Intelligence-led vulnerability management · Defence, CNI & Regulated IndustryA scan of your estate returns thousands of findings. Picket tells you which few are most likely to be used against you, and leaves a record you can hand an assessor, a prime or an insurer.
Most organisations come to us because somebody external has started asking.
Defence Cyber Certification
Def Stan 05-138 scales with your Cyber Risk Profile rather than setting one bar. From Level 1, vulnerability management, patch management and monitoring are in scope, and an assessor will want to see them evidenced.
Where do we stand, and what would we hand an assessor?
Twelve questions that tell you which level you need →NCSC Cyber Assessment Framework, B4 and C1
Outcome B4.d asks you to understand your exposure to publicly-known vulnerabilities and to prioritise and promptly mitigate them. Principle C1 asks you to detect and triage what matters. Both are evidence questions before they are engineering questions.
Can we show a year of it, in the framework’s own words?
Twelve questions on the outcomes you are assessed against →The questions on your renewal proposal form
Insurers can ask how often you scan your perimeter and how quickly you patch. A dated document is worth more than an assertion at renewal, and far more after a claim. A Recce gets you one inside a week.
Can we answer the form with evidence rather than an estimate?
What a Recce gives you →Nothing is scanned until you have authorised it in writing, under a signed scope naming the assets and the window.
Wherever the question came from, the first step is the same.
Book a free scoping call →Picket is run by people who did this work inside government. Ben Brand ran the MOD’s Vulnerability Management Support Team for over two years, after ten years in the Intelligence Corps. James A. Lang retired a Warrant Officer Class 1, Royal Signals, and was appointed the MOD’s first AI Cybersecurity Product Manager.
If your MSP or your own team already scans and patches, Picket does not replace them. It ranks what they and we find against what is actually being used against organisations like yours.
Ranked on severity alone, the curl flaw would sit near the top. Here it comes last: lower exploit probability, on a build server that matters less to the business. The Citrix flaw is less severe on paper, but its exploit probability is above 99% and it sits on the gateway everyone signs in through.
| Pri | Finding | Asset | CVSS | EPSS | Exploited | Status |
|---|---|---|---|---|---|---|
| 91 | FortiOS SSL VPN: out-of-bounds writeCVE-2024-21762Analyst: exploited in the wild (CISA KEV, graded A1). This is the VPN every remote user comes through. Upgrade to a fixed FortiOS release this week, or turn off SSL VPN until you can. | vpn.example.comcriticality: critical | 9.8 | 83% | CISA KEV | Open |
| 91 | Citrix NetScaler: session token disclosureCVE-2023-4966 | gateway.example.comcriticality: critical | 7.5 | >99% | CISA KEV | In progress |
| 89 | PHP-CGI: argument injectionCVE-2024-4577 | legacy.example.comcriticality: medium | 9.8 | >99% | CISA KEV | Open |
| 88 | OpenSSH: sshd race conditionCVE-2024-6387 | sftp.example.comcriticality: high | 8.1 | >99% | none known | Fixed |
| 77 | SSH: prefix truncation (Terrapin)CVE-2023-48795 | sftp.example.comcriticality: high | 5.9 | 94% | none known | Accepted |
| 74 | curl: SOCKS5 heap overflowCVE-2023-38545 | build.example.comcriticality: low | 9.8 | 78% | none known | Open |
Every step is fixed in scope and leaves you with a dated record.
Picket Recce
Fixed fee, one day
Founding rate · first five clients
Book a free scoping call →Read about the Recce →Picket Assessment
Fixed fee, four weeks
Picket Continuous
Monthly retainer
Picket Annual
Fixed fee, yearly
