stratops.Cyber capabilities as a service
Domain · Vulnerability management

Vulnerabilities fixed, within deadlines that hold.

We scan your systems, prioritise vulnerabilities by their exposure and real exploitability, set remediation deadlines and check that each patch is applied.

Describe your needAll domains
Situations

You are in the right place if…

  • Your scanner produces reports thousands of lines long that nobody reads.
  • You do not know how long it takes you, on average, to fix a critical vulnerability.
  • Old servers no longer receive updates, and nobody dares touch them.
  • Your managed service provider applies patches « when it can ».
  • An auditor asks for evidence of your patch management process.
Our conviction

A known vulnerability left untreated is a risk accepted unknowingly.

Not all vulnerabilities are equal: a critical flaw on an isolated server weighs less than a medium flaw on an exposed, actively exploited service. Sorting by score alone leads to fixing a lot, but not what matters.

So we prioritise by exposure and exploitability, set deadlines by level, and follow each vulnerability until its fix is verified, or until an explicit, dated risk acceptance.

Our approach

From scan to verified fix.

A regular cycle, with remediation deadlines everyone knows and exceptions decided, not endured.

  1. 01ScanAuthenticated scans of servers, workstations and devices, at a frequency suited to their criticality.

    You getAn inventory of vulnerabilities

  2. 02PrioritiseExposure, active exploitation, asset criticality: a real priority, not just a score.

    You getA short list, by remediation deadline

  3. 03Get it fixedEach vulnerability retained has an owner and a due date; an exception becomes a dated risk acceptance.

    You getA remediation plan and its exceptions

  4. 04Re-checkThe next scan confirms the fix; deadlines met and missed are measured.

    You getTime-to-fix indicators

What the texts say

What the texts expect of vulnerability handling.

The texts do not only ask you to scan: they ask you to prioritise, fix within deadlines and verify.

  • DORA · RTSRTS 2024/1774 art. 10(1) · RTS 2024/1774 art. 10(2), point (b) · RTS 2024/1774 art. 10(2), point (f) · RTS 2024/1774 art. 10(2), point (g) · RTS 2024/1774 art. 10(4), point (d)

    Financial entities document and apply vulnerability management procedures: automated scanning at a frequency commensurate with asset criticality, prioritisation of patches, verification of remediation, and deadlines for installing patches with an escalation procedure.12345

  • DORADORA art. 13(1)

    They have the capabilities and staff needed to gather information on vulnerabilities and cyber threats, and analyse their impact.6

  • NIS 2 · ReCyFNIS 2 art. 21(2), point (e) · ReCyF v2.5, objectif 5

    The directive lists vulnerability handling among the measures Member States must require of entities; the ReCyF (working version) sets them the objective of a security maintenance process that applies security patches.78

  • CNIL guideGuide CNIL sécurité, fiche 6, F06-PE-04 · Guide CNIL sécurité, fiche 9, F09-MC-05

    The CNIL recommends deploying security updates as early as possible, without delay for public critical flaws, and using vulnerability detection tools on servers.910

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of engagement.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

We scan at the agreed frequency and document vulnerabilities, their age and their fix.

Deliverables
  • Recurring scans and their results
  • Alerts on actively exploited vulnerabilities
  • Time-to-fix indicators
Level 02

Advise

We prioritise vulnerabilities in your context and recommend patches and workarounds.

Deliverables
  • Priorities by exposure and exploitability
  • Remediation deadline policy
  • Analysis of exceptions and obsolete systems
Level 03

Drive

We run remediation with your teams and your managed service provider until the fix is verified, without making the changes in your systems.

Deliverables
  • Tracking of fixes and reminders
  • Register of risk acceptances
  • Re-check after each patch campaign
Accelerators

What we bring from day one.

Exploitability-based prioritisation

Vulnerabilities crossed with observed exploitation and your exposure, to fix first what is being attacked.

Template deadline policy

Remediation deadlines by priority level, with the exception procedure, to adapt to your organisation.

Fixes ready to apply

With the Action Kit option, remediation scripts and procedures that your teams review and apply.

Frequently asked questions

Before we start.

Must every vulnerability be fixed?

No. Some are fixed, others worked around, others accepted, explicitly and for a limited time. What matters is that each decision is made and recorded.

What remediation deadlines should we set?

They depend on priority and your production constraints; we propose a grid at scoping. For a financial entity subject to DORA, these deadlines and the escalation procedure when they are missed must be set in the patch management procedures.5

Can your scans disrupt production?

Scans are configured and scheduled with your teams, on the scope and slots agreed in writing; fragile systems are identified and handled separately.

What about a system that can no longer be updated?

Isolate it, reduce its exposure, strengthen its monitoring, and plan its replacement; the residual risk is accepted in writing by the right person, with a review date.

Start with a first scan.

Describe your estate and your current tools. We come back to you with a proposed scope and frequency.

Describe your need
Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 10 excerpts quoted
  1. 1RTS 2024/1774 art. 10(1)32024R1774-a10-p1
    As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement vulnerability management procedures.
    Normative force
    directly applicable EU law (delegated regulation — RTS, level 2)
    Source
    Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
    Version
    CELEX 32024R1774 — ELI reg_del/2024/1774
    Official text
  2. 2RTS 2024/1774 art. 10(2), point (b)32024R1774-a10-p2-2
    ensure the performance of automated vulnerability scanning and assessments on ICT assets, whereby the frequency and scope of those activities shall be commensurate to the classification established in accordance with Article 8(1) of Regulation (EU) 2022/2554 and the overall risk profile of the ICT asset;
    Normative force
    directly applicable EU law (delegated regulation — RTS, level 2)
    Source
    Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
    Version
    CELEX 32024R1774 — ELI reg_del/2024/1774
    Official text
  3. 3RTS 2024/1774 art. 10(2), point (f)32024R1774-a10-p2-10
    prioritise the deployment of patches and other mitigation measures to address the vulnerabilities identified;
    Normative force
    directly applicable EU law (delegated regulation — RTS, level 2)
    Source
    Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
    Version
    CELEX 32024R1774 — ELI reg_del/2024/1774
    Official text
  4. 4RTS 2024/1774 art. 10(2), point (g)32024R1774-a10-p2-11
    monitor and verify the remediation of vulnerabilities;
    Normative force
    directly applicable EU law (delegated regulation — RTS, level 2)
    Source
    Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
    Version
    CELEX 32024R1774 — ELI reg_del/2024/1774
    Official text
  5. 5RTS 2024/1774 art. 10(4), point (d)32024R1774-a10-p4-4
    set deadlines for the installation of software and hardware patches and updates and escalation procedures in case those deadlines cannot be met.
    Normative force
    directly applicable EU law (delegated regulation — RTS, level 2)
    Source
    Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
    Version
    CELEX 32024R1774 — ELI reg_del/2024/1774
    Official text
  6. 6DORA art. 13(1)32022R2554-a13-p1
    Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  7. 7NIS 2 art. 21(2), point (e)32022L2555-a21-p2-5
    security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
    Normative force
    EU law to be transposed (directive): not directly applicable, requires national transposition
    Source
    Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
    Version
    CELEX 32022L2555 — ELI dir/2022/2555
    Official text
  8. 8ReCyF v2.5, objectif 5recyf:obj-5
    Les entités [importantes ou essentielles] disposent d’au moins une cartographie de leurs systèmes d’information suffisamment détaillée pour faciliter : 1° Le maintien en condition opérationnelle et de sécurité de leurs systèmes d’information ; et 2° L’amélioration de la réactivité de ces entités en cas d’incident de sécurité affectant leurs systèmes d’information. Ces entités définissent et mettent en œuvre un processus de maintien en condition opérationnelle et de sécurité de leurs systèmes d’information visant à appliquer les correctifs de sécurité liés à des vulnérabilités affectant ces systèmes et ainsi à limiter l’exposition des entités aux risques numériques résultant de ces vulnérabilités.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  9. 9Guide CNIL sécurité, fiche 6, F06-PE-04F06-PE-04
    Déployer les mises à jour de sécurité au plus tôt, le cas échéant après les avoir testées. Les mises à jour venant corriger des failles critiques publiques doivent d’autant plus être installées sans délais.
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text
  10. 10Guide CNIL sécurité, fiche 9, F09-MC-05F09-MC-05
    S’agissant des logiciels s’exécutant sur des serveurs, il est conseillé d’utiliser des outils de détection des vulnérabilités (logiciels de scans de vulnérabilités tels que nmap, nessus ou nikto) ou audits pour les traitements les plus critiques afin de détecter d’éventuelles failles de sécurité. Des systèmes de détection et prévention des attaques sur des systèmes ou serveurs critiques peuvent aussi être utilisés.
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text