What is actually running:
a checklist.

Attackers look for the system nobody listed. The checklist helps you find yours first, in about an afternoon, without our tools and without a call. It arrives by email once you confirm your address.

Ask for the checklist

Six things to look for

Each is a place where something runs that nobody listed, nobody updates or nobody chose to open. Together they make a first inventory you can keep.

Devices that run code and were never listed, such as building and production controls
Systems past the end of their support
Services listening on the network that nobody chose to open
Accounts nobody uses, and accounts with more access than the job needs
Connections that leave your network, and where they go
Changes nobody can explain

Read November’s letter before you sign up →

Work email

Also send me the monthly letter and occasional news from H2 Labs: what attackers used each month, one thing worth checking, and now and then a new checklist, tool or service of ours. Every email has a one-click unsubscribe.

First we email a link to confirm the address. The checklist arrives once you press Confirm on the page it opens; the letter and news start only if you tick the box.

H2 Labs keeps this address; Resend, in the United States, delivers our email. What we keep and for how long: privacy notice.

What happens to your address

Two emails and one press of a button. Nothing else arrives unless you ticked the box for the letter, and every letter carries a way out.

Fig. 1 Opening the link changes nothing. Only a press of the button confirms the address.

A link to confirm. First we send one email with a link. It works once, for 7 days. If you did not ask for it, ignore it: an address nobody confirms is deleted after 7 days.

A page with one button. The link opens a page, and opening it changes nothing. Many companies’ mail filters open every link to check it, so only your press of the button confirms the address.

Then the checklist. It arrives straight after you press. If you ticked the box, the monthly letter and occasional news start too; if not, the checklist is the last email from us.

A way out in every letter. Each letter ends with an unsubscribe link, and mail programs that show an unsubscribe button use it in one click. The checklist email carries the same link when the letter is on. Either way the letters stop and the address leaves our list.

Table 1 What we keep, and for how long.
What	Kept	Then
An address waiting to be confirmed	7 days after the request	Deleted, with everything recorded about it
An address that asked for the checklist only	30 days after confirming	Deleted, with everything recorded about it
An address on the letter and news	Until you unsubscribe	Deleted at once
The record of your consent to the letter and news: when, which words, from which network address	3 years after you unsubscribe	Kept with a code in place of the address, then deleted
Network addresses, for the limit on sign-ups	1 hour	Deleted within 10 minutes

Who delivers the email. Resend sends our email for us and keeps its own records of each message in the United States. The privacy notice says what that covers, and how to use your rights.

Start with a free inventory

Most of the work starts with knowing what runs. We read it from your systems with your permission, then give you a 45-minute readout with one real finding and a straight answer on whether you need us.

Get a free inventory How we start

FreeInventory. What runs on your systems and what is exposed, read on the dates you agree. You keep the results.
€9,500Assessment. Priorities, risks, a plan and a quote, for a fixed fee, excluding VAT, credited against the work that follows.
MonthlyOngoing protection. From €2,400 a month: we apply your updates, watch your systems, record every action and send a short report each month. The three plans.