Exposure Management
240 questions across nine pillars: what an attacker can reach, and how long it stays reachable.
240 controls · 9 pillars · 75 categories · evidence can be collected automatically
240 questions across nine pillars: what an attacker can reach, and how long it stays reachable.
240 controls · 9 pillars · 75 categories · evidence can be collected automatically
Most incidents begin with something the organisation already owned and had stopped watching: a server nobody patched, a public interface nobody retired, a supplier's component nobody reviewed after it was installed. This assessment establishes how much of that exposure exists and, more importantly, how long a known weakness stays open before someone closes it. If you report under NIS2, DORA or the Cyber Assessment Framework, that second figure is the one you will be asked to evidence, and an assurance from your own team is not evidence.
240 scored questions across nine pillars and 75 categories, covering patching, open source dependencies, build pipelines, external attack surface, baseline identity and endpoint controls, data and AI governance, cloud runtime, detection and response, and governance. The pillars are independent, so the 44-question baseline security pillar and the 40-question data and AI governance pillar can sit in different quarters of a compliance calendar. Nothing is deployed and nothing is attacked: the collector scripts are read-only, so the disruption is interview time, configuration exports and evidence review.
Inspection runs from patch telemetry coverage and SBOM completeness, through CI/CD scanner placement, external asset discovery and API endpoint exposure, into Kubernetes and container runtime policy, OT and industrial control segmentation, and the newer surfaces: MCP server access control, agent containment and action gateways, and RAG and vector store governance. The questions are written to fail a tool that merely exists — the patch question asks whether status is visible across endpoints, servers and cloud workloads at once, not whether you own a patching product. Evidence is collector output, configuration exports and pipeline definitions, scored per control with the artefact recorded beside the answer.
240 controls across 9 pillars and 75 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Read-only collector scripts run against your own environment and return a machine score per control, which the assessor accepts, overrides with a note, or marks unreadable. Interviews and configuration exports score the controls no script can observe, and the artefact behind every answer is recorded with it.
A collector can show that a control is configured; it cannot show that anyone acts on what it produces, so whether a finding actually gets fixed remains an assessor's judgement from interview and ticket history.
This is where OT segmentation meets IT patching: five questions deal with industrial control systems specifically, and the runtime pillar holds them to the same remediation clock as everything else.
Time-to-remediate is the figure the Cyber Assessment Framework presses hardest, and the 19-question patch and currency pillar is built to produce it with evidence rather than assertion.
DORA expects an ICT risk picture that includes third-party software, which is exactly what the 18-question open source risk pillar and its supply chain categories measure.
These estates accumulate unpatchable clinical and lab equipment alongside long-lived shared accounts, and both land inside the 44-question baseline security pillar rather than being quietly excluded.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 240 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.