Exposure assessment
Assess
A fixed-scope review of your vulnerability data, external attack surface and patch process, ending in a ranked remediation plan.
Vulnerability & exposure management
Fix what attackers are actually using, first.
Scanners produce thousands of findings, and most teams cannot fix them all. We rank them by what is being exploited in the wild and what matters to your business, agree realistic patch timelines, and track every fix to closure.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
How it works
A programme, not a pile of scan reports.
The same prioritisation behind our public threat-intel tracker, applied to your own systems.
Discover
Confirm what you actually run: servers, endpoints, cloud services and internet-facing assets, with your existing scanner or one we help you choose.
Prioritise
Rank every finding by whether it is exploited in the wild (CISA KEV), how likely it is to be exploited next (FIRST EPSS), how severe it is (CVSS) and how important the asset is to you.
Remediate
Agree patch timelines by priority and hand clear, ranked work to your IT team or MSP, or coordinate patching through a vetted partner.
Verify
Re-scan to confirm fixes landed everywhere, and chase the stragglers that usually get missed.
Report
A monthly one-page view for leadership: exposure trend, overdue items, and what changed. Evidence your auditors and insurers can use.
Patch timelines
Clear deadlines, agreed with you.
Example targets we start from. The final timelines are agreed with you during onboarding, to fit your systems and change windows.
| Priority | What it covers | Example target |
|---|---|---|
| Act now | Exploited and used in ransomware, very likely to be exploited, or critical | Internet-facing: within 72 hours. Internal: within 7 days. |
| This week | Exploited, with a meaningful chance of use or high severity | Within 14 days |
| Plan | Exploited, but lower likelihood and impact | Within 30 days, and before the CISA date |
| Routine | Not known to be exploited | Normal patch cycle |
What is included
Works with the tools and people you already have.
We work with Microsoft Defender Vulnerability Management, Tenable, Qualys, Rapid7 and open-source scanners, and alongside your IT team or managed service provider.
We only scan or test systems with your written authorisation, under an agreed scope.
- Asset and scanner coverage review
- Risk-based ranking using CISA KEV, FIRST EPSS and CVSS
- Patch timelines and ownership agreed in writing
- Remediation tickets and tracking to closure
- External attack-surface checks
- Cloud configuration risk review
- Monthly executive report and exposure trend
- Evidence for SOC 2, ISO 27001, HIPAA and insurers
Ways to start
Assess, build, or hand it to us.
Programme set-up
Build
Tooling, asset coverage, patch timelines, ownership and reporting, documented so your team can run it.
Managed vulnerability management
Manage
We run the programme each month: prioritisation, remediation tracking with your team or MSP, verification and leadership reporting.