Drubix watches every site your agency manages, checks it against Drupal.org's security advisories, and tells you exactly what to run to fix it, before it becomes an incident call.
No credit card Report in under a minute Drupal 9, 10 & 11
The problem
Every agency managing Drupal sites already does this work. The problem is doing it for every client, every week, without missing one.
What Drubix does
Uptime and SSL checks are included, but general-purpose monitoring tools don't know what a Drupal security advisory is. Drubix is built around exactly that.
Every advisory checked against your actual installed modules. A confirmed version match, not a guess.
^6.2.3^10.2.6The exact Composer update from the advisory, on every affected site at once. Turn on Autopilot and patch-level fixes merge once CI passes.
Every site you manage in one place, sorted by what actually needs attention.
Slack, Teams, Discord, email or webhook the moment an advisory affects a site. Acknowledge or snooze in one click.
A branded report emailed to each client every month, plus a live health page you can share.
Cross-referenced with CISA's catalog, so you fix what's actually being attacked, not just what's rated severe.
Flags configuration changed directly on a live site that never got exported to your repository.
Fail the build on open findings at or above a severity you choose, before a known vulnerability reaches production.
Historical trendsDaily snapshots show whether a site is improving or degrading.
Cross-site benchmarkingSee how a site ranks against every other Drupal site on the platform.
Attack surface scanningExposed .git, .env or backups, plus missing security headers.
Permissions & admin auditRisky permissions and settings, new or dormant admins.
Custom code scanningSQL injection, XSS and other mistakes in your own modules.
Secrets in the repoPasswords and API keys committed by accident.
File integrity monitoringChanged core files and web shells in the files folder.
Page tampering monitorNew scripts, card skimmers, spam links and redirects.
Before & after screenshotsKey pages checked on staging before a patch merges.
Temporary firewall rulesBlock a vulnerable module's URLs until you can update.
Email & DNS securitySPF, DKIM, DMARC and subdomain takeover risks.
Blast-radius incidentsOne advisory hitting 15 sites shows as one incident, not 15 findings.
Unmaintained module flaggingKnown-risky modules flagged before there's a CVE to match.
Mean time to patchA number you can put straight into a client report.
Drupal upgrade plannerEnd-of-life dates and module readiness for Drupal 11.
Uptime, SSL & domainDown alerts in minutes; expiry warnings weeks ahead.
Team workflowAcknowledge, snooze, assign or accept a risk, with history.
Daily digest & escalationOne morning email; escalation when criticals sit unpatched.
Versions from composer.lockConfirmed findings from GitHub, no module install.
Bulk importBring every site in from a CSV, Pantheon or Acquia.
How it works
Paste a URL. Drubix scans it immediately. No credentials needed for the first look.
For confirmed version accuracy, drop in a small Drupal module: one Composer require, one Drush command.
When an advisory affects a site you manage, you hear about it immediately, with the exact command to resolve it.
AI, where it's earned trust
Every finding comes from real advisory data compared against real, confirmed versions. It's fully deterministic. AI is layered on top only for writing: PR descriptions, plain-English report summaries and agent-activity correlation.
The same input always produces the same finding. No model in the loop can hallucinate a vulnerability, or miss one.
Clear PR descriptions and client-ready summaries, with a complete non-AI fallback if a provider isn't configured.
Pricing
Priced per monitored site, all core features included. Your site count is the only thing that changes your bill.
Unlimited one-off passive scans. No ongoing monitoring.
Full monitoring with confirmed version accuracy.
Sites 25 to 99 cost $6 each and every site from 100 costs $4. Pay yearly and get two months free. See how much you'd save →
Start with a free scan. No credit card, no commitment. Paste a URL, get a report in under a minute.