VULNERABILITY AND POSTURE
What is weak?
Thousands of findings, no order
PORTFOLIO EXPOSURE MANAGEMENT · BUILT FOR THE AI ERA
Know what you stand to lose. Then don't lose it.
If you are lucky enough to have a cybersecurity budget, your tools will tell you what processes are broken, which regulations you are not compliant with and what kind of phishing your employees fall for. None of them tell you what to prioritise based on what your company might actually lose. We model your real estate, small startup or big enterprise, and cut through the noise. For free. Well, sort of.
HOW WE CUT THROUGH YOUR NOISE AND BRING YOU THE CLARITY YOU NEED MODEL CURRENT
In our model, we want to simplify but also make sure we have a clear exposure based view of what is urgent and what is important, because these two are actually not the same.
THIS WEEK · 169 IN, 1 OUT
26
ASSETS ON RECORD
16
DATA FLOWS BETWEEN THEM
4
POTENTIALLY CRITICAL
9
STILL UNCLAIMED
2.1M
CUSTOMER RECORDS HELD
169 NEW VULNERABILITIES published this week for software you run
24 REACHABLE an attacker could actually get to them here
4 IMPORTANT money loss risk, ranked by how much
1 URGENT TOO clock already running on this one
ANNUALISED LOSS · MEAN
$5.61M
Money you would actually lose to cyber incidents in a typical year: downtime, recovery, fines, notification, lost customers. Not what security tooling costs you, and not a worst case.
2 vulnerabilities being exploited right now $1.18M HAPPENING
No strong sign-in on admin accounts $1.01M NO CLOCK
No password manager $0.84M NO CLOCK
No device management (MDM) $0.71M NO CLOCK
No disaster recovery plan $0.53M LOSS COULD BE TOTAL
DO THIS ONE FIRST
Patch the two servers being exploited right now
Three days, half a person, and it takes $1.18M off the table. Nothing else on the list is already happening.
The assessment is easier if you bring a diagram and some prior knowledge of the company and product, or at least a description. We can also connect to your tools, if you are not scared. We will sign an NDA if need be.
THE PART NOBODY SELLS YOU
Every tool shows you something very confidently. But do you know what to prioritise?
So you have CrowdStrike, Okta and Tenable (you're a lucky CISO). All of them need a team of ten to run through every alert and possible scenario. How do you know what to prioritise? And why, and with what money?
ATTACK-PATH PLATFORMS
What can be reached?
Real-time threats and exposure points
RISK QUANTIFICATION
What could it cost?
A number, disconnected from the fix
GRC PLATFORMS
What can we prove?
GRC evidence is stale by design
What should we do now, and what will it change?
HOW IT ACTUALLY WORKS
We make a bespoke model you can use, defend and budget for in a smart way.
The idea behind this platform is that we want to use the power of AI and computational knowledge to create a (safe) space you can actually use to orchestrate your entire security program and actually mature it as your company grows (or shrinks - but still your choice)
01 · OBSERVE
Read the estate
Bring a diagram or connect what you run. We propose what we found; you approve or reject each one.
02 · MODEL
Follow the money
Routes, threats and controls get wired to the parts of the business that make a tasty target for hackers.
03 · SIMULATE
Price the options
We give you options depending on your budget, compared on loss removed, effort and cost.
04 · COMMIT
Someone signs it
A person decides, with a reason. Then we play tag with whoever is the poor soul assigned to fix it, until the number moves.
WHY NOW · THE BORING ANSWER
You do not need another alert. You need a decision by Thursday.
It's the end of the world as we know it, and it matters that you cut through the noise of agents and everyone telling you to ACT NOW, and focus on your own assets instead. Everyone has started talking with unearned authority, so we want to help, with the backing of over 30 years of experience in security.
Attackers got faster
Reconnaissance, vulnerability research, phishing and sorting through stolen data are all cheaper than they were. Your time-to-decision has to come down with them.
Software now acts
Agents plan, call tools and cross systems using delegated identities. Those permissions and data flows are assets. Most estates have no idea how many they have.
Estates change weekly
New AI services, automations and citizen-built workflows appear faster than any annual assessment can write them down.
Documents are free now
Anyone can generate a policy in a minute. What is left as evidence of security is provenance, observed control state and a history of real decisions.
RESEARCH BASIS FAIR: FACTOR ANALYSIS OF INFORMATION RISK ↗NIST SP 800-30 RISK ASSESSMENTS ↗NIST CSF 2.0 ↗
HOW WE ACTUALLY USE AI
AI will scan, recommend, propose and help. You will still need to do the thinking. Don't be a meat proxy!
Yes, we use AI, and no, it does not get a vote. It is brilliant at reading your messy diagrams and hopeless at understanding your actual estate and the intricacies of your business by itself, so that is all we let it do. The maths is reproducible and you can take it apart.
AI / INTERPRETS
Reads the messy stuff.
Diagrams, free text, findings and feeds turn into candidate assets, flows, scenarios and actions, as drafts, in a queue.
ENGINE / CALCULATES
Does the arithmetic.
Routes, assumptions, loss distributions and intervention deltas, all decomposable and reproducible. You can take it apart.
HUMAN / DECIDES
Owns the consequence.
You approve, edit or reject, and your name sits on the reason, the timing and the residual you accepted.
FOUR AUDIENCES, ONE MODEL
Data doesn't have to be reconciled. We hand it over perfectly conciled and all.
Whether you need it for your board meeting, for an auditor knocking at your door, or for a client who really, really wants to know, we help you compile it for all tastes and backgrounds.
BOARD / CEO
How exposed are we?
You speak numbers, we speak numbers. Instant win!
CISO
Which move is worth it?
The budget you get is never the budget you wanted, and that will forever be your curse. At least this ranks what the money you do get should buy.
CTO / PRODUCT
What breaks my roadmap?
You should know your crown jewels and be able to defend them. Ransomware lands while your CISO writes policies and you decide which AWS services to cut for Codex tokens, and then who are you gonna call? Ghostbusters, probably.
AUDIT / RISK
Can we defend this?
Without evidence, what are we? Unregulated? You need a way to prove your programme to everyone (and their mothers).
FREE GRC
You do the actual security work. We help you prove it works.
We could sell you compliance software and stop there. We could be, we just don't want to. The same control state, evidence, owners and decisions map across ISO 27001, SOC 2, NIST CSF, GDPR, NIS2, DORA and CER, because you did the work, not because you lied on your audit (wink).
INCLUDED AT NO EXTRA LICENCE COST
HOW THE PAPERWORK GETS WRITTEN, IN THREE STEPS
Do the work
CONTROL · OWNER · EVIDENCE · VERDICT
State is observed, not claimed
CURRENT, OWNED AND TRACEABLE
We compile the paperwork
FRAMEWORKS · AUDIT · BOARD · REGULATOR
ARGUE WITH US
You should be able to disagree with our number.
So we wrote this huge paper that only Marcello fully understands and Ioana nods along to, but the short version is: we found a way to compute cost using models that already exist, like FAIR and Monte Carlo. Only read it if you are a nerd, nerd.
READ THE EXPOSURE FORMALISM ↗BEFORE YOU BOOK ANYTHING
Viezure is probably wrong for you if:
01
You have fewer than about twenty assets
A spreadsheet and an afternoon will get you most of the way. Come back when the estate stops fitting in your head.
02
You need a certificate by Friday
We produce evidence as a by-product of real work. If the only goal is the badge, a pure compliance tool is faster, and we can recommend some good ones.
03
Nobody is allowed to decide anything
You don't do the work of making sure people are accountable, or you work somewhere that still doesn't understand in 2026 why security matters. In which case, we might be hiring!