Evidence before adjectives
Every Critical-to-Low finding carries the observation, evidence, business risk, repair recommendation, control mapping, owner and validation method.
01 · Security exposure map
Map the gaps. Move first.
Security gap assessment, ranked by what an attacker would use first.
A read-only interrogation of configuration and evidence across 38 modules. Each finding arrives with proof, risk, ownership, a repair move and a validation test, sequenced by the route an attacker could exploit, not by alert volume.
flowcraft · exposure mapobservation mode
- FrameSystems, identities and evidence bounded in writingSIGNED
- OpenYour admin grants a time-boxed reader roleMINIMUM
- TraceAI-assisted collection, expert attack-path analysisNO CHANGES
- NavigateRisk-rated findings, named owners and fix sequenceDELIVERED
- ChangeOnly after your written authorisationAPPROVAL GATE
Process illustration only. No client system or data is represented.
The output
A command brief, not a scanner spill.
A sequence your team can execute
Priorities follow exposure, dependency and attack path, not the loudness of the alert. Identity commonly leads because every other control borrows its trust.
Two altitudes of truth
Your operators receive a working findings tracker; management receives a one-page view of business risk, concentration and next moves.
Assessment architecture
38 lenses. 9 attack surfaces. One order of action.
You select the lenses in scope. The fidelity of the map depends on the systems connected, the access granted and the evidence that exists.
- Critical first in line: a plausible route to major compromise
- High material exposure or attack-path leverage
- Medium defensive depth and operating maturity
01Identity and privileged access
Where one credential can become the whole estate6 modules
Active Directory security Critical
Administration tiers, privileged groups, delegation, Kerberos and NTLM exposure, legacy protocols and the paths that connect them to high-value systems.
Entra ID and cloud identity Critical
Conditional Access, identity protection, application consent, guest access and federation examined as one cloud trust fabric.
Privileged access management Critical
Standing administrator rights, PAM and PIM coverage, just-in-time elevation, break-glass accounts, service identities and hardened administration workstations.
MFA and authentication Critical
MFA reach, phishing-resistant methods, legacy authentication and the policy gaps where weaker factors can still pass.
User access review High
Joiner, mover and leaver breaks, orphaned identities, excessive access and segregation-of-duties collisions.
IAM governance Medium
Identity lifecycle, role architecture, service identities and access certification measured for control depth and repeatability.
02Email and internet-facing exposure
The doors an attacker can reach without an invitation4 modules
Email security Critical
Anti-phishing and anti-malware controls, safe links and attachments, SPF, DKIM, DMARC and the bypass rules that can quietly nullify them.
Perimeter firewall Critical
Internet-facing services, NAT, rule hygiene, exposed administration interfaces and the change controls governing the edge.
Secure remote access and VPN Critical
VPN configuration, MFA, device-posture checks, split tunnelling and the practical runway toward zero-trust access.
Web application firewall High
WAF coverage, OWASP-aligned rule sets, tuning quality and the routes traffic can take around inspection.
03Ransomware and cyber resilience
Whether recovery survives the same blast radius3 modules
Ransomware readiness Critical
The full ransomware path tested on paper: initial access, privilege, lateral movement, backup reach, detection and recovery time.
Backup and cyber resilience Critical
Coverage, immutability, separation from production credentials, restore evidence and alignment with stated RTO and RPO targets.
Incident response readiness High
Plans, decision rights, investigative logging, evidence handling and readiness to rehearse the response at tabletop.
04Endpoint and server
The terrain where intrusion becomes persistence3 modules
Endpoint and EDR High
Sensor coverage, policy fractures, tamper protection, attack-surface-reduction rules and readiness to contain from the console.
Server and OS hardening High
Baseline alignment with applicable CIS Benchmarks, patch posture and the reach of local administrator access.
Vulnerability prioritisation High
Risk-led ordering through known-exploited catalogues, EPSS, internet reachability, asset criticality and attack-path context.
05Cloud and Microsoft 365
Where shared responsibility often becomes shared ambiguity6 modules
Microsoft 365 security High
Secure Score, Defender for Office 365, Purview, external sharing and audit configuration read beyond the headline score.
Azure security assessment High
Subscriptions, RBAC, Azure Policy, network exposure, Key Vault, Defender for Cloud and logging against the Microsoft Cloud Security Benchmark.
AWS security assessment High
IAM, organisations and SCPs, VPC exposure, S3, KMS, CloudTrail and GuardDuty against the AWS Well-Architected Security Pillar.
Google Cloud security assessment High
Resource hierarchy, IAM, VPC, storage, KMS and logging against Google Cloud Enterprise Foundations.
Cloud security posture (multi-cloud) High
One view of identity, network, data and logging gaps across every cloud you run, with CSPM findings ranked by exposure.
Database security Medium
Database access, encryption, auditability, network exposure and platform hardening examined as a single data trust boundary.
06Virtualisation
The layer beneath every server4 modules
VMware vSphere and ESXi security High
vCenter and ESXi hardening, lockdown mode, admin access, management network isolation and patch level.
Microsoft Hyper-V and SCVMM security High
Host hardening, administrative separation, shielded VMs, replication and management access.
Nutanix AHV and Prism security High
Prism access, cluster hardening, STIG alignment, encryption and management-plane isolation.
Citrix Virtual Apps, Desktops and NetScaler High
NetScaler exposure and patch level, delivery controller access, session policies and the gateway as an internet-facing door.
07Network and segmentation
Converting one foothold into a contained event3 modules
Core and internal firewall High
East-west policy, inter-zone rules and least privilege between segments.
Network segmentation High
Zones, micro-segmentation, VLAN and ACL design, and whether trust boundaries exist in configuration as clearly as on diagrams.
Network access control Medium
802.1X, guest and BYOD isolation, admission policy and wireless security at the point a device joins.
08Data protection
Making sensitive information difficult to misplace1 module
Data protection and DLP Medium
Classification, DLP policy, encryption and key management traced from declared sensitivity to enforced behaviour.
09Security monitoring and SOC
Turning telemetry into time to act8 modules
SIEM and SOC assessment Medium
Log-source coverage, use-case quality, alert fidelity, SOAR, retention and ingestion economics assessed as one detection system.
Source logging configuration gap High
Whether the systems that matter are actually generating the audit events an investigation would need.
Log source onboarding validation Medium
Every expected source confirmed as arriving in the SIEM, on time, from every in-scope host.
Log payload and parsing quality Medium
Fields parsed, normalised and usable by detections, not stored as unreadable text.
Detection engineering review Medium
MITRE ATT&CK coverage, rule logic, tuning discipline and test evidence, because a detection that never fires is only documentation.
Detection validation Medium
Agreed, harmless test events run in a controlled window to confirm that priority detections fire and reach an analyst.
Threat hunting Medium
Hypothesis-led, ATT&CK-mapped hunts across existing telemetry, with what is learned engineered back into durable detections.
Log retention and cost Medium
Retention against investigation and regulatory needs, and ingestion spend against detection value.
Access geometry
Visibility sized to the question. Authority held to the minimum.
| Permission band | Purpose | Grant pattern |
|---|---|---|
| ROObservation | Every assessment lens; configuration remains untouched. | Your administrator grants reader or security-reader roles, or supplies configuration exports, for the defined assessment window. |
| EDDocument edit | Named policy, standard and audit-document revisions. | Edit rights apply only to identified documents, with tracked changes and your approval retained in the record. |
| RWIntervention | Remediation only, after you approve both the finding and the change plan. | A separate, time-boxed administrator grant, such as PIM activation, for the named systems and approved change window. |
No agent is installed on your systems: FlowCraft AI runs on our side and works through the access you grant. Your data stays on your systems. Timing follows the selected scope and is fixed in the written proposal; the clock begins only after access is confirmed. How remote delivery works.
Framework translation
One exposure map. Many reporting languages.
- EnterpriseNIST CSF 2.0
- Mapping by control IDISO/IEC 27001:2022
- PrioritisedCIS Controls v8.1
- ControlsNIST SP 800-53
- Threat-informedMITRE ATT&CK
- DefensiveMITRE D3FEND
- CloudMicrosoft Cloud Security Benchmark
- CloudCSA CCM
- PaymentsPCI DSS v4.0.1
- AssuranceSOC 2
- AINIST AI RMF
- AI managementISO/IEC 42001
- SOC maturitySOC-CMM
- European UnionEU NIS2
- EU financialEU DORA
- EU and UK privacyGDPR
- United KingdomNCSC CAF
- GCCUAE IA Standard V2
- GCCNCA ECC
- GCC bankingSAMA CSF
- US healthcareHIPAA
- AustraliaASD Essential Eight
Start where trust concentrates.
Identity, email and recovery usually reveal the first decisive moves. Tell us what you operate and where confidence thins; we will propose the right assessment boundary.