Example snapshot · Switchback Cyber
Free Exposure Snapshot for Example Law PLLC
| Prepared for | Example Law PLLC (fictitious) |
|---|---|
| Domain in this example | example.com |
| Example timestamp | 13 October 2026, 15:00 UTC. A real snapshot is dated when it is prepared. This date is illustrative. |
| Requested by | alex@example.com (placeholder) |
| How it was produced, in a real snapshot | Third-party passive sources, plus ordinary requests to the website and a TLS handshake. No login. No Microsoft 365 access. No internal network. |
| This page | Invented to show the format. example.com was not scanned to produce these rows. |
- This is a concise public-records note. It is not a vulnerability scan, a penetration test, or an audit.
- Public information is not evidence of compromise, a compliance failure, or an exploitable vulnerability.
- A name whose ownership is not confirmed is not treated as the firm's asset, and it is not used as a reason to contact anyone.
- The note describes what the sources showed at the timestamp. It does not describe Microsoft 365, file sharing, identity, or AI tools inside the tenant.
- There is no score and no vulnerability count.
1. DNS
Published names for the domain, and names that appear in certificate transparency. Unconfirmed names stay unconfirmed.
| Name | Example observation | How to read it |
|---|---|---|
| example.com | A record 203.0.113.10. That address is from the documentation range in RFC 5737. It is not a firm's server. | Placeholder only. |
| www.example.com | CNAME to example.com. | In this example, the www name points at the same site. |
| mail.example.com | Listed in this example as a certificate-transparency name. Ownership was not confirmed. | Left as unconfirmed. Not described as Example Law PLLC's system. |
2. TLS
Whether an ordinary HTTPS request completes, which name is on the certificate, and when that certificate expires. Not a cipher review.
| Check | Example observation |
|---|---|
| Name on the certificate | example.com |
| Ordinary request | Illustrated as completing for https://example.com/ |
| Expiry in this example | 15 January 2027 (placeholder) |
A completed request and a matching name are observations. They are not a statement that the site is safe, and they are not a finding of a weakness.
3. Email authentication
SPF, DKIM, and DMARC as they would be copied into the report. These records say how receivers are asked to treat mail that uses the domain. They do not show that any such mail was sent.
| Record | Example value |
|---|---|
| SPF | v=spf1 include:_spf.example.com -all |
| DKIM | Selector selector1._domainkey.example.com is shown as published in this illustration. |
| DMARC | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
p=none means receivers are asked to send reports, not to reject mail. In a real snapshot that would be written as a configuration fact. It would not be written as evidence that the domain had been spoofed.
4. Public website
In this example, the homepage is described as returning a normal page over HTTPS. The illustration notes that a Strict-Transport-Security header was not present. That is a header observation. It is not evidence of compromise.
5. Public mentions
A real snapshot may note a public page that names a tool or a storage address. This example has none. A mention, when one exists, is not proof the tool is in use, and it is not evidence of a leak.
6. Note for IT
A real snapshot ends with a few sentences: what was checked, what was left unconfirmed, and whether anything is worth a look. This example's note would read: the DMARC policy in the illustration is monitoring-only, and mail.example.com was left unconfirmed. Nothing here is a vulnerability count.
What a real snapshot does not include
- Microsoft 365 identity, guests, sharing, app permissions, or audit logs
- On-premises systems, file servers, or an internal network
- AWS, Azure, or GCP
- Any login, any change, or any test that tries to break in
- A compliance opinion, a legal conclusion, or a claim that the firm has or has not been compromised
Qualified or referred requests. Switchback prepares up to two snapshots a week. The M365 Quick Check ($750–$1,000, about a half day, read-only) and the Identity, Data & AI Security Review (from $3,500, typically $3,500–$5,500) are separate engagements. See pricing.