Penetration tests, audits and internal reviews often leave separate backlogs with different scoring. We reconcile them, look at your external endpoints, configuration and recent incidents and alerts for ourselves, work out why the same findings keep appearing and agree a realistic sequence of fixes that remove the cause.
Security teams carrying more findings than they can address at once, or leaders who need a defensible plan for the next six to twelve months.
Independent findings from the last year, with the report each one comes from.
Independent findings from the last year, with the report each one comes from.
of UK businesses that identified a breach or attack in the last year experienced phishing, the most prevalent and most disruptive type. Just over four in ten businesses (43%) identified an attack at all.
This is why a flood of phishing reports is treated as a symptom and traced to the control that let it through, such as an allow list or a gap between the mail gateway and Defender, before anyone buys more training.
of all published vulnerabilities have ever been observed being exploited in the wild, and fewer than 5% of those reach more than 1 in 10 organisations.
This is why the roadmap does not sort by CVSS. A run of findings on public facing apps points to the missing control, such as no DAST or SAST in the pipeline, and fixing that becomes the next step.
more critical vulnerabilities to patch in the median organisation than the year before, while only 26% of those known to be exploited were fully fixed and the typical fix took 43 days.
This is why the plan sequences work by root cause and by the capacity you actually have, so the same class of finding stops reappearing in next year’s test.
Collect existing reports, test results, audit findings and backlogs, then look for ourselves at your external endpoints, configuration and recent incidents and alerts.
Map the different rating schemes into one structure, remove duplicates and identify recurring causes.
Consider the affected service, likely impact, architecture, current controls and delivery capacity alongside technical severity.
Group related fixes, record dependencies and agree realistic milestones for each quarter.
Present the recommended order with the evidence and tradeoffs needed for leadership approval.
A run of vulnerabilities on public facing apps usually means nothing scans code before release. A flood of phishing usually means a control is letting it through. Each recurring finding is traced to the control or process behind it, and that is what goes on the plan.
A lower severity issue on a payment system may deserve attention before a critical issue on an isolated test service.
A roadmap must fit the people, budget and dependencies available, otherwise it becomes another unused backlog.
A prioritised roadmap with owners, dependencies and quarterly milestones, each step tied to the root cause it removes, supported by an executive summary and the scoring behind each decision.
Sample report, fictional client
Our consultants have owned internal security backlogs and understand the constraints behind delivery.
Repeated findings are traced back to the underlying process or control so the roadmap addresses the cause.
The roadmap gives delivery teams enough detail to start work and gives leaders the reasoning behind the priority.
