Shodan, a public index of internet-facing systems, lists the published vulnerabilities (CVEs) that match the software it saw on each address. Unless Shodan marks a match verified, it is inferred from that software and its version and has not been tested against the service. The same index is open to anyone, so an attacker can read the same list.
A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.
Related External Attack Surface checks
Check your own tenant
Is your tenant covered on "patch internet-facing services"?
One read-only scan answers it — this check and every other one in the catalog, each with a plain-English fix. 7-day Pro trial, no credit card.