Early warning for internet-facing systems
Know within hours when attackers start exploiting something you run.
Hejnal finds your internet-facing systems, recognises the software on them and checks it against the flaws attackers are exploiting right now. You get a short, ranked fix list instead of a 300-page scan report.
Free and open source (Apache-2.0). Hosted and managed plans for teams.
Example output for a made-up company.
How it works
One ordinary visit per system, three questions answered
Hejnal sends what any visitor sends. It never logs in, never tries an exploit, and only checks systems you have authorised in writing.
Find what you expose
Your domains, subdomains from public certificate logs, your IP ranges and the ports that answer.
Recognise the software
279 products, from VPN gateways and firewalls to routers, cameras, mail servers, CMSs and developer tools, read from web pages and service greetings.
Match what attackers exploit
CISA's catalog of exploited flaws, version ranges from NVD and exploit likelihood from FIRST, ranked into a weekly fix list and alerts within hours.
products recognised, each with a test sample of what it sends
of the 1,767 flaws in CISA's catalog of exploited vulnerabilities are covered
days: the median time to patch a flaw attackers already exploit (Verizon DBIR 2026)
Built to be trusted
Safe by design, traceable by default
Detection only
No exploits, no logins, no brute force. Optional checks only look for exposed files such as .env and .git.
Every finding has a source
Each item links to the catalog entry, the version check and the evidence Hejnal saw, so you can verify it yourself.
Written authorisation
Every scope file records who approved the scan and when. Hejnal refuses targets outside it.
Signed, open releases
Open-source code, signed builds and a list of every component, because security tools are targets too.
Plans
Run it yourself, or let us watch for you
Open source
FreeApache-2.0
- Command-line tool, REST API and MCP server
- Fix list, monthly report, NIS2 draft
- Slack, Teams and email alerts
Hosted
€99 / monthup to 250 internet-facing assets
- One dashboard across sites
- Alerts within hours of a new exploited flaw
- Sign-in controls, audit trail, report exports
Managed
from €490 / monthper organisation
- We apply fixes and check for break-ins
- We rotate exposed passwords and keys
- We draft your NIS2 incident reports
Partners
€29 / monthper client organisation
- For IT service firms
- Many clients in one installation
- Reports under your own brand
Early-access prices for the first customers. The open-source core stays free.
NIS2 in Poland
The deadlines are set. Exposure is the easiest place to start.
The amended KSC act makes covered organisations, and the suppliers they rely on, show they manage known risks. Hejnal gives you the evidence: what was exposed, when you knew, and when it was fixed.
- Amended KSC act in force
- Security measures must be in place
- First audits for essential entities; fines up to €10 million or 2% of turnover
Kraków's trumpeter warned the city when he saw raiders coming. Hejnal does the same for your systems: it sounds as soon as attackers start using a flaw in something you run.
Tobias, founder · Warsaw
Join early access
We are taking three design partners: a free managed service for three months in exchange for weekly feedback.
hejnal@legatia.solutions