As of 13 August 2026, AI can only partly scan your business website for vulnerabilities.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the website owner's records and write down the exact domains, subdomains, IP addresses, test window and exclusions covered by your written authorisation.
   2. Gather the website's technology inventory, dependency versions, hosting details, security headers, authentication scope and any customer-data constraints without pasting secrets, passwords or live personal data into the chatbot.
   3. Run an authorised, non-destructive vulnerability scan using a security tool appropriate to your hosting and export the results with timestamps, affected URLs and request evidence.
   4. Paste the scope, constraints and exported results into the prompt, then ask the AI to separate confirmed findings from assumptions and rank remediation work.
   5. For each high-priority finding, reproduce only the safe validation steps against a test account or staging copy and compare the result with the evidence quoted in the AI report.
   6. Send the report and unresolved findings to a qualified penetration tester or security professional, then record which findings they confirm, reject or require further testing.
   7. Apply fixes in staging, rerun the authorised checks, and keep the scan evidence, change record and professional review together as the finished assessment.

   Prompt

   Act as a defensive web-security analyst. I have written authorisation to assess this business website: [WEBSITE URL]. Do not attempt to access, scan or exploit any system, endpoint or account yourself. Work only from the authorised scope and the evidence I paste below.
   
   Scope and constraints:
   - Authorised domains and IP addresses: [SCOPE]
   - Excluded systems, paths and actions: [EXCLUSIONS]
   - Test window and rate limits: [WINDOW AND LIMITS]
   - Technology or hosting details I know: [DETAILS]
   - Compliance or customer-data constraints: [CONSTRAINTS]
   
   Evidence:
   [PASTE SCANNER OUTPUT, HTTP HEADERS, CONFIGURATION, DEPENDENCY LISTS OR SOURCE CODE HERE]
   
   For each finding, provide:
   1. A short title and severity marked as confirmed, likely or unconfirmed.
   2. The exact evidence supporting it, quoting only the material I supplied.
   3. The affected URL, component or code location.
   4. Why it matters in plain English.
   5. A safe way to reproduce or validate it without destructive testing, account access or data extraction.
   6. A prioritised remediation plan suitable for a UK business.
   7. What a qualified security professional must verify before closure.
   
   Separate observations from assumptions. Do not invent versions, vulnerabilities, CVE identifiers, exploitability, compliance duties or affected data. Flag missing evidence and tell me what authorised evidence to collect next. Do not claim the website is secure merely because no issue appears in the supplied evidence.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.