Service · 2–4 weeks · Fixed fee
Stop fixing by CVSS score and start fixing what attackers would use
I review how you find, rank, prove and fix exposures, then give you a prioritisation model and an owner playbook your teams can run every week.
- 2–4 weeks
- Fixed fee
- Gartner CTEM
- CVSS
- EPSS
In short
An exposure management assessment reviews how an organisation finds, ranks, validates and fixes weaknesses, using the five CTEM (continuous threat exposure management) stages defined by Gartner: scoping, discovery, prioritisation, validation and mobilisation. I examine scanner and testing coverage, prioritisation beyond CVSS (Common Vulnerability Scoring System) and remediation ownership, then deliver a prioritisation model, a validation approach, an owner playbook and metrics.
This is for you if
- Scan reports are long, sorted by CVSS and mostly ignored
- Two scanners and the CMDB disagree on what you actually own
- Findings sit for months with no named owner or deadline
- Auditors ask for remediation evidence, not more scan reports
When to call me
The moments this engagement is built for.
- 01A known exploited flaw caught you outA vulnerability on the CISA KEV list sat open on an internet-facing system longer than anyone realised.
- 02Scanner renewal or consolidationYou run more than one scanner and want to know what each one actually sees before renewing.
- 03Audit findings on remediationAuditors flagged ageing critical findings and risk exceptions with no expiry date.
- 04Teams push back on the backlogInfrastructure and app teams cannot fix everything, and nobody can say what to fix first.
How it runs · 2–4 weeks
From kick-off to a plan you can act on.
- 01Scoping
- Pick the business services and crown-jewel assets
- Agree what critical means, from the impact analysis
- 02Discovery review
- Reconcile assets across scanners, CMDB and cloud
- Check credentialed and authenticated scan coverage
- Review SAST, DAST and SCA in the pipeline
- 03Prioritisation model
- Enrich a sample with EPSS, CISA KEV and exposure
- Weight by reachability and business criticality
- 04Validation approach
- Design automated and targeted manual validation
- Pilot on a few top-ranked exposures, with consent
- 05Mobilisation and metrics
- Draft the owner playbook, deadlines and exceptions
- Set metrics and a weekly review rhythm
What you get
Deliverables, not a slide deck of opinions.
- PDF reportCoverage and gap reviewWhat each scanner and test sees, what nothing sees, and where credentials or logins are missing.
- SpreadsheetPrioritisation modelScoring that combines CVSS, EPSS, CISA KEV, reachability and business criticality.
- PDF reportValidation approachHow to prove exploitability: automated testing, targeted manual tests and rules of engagement.
- PDF reportOwner playbookWho fixes what by when, how exceptions expire, and how every fix is re-tested before closure.
- SpreadsheetMetrics setMeasures by business service: time to remediate, coverage, overdue exceptions, reopened findings.
What happens next
Afterwards, you can decide.
An assessment is only useful if it changes a decision. These are the ones this engagement is designed to unlock.
- 1Which business service becomes the first CTEM scope
- 2Whether to adopt the prioritisation model and retire fixing by CVSS alone
- 3How validation runs: an automated platform, manual tests or both
- 4Who owns remediation deadlines, and who may approve an exception
- 01
Assess
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
- Findings with evidence
- Score per area
1–4 weeks
- 02
Recommend
A prioritised plan: what to fix first, what it costs, and what risk it removes.
- 30/90/365-day plan
- Board summary
With the assessment
- 03
Execute, case by case
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
- Delivery options
- Independent oversight
Only where it makes sense
Method
Built on standards your auditors recognise.
- Gartner CTEM
- CVSS
- EPSS
- CISA KEV catalogue
Grounded in delivery
Where this experience comes from.
Do we need new tools to start CTEM?
Usually not. Most organisations already own scanners such as Tenable or Qualys, plus some SAST (static application security testing) or DAST (dynamic application security testing). CTEM (continuous threat exposure management) changes how you use them: scoping around business services, enriching findings with exploit evidence, validating the top of the list and giving every fix an owner. New tools come later, if a gap justifies them.
What is wrong with prioritising vulnerabilities by CVSS score?
CVSS (Common Vulnerability Scoring System) base scores measure how severe a flaw is in general, not how risky it is for you. A critical finding on an isolated test server can matter less than a medium one on an internet-facing banking portal. Better prioritisation adds likelihood from EPSS (Exploit Prediction Scoring System), confirmed exploitation from the CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalogue, reachability and criticality.
How is this different from a VAPT?
A VAPT (vulnerability assessment and penetration test) finds weaknesses in systems at one point in time. This assessment looks at the process around those findings: whether scanning covers everything, how findings are ranked, how exploitability is confirmed and whether owners fix them on time. It answers why last year’s findings are still open, which another round of testing cannot.
Will you test exploitability on production systems?
Only under written rules of engagement. During the assessment I design the validation approach and, if you agree, pilot it on a few top-ranked exposures, starting in non-production or on low-risk systems. Scope, timing, allowed techniques and who can stop a test are agreed in advance, and the SOC (security operations centre) and system owners are told beforehand.
Which metrics show that exposure management is working?
Not the number of vulnerabilities found, which mostly measures scanning effort. I recommend median time to remediate validated high-priority exposures, the share of in-scope assets with recent credentialed scans, open validated exposures on internet-facing critical systems as a trend, exceptions past their expiry date, and findings that reappear after closure. Report them by business service, not by tool.
Other engagements
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support