A Bristol design agency scanned twelve active client sites in one afternoon and turned eight of them into follow-up engagements.

What made them run a scan

A retainer client received a phishing email impersonating the agency itself. No financial loss, but the founder wanted to know which of the agency's other client sites were similarly impersonatable, before any of them became the next target.

What Vantyris found

1. 01

   Four of twelve client domains had no DMARC record

   high

   Any sender on the public internet could spoof email from those four client domains to their customers without authentication failure being acted on.

2. 02

   Two of twelve client sites had a WordPress admin reachable on a non-standard port

   high

   Both were development environments mistakenly left in production. One had a default admin username.

3. 03

   Seven of twelve client sites had at least one missing security header

   medium

   Most commonly Content-Security-Policy or X-Frame-Options. None of the client sites returned the full set of four recommended headers.

4. 04

   One client site offered a deprecated TLS cipher

   low

   The cipher in question is not currently exploitable against modern clients but flagged by SSL Labs and OWASP guidance.

5. 05

   Eleven of twelve client sites passed the TLS baseline

   healthy

   TLS 1.2 or 1.3 was enabled with modern cipher suites on every site bar one. The remaining one was on a legacy host.

What they fixed and how

The agency ran twelve verified scans in a single afternoon (one medium credit pack plus change). Each client received a branded PDF report with prioritised actions. Eight clients booked follow-up engineering work; three self-fixed using the report; one chose to defer. The total cost of credits was about EUR 60. The eight follow-up engagements paid for the agency's annual Vantyris credit budget several times over within the first week.

What's next

The agency now runs every client on a quarterly cadence and includes a free baseline Vantyris scan with every new client onboarding. The pattern has become an active sales asset, not just a security one.