Security Pulse - Continuous Monitoring of Your External Attack Surface

What Does the Internet Know About Your Company?

The problem:
Your organization is more visible on the internet than you might like. Web servers here, mail servers there, and in between cloud services, test systems, and legacy applications that nobody remembers anymore.
Attackers use automated scanners or AI and quickly and reliably find open doors.
At the same time, ISO27001, NIS2, and even end customers are increasingly demanding evidence of regular security reviews.
But where do you start when you don't even know what is visible on the internet in the first place?

The solution:
Security Pulse. Regularly repeated OSINT and attack surface checks that systematically map your external attack surface. Automated, reproducible, and prepared in easy-to-understand reports. No tool overkill that someone has to learn to operate first, no reports that nobody reads.
What you get are prioritized risks, clearly formulated action recommendations, and the support of an experienced security expert in regularly scheduled review meetings.

Security Pulse Explained in One Sentence

Security Pulse is an automated vulnerability and threat management service (also known as attack surface monitoring and threat management) with expert guidance from an experienced security professional for correct risk assessment and the formulation of prioritized action recommendations.

The Three Service Tiers

The service is available in three tiers.

Recon: What does the internet know about us?
The starting point is the root domains of your organization. In purely passive mode (OSINT), Security Pulse identifies all discoverable subdomains and maps and deduplicates the associated IP addresses. Without a single point of contact with your systems, an honest picture emerges of what the internet knows about your company - the first step towards a solid overview.

Surface: How exposed and exploitable are we?
Building on the recon results, the discovered assets are actively scanned: Which ports and services are reachable from the outside? Each port is matched against a baseline security policy and reported in the port compliance report. This answers the question of whether your IT could be exploited by common automated attacks - the typical starting point for attackers targeting small and medium-sized businesses.

Audit: For compliance, evidence, and reputation
The Audit tier is the next level for customers with compliance requirements and documentation needs. You receive everything from Recon and Surface, prepared to audit level, including in-depth information on the public reputation of your domains and IP addresses. Ideal if you need evidence for an ISO27001 ISMS, for NIS2 compliance, or for customer requirements.

Service Description

Security Pulse comes with some special features:

Port Compliance Based on the Approval Principle
"If something is going to communicate with the internet, it must be justified and approved."
This is the principle many CISOs and information security officers work by - and that is exactly what Security Pulse implements. The default is: all ports are initially forbidden. The report lists every open port as "approved", "exception defined", or "approval pending". Which communication is legitimate is clarified in our recurring review meetings. Approved ports are then listed as "approved" going forward and no longer show up as a deficiency. This way, a reliable approval documentation grows with every check.

Detecting New Assets: The DIFF
Each check is compared with previous ones. If assets appear that were not visible in earlier checks, this is a warning sign: It can point to misconfigurations or even shadow IT. Especially when your own change management is patchy, the DIFF is often the most reliable early warning. And the other way around: what disappears, disappears verifiably.

Automated, Recurring, Extensible
After setup, the checks run fully automatically at regular intervals, e.g. weekly or monthly. On request, the checks can be extended with active vulnerability scans (e.g. with OpenVAS or Nmap) or with the inspection of WordPress installations (WPScan) - the results flow integrated into your reports.

Delivery
The reports are compact, static HTML documents - clearly structured, readable offline, and easy to interpret without specialist knowledge. They are delivered as a ZIP file or, on request, via a secured web server.

Infrastructure, Privacy, and Compliance
The checks run on dedicated, self-administered infrastructure in Germany. Everything is contractually and legally watertight (data processing agreement in place), and the processes are ISO27001-compliant. With a certified ISO27001 Lead Auditor and Data Protection Officer at your side, you can rest assured: there is no compliance stress here - on either side of the table.

Optional Add-On: Intrusion Detection & Monitoring
As a next step after the regular checks, keep your cyber security in view: I support your IT department in building a comprehensive monitoring solution with modern open-source tools such as Wazuh (SIEM), Grafana, or Icinga (monitoring) for intrusion detection and alerting in the event of an incident.
This add-on service is not part of the tiers but can be commissioned modularly and billed by effort as needed.

Target Group, Prerequisites, and Effort

• Target group:
• Small and medium-sized businesses, especially those with compliance requirements (ISO27001, NIS2, customer requirements)
• Prerequisites:
• Contractual safeguards for the service: data processing agreement, non-disclosure agreement, and service contract.
• Effort:
• Depends on the tier, the number of domains, and the check frequency.
• We will be happy to clarify this in a free initial consultation.

Your Benefits

Further Information

Would you like a free initial consultation or personal advice?
A simple inquiry is all it takes!
Call me at: 06423 963 410 or write to: info(at)vangestel.de