Language
Project & Assessment Inquiry

CORE CAPABILITY

A plan to look at everything looks at nothing

Declare a full sweep across 3,000 assets and six months later you have a half-filled checklist. We sequence by attack path instead.

Discuss scope

Methodology

  • 1. Asset discovery and exposure

    The inventory is rebuilt from what actually responds, not from the asset register. Incidents often start with something the register never listed.

  • 2. Attack path modelling

    We draw the paths from externally reachable assets to the critical data. Assets on those paths are assessed first.

  • 3. Deep assessment

    Priority assets get manual testing; the remainder gets automated checks with sampled manual verification. Mixing the two is what fits the calendar.

  • 4. Remediation design and retest

    A remediation order that respects operational constraints, then we retest it ourselves rather than accepting a completion report.

Why prioritisation matters

At scale the finding count means nothing. Of 12,000 items raised across 3,000 assets, only dozens are usable in an actual attack. Reporting the rest alongside them costs the client their sense of priority, and nothing ends up fixed.

Our first criterion is whether the asset sits on an attack path: is it reachable from the internet, can an attacker move on from it, and does that path end at critical data. A low-severity finding on the path outranks a medium-severity finding off it.

Deliverables

  • Discovery-based asset inventory, including the delta against the register
  • Attack path diagrams with chokepoints identified
  • Valid findings with reproduction steps, evidence and environment-adjusted severity
  • Remediation roadmap by quarter, respecting operational constraints
  • Retest report

Typical duration

Roughly eight weeks for 1,000 assets and fourteen weeks for 3,000. Running penetration testing in parallel adds four weeks.

Last three years

Large-scale assessments
47
Assets assessed
21,400
Remediation confirmed at retest
92 %

Been putting it off because the estate is too big?

You do not have to cover it all at once. We will help you decide where to start.

Request a consultation