Attack Surface Review ยท Cyber Assurance
Prove every client's security controls are in place. On the day they ask.
Examiners, auditors, cyber insurers, lenders and boards all ask the same question: are the controls you say you have actually in place, and can you prove it? Attack Surface Review turns scan results and the security tools you already run into owned findings on one record, mapped to the rules your clients answer to.
The rules moved
From "have a security program" to "show us the evidence." Today the answer lives in a dozen consoles, and someone spends audit week pulling screenshots into a binder.
A running record of whether each client's security controls are actually working.
Regulators, insurers and lenders now want proof of MFA, scanning, patching, backups and training.
Findings with owners and due dates, and one export that answers the exam or questionnaire.
Every client, its exposure and what needs action.
The worklist shows every client with its primary IP, last scan date, open ports, risk level and a status of Clean, Open or Review. It's searchable by client, IP address or entity.
Opening a client shows headline tiles, a scan history chart of open ports against critical findings, the latest scan details, and a searchable, exportable table of every open port and service with its version and risk. Each record carries its own Findings, Tasks and History tabs, and Run New Scan starts a fresh scan on demand.
| Client | Primary IP | Ports | Risk | Status |
|---|---|---|---|---|
| Lakeshore Credit Union | 203.0.113.24 | 3 | High | Open |
| Granite State Leasing | 198.51.100.7 | 2 | Medium | Review |
| Harbor Point Finance | 192.0.2.141 | 1 | Low | Clean |
| Westfield Dental Partners | 203.0.113.90 | 2 | Low | Clean |
Concept screen with sample data.
The scan is the first feed, not the only one.
Each feed comes from a tool you already run. We add them one integration at a time, and every feed works the same way on the client record.
External exposure
Open ports and services from our scans, expiring SSL certificates, and email domain protections (SPF, DKIM and DMARC).
Security awareness training
Completion by employee and department, who's overdue, and phishing simulation results.
Identity & access
MFA coverage across every account, stale or orphaned accounts, and periodic reviews of privileged access.
Endpoint protection
Whether every device is reporting into SentinelOne or Huntress, and which ones have gone quiet.
Patching & vulnerabilities
Missing critical patches and how long each one has been outstanding.
Backup & recovery
The last successful backup and the last tested restore for each critical system.
Program evidence
Policy acknowledgments, incident response tabletop exercises, penetration test findings, third-party SOC 2 reports on file, and the annual cyber report to the board.
Every failed check becomes a task with an owner.
- Check failsA scan, sync or feed reports a gap.
- Finding opensSeverity, framework mapping and evidence attached.
- Task assignedAn owner and a due date, by your SLA.
- Fixed or acceptedConfirmed by the next check, or formally accepted with a reason.
- On the recordEvery step in the history, ready for export.
A new port shows up
The weekly scan finds remote desktop open on a credit union's public IP. The record flips to Open and High, a finding goes to the IT owner, and it stays open until the next scan confirms the port is closed.
Training deadline
Annual awareness training closes with 14 employees incomplete. Verify opens a task for each department manager, escalates anything 30 days past due, and keeps the client in Review until completion hits 100%.
MFA gap
A new hire's account is created without MFA. The next sync flags it, IT gets a finding, and it closes only when MFA is enforced.
Exam or board prep
The compliance officer exports one evidence pack covering twelve months of scans, training completion, MFA coverage and every finding with its closure date.
The requirements your clients are already answering.
NYDFS Part 500 now requires annual awareness training that covers social engineering, MFA for anyone accessing information systems, an annual written CISO report to the board, automated vulnerability scanning and a documented asset inventory. The FTC Safeguards Rule asks non-bank lenders and finance companies for training, MFA, vulnerability assessments at least every six months and an annual written report to the board. Lenders and insurers push the same questions onto their vendors.
Scroll sideways to see the full table.
| Evidence feed | NYDFS Part 500 | FTC Safeguards Rule | HIPAA Security Rule |
|---|---|---|---|
| External exposure & scanning | 500.5 vulnerability management, automated scans | 314.4(d)(2) assessments at least every six months | 164.308(a)(1) risk analysis |
| MFA coverage | 500.12 MFA for anyone accessing information systems | 314.4(c)(5) MFA | 164.312(d) authentication |
| Awareness training | 500.14 annual training incl. social engineering | 314.4(e) security awareness training | 164.308(a)(5) awareness & training |
| Asset & endpoint inventory | 500.13 asset inventory | 314.4(c)(2) inventory of systems | 164.310(d) device & media controls |
| Backup & recovery | 500.16 incident response & continuity | 314.4(h) incident response plan | 164.308(a)(7) contingency plan |
| Board reporting | 500.4 annual written CISO report | 314.4(i) annual written report | Documented risk management |
Mapping is a guide to where evidence supports each requirement, not legal advice or a certification. The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025 and pointed institutions to NIST CSF 2.0.
Not another security console. The record behind the work.
Enterprise attack surface platforms
Built and priced for large security teams, and they produce technical alerts, not compliance records. Verify keeps the alert's outcome on the record.
Security ratings services
Grade an organization from the outside and tell a client there's a problem. Verify manages the fix through to closure.
Compliance automation tools
Collect control evidence well, but they're built for tech companies chasing SOC 2 and the client has to run them alone. Verify pairs evidence with the managed work.
Straight answers.
What is an Attack Surface Review in Verify?
It's a worklist in Verify, next to Standard and Periodic Review, that tracks each client's cybersecurity posture. It starts with external exposure from scans, such as open ports, services and versions, and adds evidence feeds for training, MFA, endpoints, patching, backups and program documents. Each failed check becomes a finding with an owner, a due date and a documented outcome.
Is this a vulnerability scanner?
No. Verify isn't a new security product. It's a governed record on top of the security tools and scans you already run. The scan is the first evidence feed, and others are added one integration at a time.
Which regulations does it map to?
Findings are mapped to NYDFS Part 500, the FTC Safeguards Rule and the HIPAA Security Rule. Since the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025 and pointed institutions to NIST CSF 2.0, NIST CSF mapping is on the roadmap.
How is this different from a security ratings service?
Ratings services grade an organization from the outside. They tell a client there's a problem, but they don't manage the fix. Attack Surface Review turns each problem into an owned task and keeps the record until the next scan confirms it's closed or the risk is formally accepted.
Is Attack Surface Review available now?
The scan-based worklist is in a pilot program with managed IT clients, with more evidence feeds rolling out through 2027. Ask about joining the pilot.