Client Posture
White-label security scans and proposals for MSPs.
A startup from Brandon, the United States.
White-label security scans and proposals for MSPs.
A startup from Brandon, the United States.
This page is designed to help you find out whether Client Posture is good and if it is the right choice for you.
Client Posture is a white-label security assessment tool for managed service providers. Enter any client or prospect domain and get a grade with plain-English findings from 17 passive checks: SPF, DKIM, DMARC, MTA-STS, TLS reporting, email platform detection and email filtering; TLS certificate, HTTPS redirect, security headers and software banners; DNSSEC, CAA and domain expiry; plus hostnames in public certificate logs.
Scans are passive by design. They read DNS, certificate transparency logs, domain registration (RDAP) data and one normal homepage request. There are no port scans, login attempts or vulnerability probes, so you can run it on a prospect before they sign. Nothing is installed on the client's side.
Send prospects a Security Brief under your logo: what's working, what's not, a "how we'd fix it" plan, and a projected grade when fixes would raise it. You get an alert when they open it. On Pro, findings map to a 48-service Service Library and become a Good / Better / Best proposal the client accepts online. Client Posture shows your own payment link and never takes the client's payment.
Also included: a 14-question cyber insurance readiness questionnaire with scan auto-fill (all plans). On Pro and Founding Partner: weekly rescans and change alerts, a 14-template Policy library mapped to CIS Controls v8 and NIST CSF 2.0, the Grow prospecting pipeline, HubSpot and HaloPSA integrations, signed webhooks, a REST API, and an MCP server for AI assistants (Founding Partner has no quote drafts).
It is a point-in-time passive external posture check. It is not a penetration test, a vulnerability scan or a compliance certification.
Listed in
Passive checks
17 passive checks: Email (SPF, DKIM, DMARC, MTA-STS, TLS reporting, email platform detection, email filtering); Web (TLS certificate, HTTPS redirect, security headers, software banners); Domain (DNSSEC, CAA, expiry); plus certificate-log hostnames
Grade and findings
Letter grade with plain-English findings, evidence and fixes
Branded reports
Branded PDF reports and share links: your logo and no watermark on paid plans; Free reports are watermarked
Free public scan
Free public scan with no signup
CSV import and export
Bulk client import by CSV; findings export to CSV (all plans)
Team logins
Team invites with individual logins (all plans)
Security Briefs
A branded, plain-language page with what's working, gaps, a "how we'd fix it" plan, projected grade, booking link and an open alert. 2 a month on Starter, unlimited on Pro and Founding Partner.
Grow toolkit
Pro and Founding Partner: paste domains or a CSV and rank each one by dollar opportunity; self-updating pipeline (Brief sent, Viewed, Proposal, Assessment, Won); copy-only email and call scripts (Client Posture never sends them); 150 prospect scans a month
Good / Better / Best proposals
Pro: proposals from a 48-service Service Library with editable prices. The client accepts online, and you get the accepted PDF and CSV.
Weekly rescans and change alerts
Pro, Founding Partner
Progress and QBR client reports
Pro, Founding Partner; preview on Starter
Branded service menu
Branded PDF or share link (Pro; Founding Partner uses default services and prices). Overview on every plan.
Cyber insurance readiness questionnaire
14 carrier-aligned questions plus follow-ups, a no-login link, scan auto-fill, and answers labeled by source (all plans)
Insurance evidence pack
Pro, Founding Partner; preview on Starter
Compliance top 5
CIS / NIST / CMMC (Pro, Founding Partner; preview on Starter)
Policy library
14 templates (10 core and 4 AI) mapped to CIS Controls v8 and NIST CSF 2.0, exported as PDF or Word (Pro, Founding Partner)
HubSpot and HaloPSA
HubSpot (OAuth) and HaloPSA (one ticket per verified fail or warning; Unknown and Not tested are skipped) (Pro, Founding Partner)
Signed webhooks and REST API
Signed webhooks (HMAC-SHA256, no contact PII) and a REST API with scoped keys (Pro, Founding Partner)
MCP server
MCP server for AI assistants (Pro and Founding Partner; Founding Partner has no quote drafts)
It goes from a domain name to a signed proposal in one tool. The scan is passive by design: public DNS, certificate transparency, RDAP and one normal homepage request, with no port scans, logins or probes. You can run it on a prospect before they've agreed to anything, and nobody on their side installs or clicks anything. The findings become a branded Security Brief, and on Pro, a Good / Better / Best proposal built from a 48-service library that the client accepts online.
Choose it when you need a first look before there's a relationship. Prospect scans need no credentials, agent, link click or install on their side. It also turns findings into work you sell: projected grades, open alerts, proposals accepted online, rescans for QBRs and an insurance questionnaire. And the prices are public. Choose a different tool when you need internal network scanning, patching or a penetration test. Client Posture isn't any of those.
Managed service providers. That includes new MSPs and established MSPs adding a security line, who want a repeatable way to open security conversations with prospects and existing clients, and to win the fix and the monthly retainer.
Client Posture is a Next.js web app hosted on Vercel, with Supabase (Postgres with row-level security, authentication and storage), Stripe for billing and Resend for transactional email. Scans read public signals only: DNS-over-HTTPS, certificate transparency logs, RDAP registration data, TLS handshake metadata and one homepage request. AI assistants connect through Client Posture's MCP server using per-person API keys.
We have collected here some useful links to help you find out if Client Posture is good.
Check the traffic stats of Client Posture on SimilarWeb. The key metrics to look for are: monthly visits, average visit duration, pages per visit, and traffic by country. Moreoever, check the traffic sources. For example "Direct" traffic is a good sign.
Check the "Domain Rating" of Client Posture on Ahrefs. The domain rating is a measure of the strength of a website's backlink profile on a scale from 0 to 100. It shows the strength of Client Posture's backlink profile compared to the other websites. In most cases a domain rating of 60+ is considered good and 70+ is considered very good.
Check the "Domain Authority" of Client Posture on MOZ. A website's domain authority (DA) is a search engine ranking score that predicts how well a website will rank on search engine result pages (SERPs). It is based on a 100-point logarithmic scale, with higher scores corresponding to a greater likelihood of ranking. This is another useful metric to check if a website is good.
The latest comments about Client Posture on Reddit. This can help you find out how popualr the product is and what people think about it.
Do you know an article comparing Client Posture to other products?
Suggest a link to a post with product alternatives.
Is Client Posture good? This is an informative page that will help you find out. Moreover, you can review and discuss Client Posture here. The primary details have been verified within the last quarter. So they could be considered up to date. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.
