One report. A concrete question.
A compromised LiteLLM release reached its package and container registries on October 21. Do you use that vendor, in which systems, and with which permissions?
LiteLLM investigation · Oct. 23, 2026Cybersecurity for companies without a security team
An expert on your side.
From risk to action.
We identify which threats may affect you and agree who needs to act. In plans with technical checks, we verify fixes with evidence. Choose the coverage your business needs.
Security decisions, kept in order.
Illustration · invented data
Your surface: each point, a host
checked open decision
Why it matters now
The news changes. Your next step should be clear.
An update goes beyond the repository.
Node.js published security releases on October 21. For an advisory like this, establish what is affected and which version was actually deployed. A Git change alone answers neither question.
Node.js advisory · Oct. 21, 2026Public incidents, cited as context. These are not findings about Known Surface clients.
Three service levels
Start with awareness. Add monitoring. Then test your defenses.
We recommend the smallest plan that meets your needs. Each level adds depth, with written boundaries.
Intelligence
Does this advisory affect my business?
- Breach reports and vendor advisories
- Relevance to your declared products and versions
- What needs confirmation and which action follows
- Intelligence brief and a named client contact
Priced to your scope
No internal access or active testing. Your team confirms installation and remediation.
Scope my vendor listWatch
What changed, and who needs to act?
- Everything in Intelligence
- Agreed external checks and read-only integrations
- Actions with an owner, priority and date
- Deployment tracking and verification of fixes
Priced to your scope
Internal coverage is integration-specific. Automated 24/7 operation follows validation of checks and alert delivery.
Scope my connected systemsAdversarial validation
How could our weaknesses connect?
- Everything in Watch
- A red-team agent with expert supervision
- Targeted architecture, source and infrastructure review
- Evidence of validated steps and one agreed retest
Priced to your scope
One objective and scope per campaign. No exploitation or destructive actions in the standard offer.
Scope an assessmentCompare coverage and limits
| Coverage | Intelligence | Watch | Adversarial validation |
|---|---|---|---|
| Relevant sources and advisories | Included | Included | Included |
| Access to client systems | Not required | Read-only, per integration | As explicitly approved |
| Technical exposure confirmation | Provided by your team | For connected controls | Also within the campaign objective |
| Remediation follow-through | Recommended action | Owner and agreed verification | Also a campaign retest |
| Source and architecture | Outside scope | Authorized service context | Targeted review of agreed repos |
Plans activate under an agreed scope. Internal coverage and campaigns are offered through a pilot. 24/7 describes automated checks: human response has its own agreed hours and escalation route.
Your proposal defines assets, sources, integrations, cadences, review hours and campaign budgets. Setup and remediation implementation are scoped separately where applicable.
Closure evidence
An owner for action. Evidence for closure.
The record distinguishes observations, fixes your team reports, and results we could verify. Coverage gaps stay visible too.
- 01
Observed
What was detected and where the evidence came from.
- 02
Prioritized
Impact, prerequisites and what remains unconfirmed.
- 03
Assigned
An owner and an agreed date.
- 04
Fix reported
Your team records what changed.
- 05
Deployed
The target receiving the fix is identified.
- 06
Verified
The agreed check confirms the result.
Illustrative example · no client data
The repository changed. What about production?
- Reported action
- The runtime version was updated in a pull request.
- Evidence pending
- Deployed artifact identity and the service’s effective runtime version.
- Agreed closure
- Deployment evidence and the result of the scheduled verification.
Technical follow-through belongs to Watch and Adversarial validation. In Intelligence, your team supplies confirmation. Accepted risk, blocked work and unavailable verification are recorded explicitly.
When the work grows
One advisory can require many deployments.
Fixed-scope extension · Watch and Adversarial validation
Remediation campaign
For an urgent advisory or finding family requiring coordination across several services. We agree the scope and additional capacity before starting.
Discuss a remediation campaign- Inventory of potentially affected services
- Team-owned actions and dependencies
- Checkpoints and evidence per deployment
- Summary of verified closures and open work
Your team implements changes, deploys and owns rollback. Incident investigation and containment require a separate scope.
Expert and system
Tools collect. A person owns the judgment.
Your expert
Judgment and follow-through
- Judges relevance and priority in your business context.
- Agrees owners, next actions and closure evidence with you.
- Reviews findings and campaign conclusions.
The system
Evidence and repeatability
- Collects evidence within approved scope.
- Records results, failures and coverage gaps.
- Supports checks and campaigns within execution limits.
A named accountable expert, with agreed review hours and channels. No implied round-the-clock human response.
The attestation
Show it, don't say it.
Your plan’s report records scope, sources, checks and open decisions. In plans with technical checks, it distinguishes reported fixes from verified results.
It does not say you cannot be breached. It says someone is watching, and proves it.
Example · Bufete Ejemplo, S.A., a firm that does not exist
Known Surface
KS-2026-09-EX
Attestation of vigilance
Period: September 2026 · Issued 1 October 2026 · Example
- Issued to
- Bufete Ejemplo, S.A. (example)
- Scope
- 6 domains · 43 hosts under signed inventory (example)
- Checked
- 12 catalog controls · 31 complete runs in the period (example)
- Open decisions
- 2 · none past 30 days (example)
- Boundary
- External surface only. No exploitation, no internal testing.
Steward's name
Assigned steward · Known Surface
An attestation of vigilance,
not a guarantee of safety.
not a guarantee of safety.
An invented organization, shown to explain what the document looks like. It never carries a score, a grade or a percentage: a score is a promise we cannot keep, and the document is what we can.
Coverage
What we check.
This part is for your IT provider. These probes can be included in an authorized assessment. Each run’s manifest states which ran and which remain unassessed.
coverage manifest7 probes
- http_probe
- Security headers, redirect chains, cookie flags, technology fingerprinting, certificate verification.
- tls_check
- Certificate validity and expiry, weak protocol support, known protocol-level flaws.
- dns_check
- SPF, DMARC and DKIM across common provider selectors, plus MX, NS and TXT records.
- dns_health
- Dangling CNAMEs and subdomain takeover signals, lame nameservers, zone transfer exposure, CAA, DNSSEC.
- waf_detect
- Web application firewall presence and vendor.
- port_scan
- Open ports and service versions on a focused, approved profile. No broad, UDP or stealth scanning.
- cognito_inventory
- Read-only review of the sign-in configuration a public page reveals: identity-provider identifiers, redirect and logout addresses, response types. One page and up to eight of its own scripts, GET only; never logs in, follows redirects or contacts the identity provider.
Coverage and boundaries
Scope is written down before work starts.
One connected integration does not reveal your entire business. We name the accounts, environments, sources and methods actually included.
By plan and agreed scope
- Intelligence on declared vendors and products
- Authorized public DNS, TLS and web checks
- Agreed read-only internal integrations
- Targeted architecture review and supervised testing
- Follow-through and verification within your proposal
Outside the standard offer
- Exploitation, credential attacks and phishing
- Persistence, lateral movement or destructive testing
- Access to systems or repos outside scope
- Automatic remediation implementation
- A SOC, endpoint agents or staffed 24/7 response
Before you decide
Clear questions. Clear boundaries.
What do I need to get started?
A list of the products and vendors you use, and an accountable contact. For technical checks, we also agree assets, permissions and the evidence we may access.
Does 24/7 mean a person will respond at any hour?
It describes automated checks after activation and validation. Human review hours, recipients and escalation are agreed separately. Periods without coverage are identified.
Does a closed ticket count as a verified fix?
We record your team’s reported resolution separately from evidence validating the result. If evidence is missing or we cannot check it, verification remains pending.
Does the top plan include an unrestricted pentest?
It includes campaigns with a supervised red-team agent, an objective, approved methods and an execution budget. Source and infrastructure review is limited to agreed scope. The standard offer excludes exploitation and destructive actions.
Who implements the fixes?
Your engineers or IT provider. We provide judgment, follow-through and agreed verification. Implementation, larger remediation campaigns and incident response have separate scopes.
How is the price determined?
Your proposal specifies products, assets, integrations, review hours and campaigns. We start by recommending the level you need; no plan includes unlimited checks or emergency work.
Do you promise to prevent every breach?
No. We deliver observations, decisions and evidence within a specific scope. We also state what we could not observe or verify.
Start here
Four questions. Thirty minutes. No access to your systems.
Before anyone talks about an engagement, we sit down and answer four questions about your organization. You keep the answers whether or not you hire us.
Who controls your email, and can a stranger send mail as you?
When somebody leaves, what actually removes their access, and who confirms it?
When was a backup last restored, not just taken?
If something happens on a Saturday, who takes the first call?
Part of the first one we can answer before we meet, by reading the public DNS records your domain already publishes to the world. That is a lookup, not a scan: we touch nothing you own. The other three we ask you, and we write down what you say. You leave with a one-page baseline and an honest list of the gaps.
This prepares a draft in your email application; the page does not send the inquiry. You can also review and copy the text here.
View inquiry draft
We assess only estates you authorize in writing. Nothing is probed before a signed engagement.