IS MY STACK EXPOSED?
Tell me what you run, name and version. I read everything published against it, work out which of it applies to your versions and the way you deploy them, and send you the short list that matters: triaged by hand, in plain words, ranked so you know what to do first. Once, for the stack as it is today, or every month as it changes.
Plus an hour with me. Not a support queue, but the person who writes the vulnerability research on this site and builds the app, on a call about your software.
Your stack as it is today, plus an hour on a call. A good first step, and it goes stale as new advisories land.
Anything with its own version and its own advisories — an operating system, a web server, a database, a runtime, a framework. 10 are in the base; each one after that is $100.
On a call, about your software — not a support queue. One hour is in the base; each further hour is $400.
Scope is agreed in writing before anything is invoiced.
WHAT "EXPOSED" MEANS HERE
A published vulnerability that applies to a version you run, in the way you deploy it. That is the part of your attack surface a feed cannot judge and a scanner cannot see: whether the advisory that landed this week is your problem or someone else's. Exposure management tools list the advisories; this reads them against your stack and tells you which ones matter and in what order.
WHAT THIS IS NOT
- ·Not a scan and not a penetration test. Nothing touches your systems, and your external attack surface is not probed.
- ·Not a compliance audit, and no auditor will accept it as one.
- ·I only see what you tell me you run. If your exact version might not be affected, the report says so rather than guessing.
If it is a fit I will say so and invoice; if it is not I will tell you that and point you somewhere better. Nothing is charged, and no invoice is raised, until we have agreed the work.
SLVN GROUP S.R.O. · RESEARCH · RECON FOR IOS