Partly true: ThreatMate is a real MSP security platform with automated testing and prospect reports, but its 'free external pentest on any prospect domain' is an unverified-domain scan, and scanning a prospect without permission is a legal risk

The claimOn screen: 'AUTOMATED PENTESTING AT SCALE. Replace manual scan schedules with autonomous testing that secures every client in minutes,' over a black box with antennas and an octopus logo. Caption: 'ThreatMate gives you a free external pentest report you can run on any prospect domain in minutes... Limited to 5 scans per account (so it doesn't get abused). Show clients their actual risk posture, improvement score, and the actions you're taking, all in one clean PDF. Use it to... upsell managed security services.'

ThreatMate is a real company selling a real platform to managed service providers: attack-surface discovery, vulnerability management, Microsoft 365 checks, weekly automated pentests using attack templates, and branded PDF reports built for sales calls. Its prospecting page openly pitches the reports as a way to turn free assessments into managed contracts. So the product exists and the report exists. Three parts of the ad overreach. First, 'external pentest on any prospect domain': ThreatMate's own platform guide says that, to prevent abuse, it does not allow full port scans or pentesting on targets you have not verified, and verification means adding a TXT record to the domain's DNS. A prospect who has not given you DNS access gets subdomain enumeration and a vulnerability scan, which is useful but is not a penetration test. Second, 'secures every client in minutes': testing finds problems, it does not fix them, and the product's own docs say an initial internal discovery report takes about six hours. Third, the box in the ad is a styled render; ThreatMate's documented hardware is the ThreatMate Pi, a preconfigured Raspberry Pi for internal network scans, and the external prospect report needs no hardware. The bigger issue is what the ad tells MSPs to do. Probing a company's systems without written permission can breach computer-misuse laws and ISP terms; the one US case often cited for scans being legal (Moulton v. VC3) is narrow and old. Get the prospect's written OK first. The '5 scans' limit could not be confirmed on ThreatMate's public pages.

ThreatMate, its automated testing and its branded prospect reports are real and fit an MSP sales motion. The 'external pentest on any domain' line overstates what an unverified scan does per the vendor's own guide, 'secures every client in minutes' confuses detection with remediation, and scanning prospects without written permission is a risk the ad never mentions.

Confidence

Medium

Posted by

ThreatMate, the vendor's own page (sponsored ad); reel sent to Buddy Mon Oct 12, 2026, ~7:07 AM

See the original claim →