A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Vulnerability management is the ongoing programme that surrounds vulnerability scanning: discovering weaknesses on a defined cadence, triaging and prioritizing them, remediating within a stated timeframe, and verifying the fix. Unlike a one-off assessment, it is a continuous loop with owners and service levels. It is what turns a scanner's output into evidence that risk is actually being reduced.
A working programme ties CVSS severity to a remediation SLA, assigns an owner to each finding, and keeps the evidence that the loop closed. The evidence is the remediation record over time, not the licence for the tool.
Context has to override the raw score. A critical CVE on a component you do not expose can wait behind a medium on your authentication path, so a programme that cannot express that priority produces either panic or ignored alerts.
traztech delivers a vulnerability management programme for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Vulnerability management shows up in compliance as the control an auditor tests when they ask what you do about the issues your scanner finds. Owning a scanner is not the control; triage, remediation inside your stated SLA, and proof of both across the period are. We build this as a vulnerability management programme.
The number that matters is whether you meet the timeframe your own policy commits to. A realistic thirty-day critical SLA you consistently hit evidences more than an aggressive seven-day one you miss, which an auditor comparing policy to evidence will notice.
The assessment is the point-in-time activity that produces a list. Vulnerability management is the programme around it: who triages, who fixes, within what timeframe, and how you prove the loop closed.
Frequently enough to match your rate of change and your own policy. Continuous or at least monthly scanning of production, plus a scan after significant changes, is a common and defensible baseline.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.