Managed program
Every finding has an owner until it is closed.
Your expert team owns each finding from triage to closure with evidence. Your team usually makes the change, and our Cybersecurity Engineers can make it for you as advanced remediation support, where you grant access.
MFA not enforced on 4 shared mailboxes
Owner: Your IT lead. Example date: end of month.
- Stage
- Fix
- Tracked by
- Your expert team
- Closes with
- Evidence, re-checked on the next scan
- Found
- Plan
- Fix
- Proof and close
The route to closure
Vulnerability remediation, from finding to proof.
Four stages, and your expert team stays on the finding through all of them. The only stage that changes hands is the fix itself.
- 1VectraIQ
Found
A scan, an assessment or a configuration check raises it and records where it came from.
- 2Your cyber expert
Plan
Your cyber expert decides how much it matters for your business, then writes the plan: what to change, where, who does it and a target date.
- 3You or Cybersecurity Engineers
Fix
Your admin makes the change from the plan, or our Cybersecurity Engineers do where you have granted access.
- 4Your cyber expert
Proof and close
Your cyber expert checks the result and attaches the proof: a clean scan or check, or a screenshot you supply. The finding closes with that evidence, so a later review sees what was done and when.
Worked example
One finding, two ways to fix it, one way to close it.
MFA not enforced on 4 shared mailboxes
- Severity
- High
- Source
- Scheduled configuration check
- Owner
- Your IT lead
- Plan
- Enforce MFA on every account that can sign in to these mailboxes. Your cyber expert gives the exact steps for your mail tool.
- Target date
- Example: 10 working days from agreement
Your admin makes the change from the plan and tells your cyber expert.
You grant write access to the mail tenant. Our Cybersecurity Engineers make the change and record exactly what was altered.
Either way, the next configuration check shows the mailboxes passing, your cyber expert attaches that result and the finding closes.
Illustrative. The dates and the plan are made up; the stages are the real ones.
What you do
- Make the change from the plan, or grant the access so our Cybersecurity Engineers can.
- Tell your cyber expert early if a target date will slip, so priorities can move rather than the finding going stale.
- When you choose not to fix something, say so. Your cyber expert records the decision and the reason.
What is not included
- ×Changes made to your tools without access you have granted. Connections are read-only unless you say otherwise.
- ×Hands-on fixes inside the standard program. They are an add-on, delivered by our Cybersecurity Engineers.
- ×Work beyond the agreed scope, which is agreed with you before it starts.
Findings sit in your risk register, and the security page explains the access our Cybersecurity Engineers would need and who approves it.
Who makes the change
Guided closure is included. Hands-on is an add-on.
Included: guided closure
- Priority set with you, not by a scanner alone.
- A written plan on the finding: steps, system, owner and target date.
- Tracking by your cyber expert until it closes.
- Proof attached at closure.
Advanced remediation support: hands-on
- Cybersecurity Engineers make the change directly in the tool, instead of handing you a ticket.
- Needs access wider than the read-only connection. You grant it, tool by tool, and you can withdraw it.
- Quoted separately once we know what you need.
Which route fits
A setting your admin can change in minutes
Your admin makes it, following the steps in the plan.
A change that touches many systems, or needs a specialist your team does not have
Our Cybersecurity Engineers make it as advanced remediation support, if you grant the access.
A decision about cost, design or risk appetite
It is yours. Your cyber expert sets out the options and what each costs you in risk.
Questions, answered.
Who owns a finding if my team has no time?
Your expert team owns it either way. They keep it prioritized and tracked until it closes. What differs is who makes the change, and if your team cannot, hands-on remediation is the add-on that covers it.
How do we know a fix worked?
A finding closes with evidence attached, not on someone’s word. Your cyber expert checks the result against the next scan or configuration check, or against proof you supply, and attaches it.
What if we decide not to fix something?
That is your call. The finding stays visible with the decision and the reason recorded, so a later audit or review sees a choice rather than an oversight.
How is hands-on remediation priced?
It is quoted separately once we know what you need, so talk to us. It is not part of the managed program’s standard scope.
Give every finding an owner.
Tell us where findings stall today and a lead expert will show how ownership and closure would work for your team.