# bigWUF

> bigWUF is a self-service, outside-in security check for small and medium businesses in Europe. It shows what an attacker or an attacker's AI agent can see about a company from the internet, explains each finding as cause and effect in plain language, and says what to fix first, who should do it and how long it takes. It never logs in, never tries passwords and never changes anything.

## Key pages
- [What bigWUF checks](https://bigwuf.aiexperiments.eu/checks): every check, what it looks at, why it matters, what access it needs
- [Plans and prices](https://bigwuf.aiexperiments.eu/pricing)
- [Security and data location](https://bigwuf.aiexperiments.eu/security): hosted at Hetzner in Germany (EU)
- [How bigWUF scans](https://bigwuf.aiexperiments.eu/acceptable-use)
- [Privacy](https://bigwuf.aiexperiments.eu/privacy) and [DPA](https://bigwuf.aiexperiments.eu/dpa)

## Plans
- Basket (free): Free. Your results, checked when you ask. 1 domain(s), 1 suppliers, 1 tripwires, checks on demand.
- Path (EUR 19/month): One business, watched every week. 1 domain(s), 5 suppliers, 3 tripwires, re-checked weekly.
- Cottage (EUR 49/month): Shops, offices and several domains, watched every day. 3 domain(s), 20 suppliers, 10 tripwires, re-checked daily.
- Huntsman (EUR 129/month): For IT providers who look after other businesses. 25 domain(s), 100 suppliers, 50 tripwires, re-checked daily.

## Checks
- Everything of yours that's on the internet: Subdomains; Your servers and where they are; Open services; Devices and building systems; Old and hidden; Subdomain takeover; Exposed files and panels
- Known holes, ranked by real danger: Vulnerabilities in your software; Actively exploited holes; Risk level and fix; Website, certificate and encryption
- Email and impersonation: Email protection (SPF, DKIM, DMARC); Mail server encryption; Lookalike domains; Brand impersonation watch; Clone alarm (tripwire)
- People and leaks: Leaked staff accounts; Email addresses on your website
- Signs you're already being used: Botnet command servers; Hijacked networks; Blocklists; Attack map
- Your suppliers: Supplier checks; Impersonation level; Message to send them
- Tripwires: Secret link; Word document; Decoy login; Clone alarm
- Early warning: Scheduled re-checks; What changed; Alert emails and the Monday summary

## Questions
### What is bigWUF?
bigWUF is a self-service security check for small and medium businesses in Europe. It looks at your company from the outside, the way a scammer or an attacker's AI agent would: your email protection, websites, servers, open services, forgotten systems, lookalike domains, leaked staff accounts, and the fridges, cameras and building controls on your shops' and offices' internet lines. Every finding is explained as cause and effect, with the fix, who should do it and how long it takes.

### How is bigWUF different from a vulnerability scanner?
A scanner gives a technical list. bigWUF first builds the list of everything you have on the internet (including things you forgot), ranks problems by whether criminals are using them right now (CISA's list of exploited flaws and EPSS), and explains each one in plain language to the owner or office manager. It also watches your suppliers, gives you tripwires that catch intruders, and has an assistant, LittleRed, that sorts the fixes into today, this week and later.

### Does bigWUF touch or break into my systems?
No. It only reads public information and asks your servers the questions any visitor could. It never logs in, never tries passwords and never changes anything. Deeper checks, like asking for a short list of sensitive file paths, only run after you prove the domain is yours with a DNS record or a file.

### What does the free plan include?
Basket, the free plan, checks one domain when you ask, shows every finding with its fix, includes one supplier check, one tripwire and five questions a day to LittleRed. Paid plans re-check automatically, email you when something serious appears, and cover your shops and offices.

### How much does bigWUF cost?
Basket is free. Path is €19 a month for one business watched every week. Cottage is €49 a month for shops, offices and several domains watched every day. Huntsman is €129 a month for IT providers who look after other businesses. New workspaces get 7 days of Cottage with no card.

### Can bigWUF find the fridges, cameras and building systems at my shops?
Yes. Add each shop's or office's internet address and bigWUF checks what answers on it: refrigeration and cold-room controllers, heating and lighting systems (KNX, BACnet, Modbus), cameras and recorders, routers and printers. In October 2026 attackers pushed freezers in hundreds of French supermarkets to 50°C through exactly these controllers.

### What are tripwires, or canary tokens?
Bait that nobody at your company ever touches: a secret link in a file called 'VPN passwords.txt', a Word document called 'Salaries 2026.docx', a decoy staff login with a planted password, or an invisible image that tells you when your login page is copied onto a phishing site. If any of them is touched, bigWUF emails you with when and from where. Nothing is installed on your computers.

### How does bigWUF check my suppliers?
Add the companies you pay. bigWUF runs the public checks on each one every week and tells you how easy it is to send email pretending to be them (easy, possible or hard), their grade and top issues, and writes a polite message asking them to fix it. Fake invoices sent in a supplier's name are one of the costliest frauds against small businesses.

### Where is my data stored, and is bigWUF GDPR compliant?
On bigWUF's own servers at Hetzner in Germany, in the EU. bigWUF offers a data processing agreement under Article 28 GDPR, lists every subprocessor with its location, never sells data and never uses your data to train AI models.

### Who is bigWUF for?
Owners and office managers of small businesses (shops, restaurants, clinics, offices, small manufacturers), and the IT providers who look after them. You don't need a security team or technical knowledge.