Four times a year we scan your Microsoft 365 tenant and your office network for vulnerabilities, and fix what we find. Once a year, a person tries to break in. Everything is measured against the CIS Controls.
Scanning finds the weaknesses that attackers look for first: missing patches, risky settings, and exposed systems. We run it every quarter on your Microsoft 365 tenant and your local network, then remediate what we find, so the list gets shorter every round.
A person tries to break in, the way a real attacker would, to prove which weaknesses can actually be used against you. Then we fix what the test turns up. It’s the difference between a list of problems and knowing which ones matter.
We install scanning software on your local network. It also connects to your Microsoft 365 tenant, so both are covered in the same round.
It tests for vulnerabilities. The checks follow the CIS Controls, the standard our engineers built this service around.
Our vulnerability assessment agent reviews what it finds. The agent was built and defined by our project engineers. It sorts what matters from what doesn’t, and decides what to look at next.
We remediate what we find. We patch, reconfigure, and close the gaps. We don’t hand you a report and leave.
You get the results. A report of what we found, and what we fixed.
We can’t hand a penetration test to an AI agent, and we don’t. The agents define what we should look for. A person then does the testing, guided by what the agents found, and checks each weakness by hand.
From there, the same engineer does the assessment and fixes any patching issues that come out of it. That completes the vulnerability assessment.
Managed Services is the core. It covers many of the controls day to day. Penetration Testing and Vulnerability Managed Services is the add-on that tests them, every quarter and once a year.
| Core | Penetration testing and vulnerability management (add-on) | ||
|---|---|---|---|
| What we check | Managed Services | Quarterly vulnerability management | Annual penetration test |
| Know what you have | |||
| Every computer, phone, and device on your network | Covered | Covered | Not covered |
| Every program running on them | Covered | Covered | Not covered |
| Protect your data | |||
| Where sensitive data lives, and who can reach it | Covered | Not covered | Covered |
| Getting data back after a loss | Covered | Not covered | Not covered |
| Lock down settings and access | |||
| Settings that match a secure baseline | Covered | Covered | Covered |
| Accounts: who has one, and whether they should | Covered | Covered | Covered |
| Who can get into what | Covered | Covered | Covered |
| Find and fix weaknesses | |||
| Missing patches and known vulnerabilities | Covered | Covered | Not covered |
| Weaknesses in your websites and applications | Not covered | Covered | Covered |
| A person trying to break in | Not covered | Not covered | Covered |
| Block attacks | |||
| Bad email and risky web browsing | Covered | Not covered | Not covered |
| Viruses and ransomware | Covered | Not covered | Not covered |
| Switches, firewalls, and network equipment | Not covered | Covered | Covered |
| Spotting an attack as it happens | Covered | Not covered | Covered |
| Watch and respond | |||
| Records of who did what | Covered | Not covered | Not covered |
| Having a plan, and acting on alerts | Covered | Not covered | Not covered |
| People and partners | |||
| Training people to spot attacks | See Training | Not covered | Not covered |
| Managing the vendors who touch your data | Covered | Not covered | Not covered |
| Core | Penetration testing and vulnerability management (add-on) | ||
|---|---|---|---|
| CIS Controls v8.1 | Managed Services | Quarterly vulnerability management | Annual penetration test |
| Know what you have | |||
| CIS 1: Inventory and Control of Enterprise Assets | Covered | Covered | Not covered |
| CIS 2: Inventory and Control of Software Assets | Covered | Covered | Not covered |
| Protect your data | |||
| CIS 3: Data Protection | Covered | Not covered | Covered |
| CIS 11: Data Recovery | Covered | Not covered | Not covered |
| Lock down settings and access | |||
| CIS 4: Secure Configuration of Enterprise Assets and Software | Covered | Covered | Covered |
| CIS 5: Account Management | Covered | Covered | Covered |
| CIS 6: Access Control Management | Covered | Covered | Covered |
| Find and fix weaknesses | |||
| CIS 7: Continuous Vulnerability Management | Covered | Covered | Not covered |
| CIS 16: Application Software Security | Not covered | Covered | Covered |
| CIS 18: Penetration Testing | Not covered | Not covered | Covered |
| Block attacks | |||
| CIS 9: Email and Web Browser Protections | Covered | Not covered | Not covered |
| CIS 10: Malware Defenses | Covered | Not covered | Not covered |
| CIS 12: Network Infrastructure Management | Not covered | Covered | Covered |
| CIS 13: Network Monitoring and Defense | Covered | Not covered | Covered |
| Watch and respond | |||
| CIS 8: Audit Log Management | Covered | Not covered | Not covered |
| CIS 17: Incident Response Management | Covered | Not covered | Not covered |
| People and partners | |||
| CIS 14: Security Awareness and Skills Training | See Training | Not covered | Not covered |
| CIS 15: Service Provider Management | Covered | Not covered | Not covered |
Plain-English results, no control numbers.
Based on the CIS Critical Security Controls, version 8.1. A dash means that control isn’t part of these services today. Security awareness training is covered on the Training page. Ask us how your system lines up.
The CIS Controls (version 8.1) are a prioritized list of 18 controls, made up of 153 specific safeguards, that a security team can actually check one by one. Our engineers built our vulnerability assessment around them.
You may know the NIST Cybersecurity Framework better. The two work together: NIST CSF describes the outcomes you want, such as identify, protect, detect, respond, and recover. The CIS Controls spell out the specific things to do and check to get there, and CIS publishes a mapping between them. So our results line up with whichever one your auditors or insurer ask about.
You don’t need Xerillion for anything else. If you want your Microsoft 365 tenant and your network tested, and the findings fixed, we can do just that.
If we already manage your Microsoft 365 system, this is the add-on that tests it. Managed Services is the core of how we work with you, and this service builds on it.