on the product, cidguard monitors, detects and alerts.

Monitoring now
9:41
cidguardnow

Critical vulnerability detected

CVE-2024-3094 · wordpress/6.4 · immediate action recommended.

Proactive alerts available on Pro and Enterprise plans.

CVE Monitor

New CVEs cross-checked with your stack every day

cidguard cross-checks your detected stack against the OSV database daily. If a new CVE affects your environment, you’ll be notified.

Proactive Alerts

Automatic email when something critical appears

Critical and high findings arrive by email, consolidated per asset. Log in to the platform for description, severity and a suggested fix.

Monthly Report

Executive PDF delivered on the 1st of each month

Score, per-pillar evolution, top vulnerabilities and remediation status generated and sent automatically to your team. Ready to share with the board or auditors.

Compliance

From Risk to
Compliance Posture


We surface vulnerabilities that impact LGPD/Privacy and ISO/IEC 27001 compliance.

Knowing you have an XSS isn’t enough. You need to know it violates Art. 46 of the LGPD — with technical evidence ready for your data protection officer.

Technical coverage detected externally by cidguard · does not replace a formal certification audit.

LGPD

Lei 13.709/2018

Action required4 of 5 controls assessed
Art. 46Processing Security
Action required
Art. 6 VIIPrevention
Attention
Art. 47Agent Accountability
Attention
Art. 49Security by Design
No findings
Art. 37Records of Processing
Not assessed
ISO 27001

ISO/IEC 27001:2022

Action required4 of 5 controls assessed
A.8.8Vulnerability Management
Action required
A.8.12Data Leakage Prevention
Attention
A.8.20Network Security
Attention
A.8.28Secure Coding
No findings
A.5.1Security Policies
Not assessed

Auditable report generated automatically

PDF with the per-control LGPD + ISO posture, the findings impacting each one, and a content fingerprint (SHA-256) for integrity verification — ready to support audits and conversations with clients, board and your data protection officer. Available on Pro and Enterprise plans.

Real-time diagnostic

Do not take our word for it.
Run it on your domain

The platform scanners sweep your host right now: encryption, headers and the setup that decides whether anyone can send email on behalf of your company.

Accepts a domain or subdomain, such as app.yourcompany.com. Each address is scanned separately.

No signupResults in ~40 secondsPassive external scan
or check one vector at a time
TLS postureHTTP headersEmail security
Pricing
Plans

Simple pricing,
no surprises

A single security incident can cost far more than a year of monitoring. Starter is R$ 890/month.

Starter
For teams that want initial visibility into their digital exposure.
R$ 890
per month · 25 assets
Get started
  • 25 monitored assets · 3 users
  • All scanners included
  • Auditable risk score with 30-day history
  • Compare every rescan: what improved, what got worse
  • Visual dashboard + reports
  • Email support
Most popular
Professional
For teams that need traceability and daily proactive alerts.
R$ 3.190
per month · 50 assets
Get started
  • 50 monitored assets · 5 users
  • 90-day history to show progress
  • Evolution per pillar (LGPD/ISO) and per asset
  • Same-day alert when a new CVE affects you
  • Auditable compliance PDF report
  • Priority email support
Enterprise
For organizations with a complex attack surface and regulatory requirements.
R$ 6.190
per month · 150+ assets
Get started
  • 150+ assets · 25 users
  • 1-year history for audits and QBRs
  • Full view per pillar and per asset
  • Executive monthly report in your inbox
  • Onboarding with a dedicated CSM
  • Quarterly QBR with a specialist
FAQ

Frequently asked questions

Still have a question? We gathered the main ones here.

A pentest describes your exposure on the day it was done. But your surface changes every week: a new subdomain, an expiring certificate, an outdated library, a CVE published yesterday. cidguard scans your assets continuously, from the viewpoint of whoever tries to break in, and alerts you when something changes. You stop discovering problems in an audit and start fixing them first.

No. cidguard looks at your assets from the outside, exactly as an attacker sees them, with nothing to install, no VPN, no credentials in your network. You just confirm the domain is yours (a DNS TXT record) and the analysis begins. Your IT team does not need to do anything else.

No, and we insist on being honest about it: manual pentests and formal audits play a role no tool automates. cidguard covers the gap between them, the continuous monitoring of what is exposed, and gets you to those moments far more prepared, with the homework done and the evidence in hand.

Every scan produces a 0 to 100 score with an A to D grade, broken down by pillar (application, network, identity, threats). It is not a magic number: it is auditable, you see exactly which findings make it up and how it evolves each cycle. It is the number the board understands and the engineer can defend.

We help you see where your technical vulnerabilities impact LGPD and ISO 27001 controls, with the evidence ready and an auditable PDF report (with an integrity fingerprint) to take to your data protection officer, your board or a client. It is the bridge between "we have an XSS" and "this affects Article 46 of the LGPD". It is not a compliance seal, it is the technical foundation that backs the conversation.

That is why the check runs daily: every day cidguard cross-checks the stack it detected on your assets against public CVE databases. If a new vulnerability starts affecting you, you find out. On the Pro and Enterprise plans, with a proactive email alert the same day, prioritized by real impact.

Yes, and for a security company that is non-negotiable. Each customer is isolated (multi-tenant), access is protected by strong authentication with MFA, everything travels encrypted, and downloading sensitive reports requires a verified domain. We treat your exposure data with the same care we ask you to have with yours.

It starts at R$ 890/month (Starter plan), with no setup fee and no lock-in. It is month to month, you adjust or cancel whenever you want. Compared to the cost of a single incident, it is cheap insurance. You sign up yourself in minutes, right on the site.

Start today

See your risk score
in minutes

Real visibility into what your company exposes on the internet right now.

Get started See plans →