Security check-up for small businesses · early access
Most small businesses have a few glaring security gaps and nobody whose job it is to spot them. Tenken's AI checks the five that do the most damage and tells you, in plain English, exactly what to fix first.
No domain handy? Take the 2-minute self-check →
Email spoofing, exposed admin logins, reused staff passwords, out-of-date website plugins and missing backups.
Every finding says what could go wrong for your business and how long the fix takes. The top three come first.
Step-by-step instructions for your actual setup, like Google Workspace, Microsoft 365 or WordPress, or hand them to your web person. Then re-check to see it go green.
“I get phishing emails often where it will be from my own email”
“This is really scary it feels like someone is on my domain just messing around with my business”
A small-business owner on Reddit, r/sysadmin, 2026 (“Phishing emails coming from me?”).4
These are the doors that get left open when no one has security in their job title.
Without SPF, DKIM and DMARC set up properly, anyone can send email that looks like it came from you@yourbusiness.com, fake invoices to your customers included.
We check: your domain's public email-security records, and whether they actually tell receivers to block fakes.
Website dashboards, router and camera logins, remote-desktop and VPN pages that anyone on the internet can find and start guessing passwords on.
We check: only the domains, website and IP addresses you list and authorize in writing. Nothing else.
One staff password leaked in someone else's breach, reused on work email, is often all it takes.
We check: whether your verified domain's addresses show up in public breach lists and whether 2-step login is on. We never ask for or see a password.
Old WordPress plugins and themes with publicly known holes. Attackers use automated tools that hunt for them.
We check: the software versions your website shows publicly, against public vulnerability lists.
With a good backup, ransomware or a deleted folder costs you a bad day. Without one, it can cost you the business.
We check: a guided 5-minute review of where your backups live, whether they're kept separate and when you last tested a restore.
[MEDIUM] DMARC p=none; no enforcement
[HIGH] CVE-20XX-XXXXX bookly < 23.4
[INFO] 3389/tcp open ms-wbt-server
[LOW] SPF ~all softfail mechanism
[INFO] TLSv1.0 enabled on :443
… 41 more findingsIllustrative example, not a real customer.
Ten yes-or-no questions about the things no scanner can see. Answer honestly. Only you see your answers until you ask for the full report.
Pick the plan you'd choose. We're onboarding early users in waves, and we'll email you when your spot is ready. Nothing is charged today.
Book 15 minutes with us. We'll ask what you run, tell you honestly whether Tenken fits, and point you to free fixes if it doesn't.
Not yet. We're onboarding early users in waves and will email you when your spot is ready. The free email check and the self-check on this page work today.
Only with your written permission, and only the domains, website and IP addresses you list. The free check on this page doesn't scan anything: it reads the same public DNS records every mail server reads when your email arrives.
No. Every finding is written in plain English with a time estimate and step-by-step instructions. If you have a web person or IT provider, you can forward the report to them.
In every step. The AI runs the checks, reads the raw results, writes them up in plain English ranked by the risk to your business, and re-checks on schedule. There are no manual steps, which is how we keep the price this low.
No. It's a regular check-up that finds the obvious gaps and tells you how to close them. It works alongside whatever you already have.
They're three public settings on your domain that tell other mail servers which senders are really you, and what to do with fakes. Run the free check above and the report explains yours line by line.