01 · Scope
Scope and boundary
We agree the systems, environments, data types, review period, and exclusions in writing before any evidence is collected, with a stated reason for each exclusion.
DSE Cybersecurity · Technical security assessment
Stop measuring scan volume. Rank what actually matters.
A point-in-time advisory review and design of your vulnerability management program: whether the findings that matter get to a named owner, get prioritized by real risk, and get closed inside an agreed window. We assess the program, not the scanner, and hand you a design and roadmap a named owner can run.
For the leader who owns the vulnerability program. Advisory and program-design work. DSE does not run scans. Not an audit, not a certification, not a penetration test.
Named methodology
Design the program, not the scan.
The Vulnerability Management Program Design Method follows DSE's bounded-evidence assessment method: a bounded evidence request, focused interviews, a business-context severity rating, and a roadmap with named owners. The lane-specific layer is a program map covering asset coverage, prioritization logic, ownership and routing, remediation windows and exception handling, and the closure evidence that shows whether the loop closes.
02 · Evidence
Bounded evidence request
A defined request for client-provided exports, screenshots, screen shares, and documents. We do not request administrator credentials and we do not run automated scans.
03 · Interviews
Focused interviews
Short, targeted conversations with the people who own the controls, to test how the design actually operates rather than how a diagram says it should.
04 · Rating
Business-context severity
We rate each observed gap by likelihood and business impact, and record evidence strength alongside it. Severity is a business-context rating, not a vulnerability score, and the method is explained in the report.
05 · Findings
Evidence-linked findings
Each finding states what we observed, why it matters, the supporting evidence, the recommended action, and a named accountable owner.
06 · Roadmap
Roadmap with named owners
Immediate actions and a sequenced roadmap that balances risk reduction, dependencies, effort, and cost, with named owners and an executive readout for leadership.
Typical timebox: 2 to 4 weeks after kickoff and timely evidence access. Larger, multi-environment, or high-complexity engagements are scoped separately. Fees are scoped after the diagnostic and confirmed in writing before work begins.
Evidence reviewed
What we review, and what we do not run.
We assess client-provided asset inventories, existing scan and finding reports you already hold, prioritization and SLA policy documents, ticketing and remediation workflow exports, exception and risk-acceptance records, and program metrics, supplemented by screen shares of the workflow in practice.
DSE does not operate scanners, does not run automated scans, and does not request administrator credentials. We review the program and the evidence it produces; scanning and remediation execution are scoped separately in writing and named no vendor here.
Deliverables
Named artifacts. Not a slide deck.
01
Program maturity assessment
Your current program mapped against a defined target across coverage, prioritization, ownership, remediation windows, and closure evidence, with the evidence produced for each.
02
Asset coverage gap analysis
Where the asset inventory and scan coverage disagree, so findings on unknown or unscanned assets stop hiding in the gap.
03
Prioritization and SLA design
A risk-based prioritization model and remediation windows sized to your environment, so severity drives sequence rather than scanner defaults.
04
Ownership and routing model
A routing and accountability design that gets each finding to a named owner, with exception and risk-acceptance handling defined.
05
Metrics and closure-evidence pack
The small set of metrics that show whether the loop closes, and closure evidence in a form you can put in front of a board or an insurer.
06
Prioritized program roadmap
Immediate actions and a sequenced maturity roadmap balancing risk reduction, dependencies, effort, and cost, with an executive readout.
Sample output
A program scorecard leaders can act on.
Synthetic sample — not client data. It contains no client information and is not a finding about any organization.
The sample table scrolls horizontally on smaller screens. Keyboard users can focus the labeled table region and use horizontal navigation.
| Program area | Observed evidence | Severity | Recommended move |
|---|---|---|---|
| Asset coverage | The asset inventory and the scan target list differ by a material share of production hosts. | High | Reconcile the two sources, assign inventory ownership, close the coverage gap. |
| Prioritization | Findings are worked by raw scanner severity with no business-context or exposure weighting. | Moderate | Adopt a risk-based model that weights exposure and business impact. |
| Closure evidence | Remediation is tracked in tickets, but there is no metric showing time-to-close against the SLA. | Moderate | Add a time-to-close metric per severity and report it to a named owner. |
Final ratings depend on the program, the evidence, and the agreed method. We do not convert findings into a purported certification score.
Frameworks referenced
Framework structure, no vendor claims.
We organize the program against NIST CSF 2.0 and reference CISA's Cross-Sector Cybersecurity Performance Goals as a supporting baseline for essential hygiene. These frameworks shape how we describe outcomes; they do not make this an audit, and we name no scanner or vendor as a capability claim.
How the work is delivered
Accountable delivery, disclosed clearly.
DSE delivers through documented in-house expertise and qualified specialists from our expert network, selected for the technologies and risks in scope. DSE remains accountable for scope, quality, integration, and outcomes. Where specialist or partner delivery is involved, we disclose that role clearly.
Accountable owner: DSE delivery leadership.
Clear boundaries
Program design, not assurance.
This is a point-in-time assessment of the vulnerability-management program, workflow, and evidence in the agreed scope. It is not legal advice, not an audit, not a certification, and not an attestation. It does not guarantee compliance or any enforcement or examination outcome. It does not make your organization secure and does not prevent, detect, or reduce the likelihood of any security incident; it documents risk against a defined scope at a point in time. DSE does not operate a 24/7 security operations center, does not provide continuous monitoring or managed detection and response, does not perform live incident response or digital forensics and incident response (DFIR), does not run penetration tests, and does not resell licenses. Where you need any of those, we help you scope the requirement and select a provider you contract directly. Remediation implementation is performed only where it is separately scoped in writing. Counsel, auditors, and assessors retain their respective roles.