0
vulnerabilities catalogued in the public record
Source: NVD. Placeholder, replace before launch
Attack surface management platform
The attack surface management platform.
Find what's exposed. Fix what matters first.
CloudKey monitors your attack surface continuously and tells your team what to fix first. Every finding is backed by evidence, not noise.
Live KEV feed, synced 2h ago
The problem
Every month your attack surface grows and thousands of new vulnerabilities land. Almost none of them put your business at risk. Finding the few that do, and the exposures that come with them, is the real work.
0
carry confirmed evidence of active exploitation
Source: CISA KEV. Placeholder, replace before launch
0
vendor advisories published every year
Source: vendor advisories. Placeholder, replace before launch
Our approach
How we rank thousands of advisories into what to fix this week.
Six rules behind every CloudKey output. Scroll through them, or jump.
Services and products
Seven capabilities. Four layers of defense. One partner.
Attack surface management across four layers: see what's exposed outside and inside, verify what holds with penetration testing and cloud posture assessment, control privileged access, and build the ISO 27001 management system auditors recognize, with evidence on every finding.
Layer 01 . Visibility
Know what's exposed, outside and inside.
DarkWeb Report shows the view an attacker has of your domain. VulnMonitor reconciles every advisory against the equipment you actually run.
DarkWeb ReportVulnMonitor
Layer 02 . Verification
Prove your defenses hold.
Security Audit measures posture against CIS Benchmarks. Penetration testing runs adversarial scenarios, external and internal scope, RoE-gated, with re-test included. Cloud security services review AWS, Azure and GCP posture against best practice.
Security AuditPentestCloud Security
Layer 03 . Control
Lock down privileged access. Trace every action.
PAM vaults privileged credentials, records every session, and gives auditors a full trace of who touched which server and when.
PAM
Layer 04 . Governance and compliance
Build the management system auditors recognize.
ISO 27001 consulting takes you from where you are to certification-ready: gap assessment against the standard, ISMS build support, and hands-on prep through the certification audit.
ISO 27001
- Visibility DarkWeb Report . VulnMonitor
- Verification Security Audit . Pentest . Cloud Security
- Control PAM
- Governance ISO 27001
01 . Visibility, external
DarkWeb and external exposure report
The view an attacker has of your business. A monthly scan of your domain pulls leaked credentials from breach corpora, exposed subdomains, open ports on internet-facing IPs and vulnerabilities on edge services, ranked into one executive risk score.
- Leaked passwords cross-checked against known breach databases
- Subdomain discovery and external attack-surface inventory
- Open ports and vulnerabilities on internet-facing services
02 . Visibility, internal
Continuous vulnerability monitoring
The view from inside your perimeter. VulnMonitor reconciles every advisory against your real equipment inventory, servers, network gear, endpoints, applications, and surfaces zero-day exposure the moment an advisory drops, not when the CVE lands days later.
- Zero-day exposure surfaced before a CVE is issued
- AI predicts 30-day exploit likelihood; confirmed-exploited CVEs auto-promote
- Compliance evidence auto-populated for ISO 27001, SOC 2, NIST CSF and NIST 800-53
03 . Verification, posture
Security audit
A structured review of your production systems against CIS Benchmarks, every gap documented, owned by a named person, and given a remediation estimate.
- Production hardening against CIS Benchmarks
- Identity and access reviewed, exceptions documented
- Remediation roadmap with effort estimates
3/7
Controls passing
- Disk encryption enforced on all endpoints Pass
- MFA required for every privileged account Fail
- SSH root login disabled on production hosts Pass
- Password policy meets benchmark length Partial
Illustrative checklist, not a live system. Your audit reports your own controls against the CIS Benchmark profile in scope.
04 . Verification, adversarial
Penetration testing
Scoped, authorized testing of your web apps, APIs and network, external and internal scope. Every engagement opens with a signed Rules of Engagement and closes with reproducible, prioritized findings.
- Signed Rules of Engagement before any active test
- Findings with reproduction steps and evidence
- Fixes re-tested, attestation included
High
Aggregate risk
- Account takeover via chained auth bypass (app.example.com) Critical
- Broken object-level authorization on /api/v1/orders Critical
- SQL injection in legacy search endpoint High
- Exposed admin panel on internet-facing host High
Each finding ships with reproduction steps, evidence and a re-test. Illustration only.
05 . Verification, cloud posture
Cloud security services
An assessment of your AWS, Azure and GCP environments against cloud best practice. Misconfigurations, over-broad permissions and exposed services surfaced, ranked and handed back as a prioritized plan to harden posture and keep it hardened.
- Posture review against the cloud benchmark in scope, CIS or Well-Architected
- IAM, public exposure and key services reviewed across accounts
- Prioritized remediation roadmap with effort estimates
8/14
Controls passing
- Object storage buckets publicly readable Fail
- Root account MFA enforced Pass
- IAM users with admin privileges and no MFA Fail
- Default VPC security group open to 0.0.0.0/0 Partial
Illustrative posture findings. Your assessment reports your own accounts against the cloud benchmark in scope.
06 . Control, privileged access
Privileged access management
Vault privileged credentials, record every privileged session, and grant access just-in-time, with a full trace of who touched which server and when, mapped to the controls your ISO 27001 and SOC 2 auditors read.
- Credentials vaulted, every privileged session recorded
- Just-in-time access and full traceability per server, per user
- Plugs into your existing directory and identity provider
07 . Governance, ISMS
ISO 27001 consulting and readiness
From where you are to certification-ready. A gap assessment against ISO/IEC 27001, a practical plan to close what is missing, and hands-on support through the certification audit. We prepare you; an accredited registrar issues the certificate.
- Gap assessment against ISO/IEC 27001 and Annex A controls
- ISMS build support, policy stack and risk treatment plan
- Internal audit and hands-on prep through the certification audit
58/93
Annex A implemented
- A.5.1 Policies for information security Implemented
- A.5.15 Access control Implemented
- A.6.3 Security awareness training In progress
- A.8.8 Management of technical vulnerabilities Open gap
Illustrative gap analysis against ISO/IEC 27001:2022. Your readiness review reports your own ISMS against the Annex A controls in scope.
By the numbers
Four numbers that map to the seven things CloudKey covers.
Security is not one chart. Each number below is the kind of risk one of our services is built to close.
-
01 . External exposure
0 B+
Credentials sitting in public breach corpora today.
If staff reuse passwords, this is the first well attackers draw from. DarkWeb Report cross-checks your domains against breach databases every month and flags the hits before they become an incident.
DarkWeb ReportSource: aggregate breach corpus counts (Have I Been Pwned and similar). Placeholder, replace before launch
-
02 . CVE volume
0 +/yr
New vulnerabilities published every year.
About 110 advisories hit the NVD catalog daily. VulnMonitor reconciles each one against the gear you actually run, then ranks the few that matter against KEV and EPSS.
VulnMonitorSource: NVD 2024 CVE feed. Placeholder, replace before launch
-
03 . Time to detect
0 days
Median time to identify a breach.
Posture reviews and adversarial testing shorten this number. Security Audit measures your stack against CIS Benchmarks. Penetration testing proves the controls hold under attack, then re-tests every fix.
Security AuditSource: IBM Cost of a Data Breach Report 2024. Placeholder, replace before launch
-
04 . Compromised credentials
0 %
Of breaches involve compromised or stolen credentials.
Privileged accounts are the keys to the kingdom. PAM vaults them, records every session, and gives auditors a full trace of who touched which server and when.
PAMSource: Verizon Data Breach Investigations Report 2024. Placeholder, replace before launch
CloudKey covers your full attack surface. See what's exposed, prove your defenses hold, lock down privileged access, and build the management system auditors recognize. Four layers, attack surface to governance, evidence on every finding.
Book a platform demoResources
Reading the team publishes
New Methodology
CVSS vs EPSS vs KEV: how to prioritize CVEs that matter
What CISA's exploit-evidence list tells you about patch order, illustrated with two real CVEs from this month.
Read Field notes
What a useful dark web monitoring report contains
A redacted dark web monitoring report, walked section by section. The open-finding ledger. The re-test attestations. The parts auditors ask for first.
Read
Engineering
SBOM asset inventory reconciliation in practice
What your team thinks is in production is rarely what the package manifests say. SBOM asset inventory reconciliation closes the drift.
ReadStart with visibility
See your monthly DarkWeb and exposure report, then layer on what you need.
One redacted report a month: leaked credentials, exposed subdomains, edge vulnerabilities, scoped to the domains you authorize, delivered to a named owner. Verification and Control layers follow once the picture is clear.
Reconnaissance only runs after written authorization. Our scope policy. →