# S4E — Security For Everyone

> S4E is a cybersecurity platform offering 11,000+ free vulnerability scanning tools, CVE-specific scanners, automated security playbooks, real-time threat alerts (Spark), and an enterprise CTEM platform. Most tools require no account.

## Quick facts

- 11,000+ security micro-services and scanners run by the platform
- ~4,900 of those have a public tool page on s4e.io; the rest run only inside a scan
- 40,000+ users worldwide
- 50M+ scans completed
- 190+ countries reached
- 20,000+ security professionals
- 300,000+ verified assets
- 22 fully free scanners (no account required)
- CVE-level precision — many tools map to specific CVE identifiers
- Export results as PDF, CSV, HTML, or video
- Supports domains, subdomains, and IPv4 addresses

## Free Security Tools

The tools directory at [s4e.io/tools](https://s4e.io/tools) lists all available free scanners.
Each tool has a dedicated detail page with description, technical explanation, solution advice, and a scan form.

Categories (each has its own landing page):
- [Web Vulnerabilities](https://s4e.io/tools/category/web-vulnerabilities) — SQL injection, XSS, LFI/RFI, SSRF, SSTI, command injection, path traversal
- [Network Vulnerabilities](https://s4e.io/tools/category/network-vulnerabilities) — Exposed services, weak protocols, network-layer CVEs
- [Misconfiguration](https://s4e.io/tools/category/misconfiguration) — Default credentials, open admin interfaces, permissive CORS
- [Information Scans](https://s4e.io/tools/category/information-scans) — Subdomain discovery, URL fuzzing, technology fingerprinting, WHOIS
- [Exposed Panels](https://s4e.io/tools/category/exposed-panels) — Publicly reachable admin, login, and management interfaces
- [Product CVEs (Web)](https://s4e.io/tools/category/product-based-web-vulnerabilities) — CVE checks for WordPress plugins, CMS platforms, web frameworks
- [Product CVEs (Network)](https://s4e.io/tools/category/product-based-network-vulnerabilities) — CVE checks for VPNs, firewalls, routers, server software
- [DNS Controls](https://s4e.io/tools/category/dns-controls) — SPF, DKIM, DMARC, DNSSEC, zone transfer, subdomain takeover
- [SSL Controls](https://s4e.io/tools/category/ssl-controls) — Certificates, cipher suites, protocol versions, POODLE/BEAST/Sweet32

CVE-specific scanners exist for Apache Log4j, Spring, VMware, Ivanti, Fortinet, SAP,
WordPress plugins and hundreds more. Their slugs are descriptive, not CVE-shaped —
look them up in the directory instead of guessing a `cve-YYYY-NNNNN-scanner` URL.

## Platform Features

- [Opservant Agent](https://s4e.io/platform) — AI-powered continuous threat exposure management (CTEM)
- [Spark Alerts](https://s4e.io/platform#spark) — Real-time vulnerability notifications via Email and Slack (<60s detection)
- [Security Playbooks](https://s4e.io/platform#playbooks) — Automated multi-step scan chains (PCI-DSS, ISO 27001, pentest, recon)
- [Chrome Extension](https://chromewebstore.google.com/detail/s4e-continuous-threat-exp/poklckfkkeebomnafifkjddabdapipkb) — Live vulnerability reports on every site you browse

## Key pages

- [Home](https://s4e.io/) — Overview, free scan, stats
- [Free Tools Directory](https://s4e.io/tools) — Full searchable list of all scanners
- [Platform](https://s4e.io/platform) — Enterprise CTEM platform details
- [Plans & Pricing](https://s4e.io/plans) — Plans: Everyone (free), Pro, Enterprise
- [AI in S4E](https://s4e.io/ai) — How AI powers the platform

## Individual tool pages

Every tool is accessible at: `https://s4e.io/tools/{tool-slug}`

Slugs are descriptive, not CVE-shaped, and cannot be guessed. Use these verified
entry points, or [search the directory](https://s4e.io/tools/search) for anything else:

- [Free URL Fuzzer Online](https://s4e.io/tools/url-fuzzer-online)
- [SQL Injection Vulnerability Scanner](https://s4e.io/tools/sql-injection-vulnerability-scanner)
- [XSS Scanner](https://s4e.io/tools/free-and-online-xss-scanner)
- [Subdomain Finder Online](https://s4e.io/tools/find-subdomains)
- [SSRF Vulnerability Scanner](https://s4e.io/tools/online-ssrf-vulnerability-scanner)
- [LFI / RFI Vulnerability Scanner](https://s4e.io/tools/online-file-inclusion-lfi-rfi-vulnerability-scanner)
- [Command Injection Scanner](https://s4e.io/tools/command-injection-vulnerability-scanner)
- [SSL/TLS Supported Cipher Checker](https://s4e.io/tools/check-ssl-supported-cipher)
- [WAF Detection Scanner](https://s4e.io/tools/waf-detection-scanner)
- [Technology Detection Scanner](https://s4e.io/tools/fingerprinthub-technology-detection-scanner)
- [PCI-DSS 6.4.3 Compliance Checker](https://s4e.io/tools/pci-dss-6-4-3-compliance-checker)

## Severity levels

- **Critical** — Immediate exploitation risk, unauthenticated RCE, auth bypass
- **High** — Significant risk, exploitable with low effort
- **Medium** — Exploitable under certain conditions
- **Low** — Limited impact, informational
- **Info** — Configuration or reconnaissance data, no direct exploit

## Access model

- **For Everyone** — Scans anyone can run on any domain (recon, CVE checks)
- **Asset Owners** — Scans requiring proof of domain ownership (vuln scanners, auth tests)

## Contact and company

- Website: https://s4e.io
- Company: S4E Ltd
- Mission: Security for everyone — making enterprise-grade security tools accessible to all