Managed program
Scans on a schedule, and a person who reads them.
Your company is scanned weekly and your vendors’ external security posture is checked passively on a schedule. A scan is only useful once someone has decided which findings matter, so your cyber expert turns each one into a short list.
Weekly scan, your company
Example14
findings from the scan
3
actions chosen by your cyber expert
- Findings with a shared cause become one action
- The rest are noted, with no action this month
The schedule
How often things are checked.
Your company is scanned weekly. Critical vendors are checked daily, high every 3 days and medium and low weekly.
This is scheduled scanning. It is not a 24/7 watch, and it does not replace a SOC or MDR provider.
What is looked at
Four sources, all from the outside.
Standard scanning needs no access to your internal systems. Wider access is something you grant, never something we assume.
Vulnerability scans
Your external-facing systems are scanned weekly for known vulnerabilities. Scans that sign in to your internal systems are an add-on, because they need access an external scan does not have.
OSINT
Open-source intelligence: what anyone can find out about your company, domains and exposed services without logging in to anything.
Dark web monitoring
Checks for your organization’s data appearing in breaches. Breached accounts are reported as counts only. We never collect passwords.
Vendor monitoring
Passive checks of the vendors you have reviewed, covering their external security posture as well as public records and news. We never scan or probe a vendor’s systems, because they have not agreed to it.
From scan to short list
VectraIQ runs the checks. Your expert decides what matters.
VectraIQ runs the checks and flags what changed. Your cyber expert decides what matters and gives you a short list of fixes.
Worked example
Three findings, three different calls.
Illustrative findings. The scanner rates each one alone; your cyber expert rates it for your business.
Outdated web server version on the marketing site
Scanner: ScannerMedium
ExpertFix this month
Same component runs on a second host, so one change closes both.
Old test site still answering on a public address
Scanner: ScannerHigh
ExpertFix first
It serves nothing and can be switched off. Quick, and it removes the exposure completely.
Directory listing enabled on an image folder
Scanner: ScannerLow
ExpertNote, no action
Only public images are in the folder. Revisit if that changes.
What you do
- Confirm you own each domain before it is scanned. Nothing is scanned until you have.
- Tell your cyber expert about new domains, products or acquisitions so they enter the schedule.
- Act on the actions assigned to you, or say why not. Your cyber expert records either answer.
What is not included
- ×24/7 SOC or MDR monitoring. This is scheduled scanning, and a provider that watches around the clock stays in place if you have one.
- ×Authenticated internal scans and deeper testing. Both are add-ons, scoped with you.
- ×Scanning of anything you have not confirmed you own.
Vendor findings feed third-party risk and your own findings feed risk management. The security page explains the ownership check and what we never collect.
Questions, answered.
What happens between scans?
Nothing watches around the clock. VectraIQ flags changes when each scan or check completes, so your cyber expert reads what is new. If you already have a SOC or MDR provider, it stays in place and we work alongside it.
What do you do when you find breached accounts?
They are reported as counts only, and we never collect passwords. Your cyber expert tells you what the exposure means and what to do about it.
Who decides how urgent a finding is?
A scanner rates every finding on its own. Your cyber expert sets the priority for your business with you, so a medium finding on a system that holds customer data can come before a high one on a retired test site.
Find out what is exposed before an auditor does.
We confirm you own the domain, then a lead expert walks you through what the scheduled checks would cover.