See your business the way a scammer does.

bigWUF is a self-service, outside-in security check for small businesses in Europe. Type your domain and it shows what an attacker, or an attacker's AI agent, can see about you, what it means, and what to fix first.

What bigWUF finds

  • Email impersonation: whether anyone can send email from your address (SPF, DKIM, DMARC), and lookalike domains being prepared for fake invoices.
  • Everything you have on the internet, including forgotten servers, old test sites and shadow IT.
  • Open doors: remote desktop, databases and admin panels reachable from the internet.
  • Known holes ranked by real danger, using CISA's list of exploited vulnerabilities and EPSS, with CVE and CWE references.
  • Fridges, cold rooms, heating, lighting, cameras and machine controllers on your shops' and offices' internet lines.
  • Staff accounts in data breaches, and signs your servers are on botnet or hijacked-network lists.

Attackers have AI agents now

The slow part of hacking is now done by AI agents that go through thousands of businesses a night. Anthropic reported in November 2025 that an AI agent did 80 to 90% of the hands-on work in an espionage campaign. Being small no longer protects you.

Your suppliers

Add the companies you pay. bigWUF checks each one weekly and tells you which ones anyone can impersonate, the commonest route for fake-invoice fraud, and writes the message asking them to fix it.

Tripwires (canary tokens)

Bait files, secret links, decoy logins and a clone alarm for your login page. Nobody legitimate touches them, so any touch means an intruder, and bigWUF emails you when and from where. Nothing to install.

LittleRed, the assistant

Reads your results and only yours, sorts fixes into today, this week and later, names who should do each one and writes the message to send them.

Plans

  • Basket, free: Your score, what's wrong in each area, and your email protection in full. 1 domain, checked when you ask, 0 shop or office lines, 1 suppliers watched, 1 tripwires, 5 questions a day to LittleRed.
  • Path, €29 a month (€24 a month billed yearly): One business: everything bigWUF finds, watched every week. 1 domain, re-checked every week, 1 shop or office lines, 5 suppliers watched, 3 tripwires, 60 questions a day to LittleRed.
  • Cottage, €59 a month (€49 a month billed yearly): Shops, offices and several domains, watched every day. 3 domains, re-checked every day, 10 shop or office lines, 20 suppliers watched, 10 tripwires, 150 questions a day to LittleRed.
  • Huntsman, €129 a month (€107 a month billed yearly): For IT providers who look after other businesses. 25 domains, re-checked every day, 100 shop or office lines, 100 suppliers watched, 50 tripwires, 300 questions a day to LittleRed.

Questions owners ask

What is bigWUF?

bigWUF is a self-service security check for small and medium businesses in Europe. It looks at your company from the outside, the way a scammer or an attacker's AI agent would: your email protection, websites, servers, open services, forgotten systems, lookalike domains, leaked staff accounts, and the fridges, cameras and building controls on your shops' and offices' internet lines. Every finding is explained as cause and effect, with the fix, who should do it and how long it takes.

How is bigWUF different from a vulnerability scanner?

A scanner gives a technical list. bigWUF first builds the list of everything you have on the internet (including things you forgot), ranks problems by whether criminals are using them right now (CISA's list of exploited flaws and EPSS), and explains each one in plain language to the owner or office manager. It also watches your suppliers, gives you tripwires that catch intruders, and has an assistant, LittleRed, that sorts the fixes into today, this week and later.

Does bigWUF touch or break into my systems?

No. It only reads public information and asks your servers the questions any visitor could. It never logs in, never tries passwords and never changes anything. Deeper checks, like asking for a short list of sensitive file paths, only run after you prove the domain is yours with a DNS record or a file.

What does the free plan include?

Basket, the free plan, checks one domain when you ask and shows your security score out of 100, the score of each of the five areas, your email protection in full, and how many other problems were found and how serious they are. Critical problems are always named. Where each problem is and how to fix it are in the one-time report or a paid plan. Basket also includes one supplier check, one tripwire and five questions a day to LittleRed.

How much does bigWUF cost?

The check and the score are free. The full report for one domain is €39 once, with no subscription. Path is €29 a month for one business watched every week. Cottage is €59 a month for shops, offices and several domains watched every day. Huntsman is €129 a month for IT providers who look after other businesses. Yearly billing gives two months free.

Can bigWUF find the fridges, cameras and building systems at my shops?

Yes. Add each shop's or office's internet address and bigWUF checks what answers on it: refrigeration and cold-room controllers, heating and lighting systems (KNX, BACnet, Modbus), cameras and recorders, routers and printers. In October 2026 attackers pushed freezers in hundreds of French supermarkets to 50°C through exactly these controllers.

What are tripwires, or canary tokens?

Bait that nobody at your company ever touches: a secret link in a file called 'VPN passwords.txt', a Word document called 'Salaries 2026.docx', a decoy staff login with a planted password, or an invisible image that tells you when your login page is copied onto a phishing site. If any of them is touched, bigWUF emails you with when and from where. Nothing is installed on your computers.

How does bigWUF check my suppliers?

Add the companies you pay. bigWUF runs the public checks on each one every week and tells you how easy it is to send email pretending to be them (easy, possible or hard), their grade and top issues, and writes a polite message asking them to fix it. Fake invoices sent in a supplier's name are one of the costliest frauds against small businesses.

Where is my data stored, and is bigWUF GDPR compliant?

On bigWUF's own servers at Hetzner in Germany, in the EU. bigWUF offers a data processing agreement under Article 28 GDPR, lists every subprocessor with its location, never sells data and never uses your data to train AI models.

Who is bigWUF for?

Owners and office managers of small businesses (shops, restaurants, clinics, offices, small manufacturers), and the IT providers who look after them. You don't need a security team or technical knowledge.