CVE-2020-1472
Netlogon Elevation of Privilege (Zerologon)
AffectedTested and vulnerable1 asset confirmed
Close the doors before anyone finds them.
CyberVision identifies the flaws that give an attack its entry, orders remediation by business impact, and drives execution to closure. Artificial intelligence performs the technical function most organizations cannot hire.
- No technical knowledge required
- Activated in one business day
- No credit card
CyberVision — AI assistant
check the security of my company
Consolidating every monitoring front.
136/136
- internal network
- external network
- cloud
- applications
- credentials
47/100Fragile posture
24
7
- 5Require attention
- 3In progress
- 3Resolved
IndexThe grade rises as corrections are closed.
what should I fix first?
Ordering by business impact.
24/24
- external exposure
- client data
- unpatched system
- 01External exposure with publicly known exploitation
- 02Client data reachable without authentication
- 03Server unpatched for eight months
OrderedQueue reordered by impact and likelihood.
assess this week’s security bulletins
Cross-checking bulletins against your inventory and testing each one.
57/57
- CISA KEV
- vendors
- inventory
CVE-2019-19781
Citrix ADC Directory Traversal
Not exposedTested, the flaw is not presentNo asset matched
PrioritizedWhatever does not affect you leaves the queue.
generate this month’s executive report
Consolidating the period and drafting the document.
2,480/2,480
- scans
- closed tickets
- new exposures
ExecutivePDF
Executive overview — August 2026
Executive summary
Security posture and index evolution
Critical risks and remediation deadlines
Comparison with the previous period
ReadyAvailable to print and download.
assess our LGPD compliance
Measuring the required technical controls.
46/46
- encryption
- access auditing
- retention
DocumentedTechnical evidence exported for audit.
check the mail server
Analyzing authentication, delivery, and reputation.
38/38
- DNS
- delivery
- block lists
- DMARCMonitoring mode only
- SPFAllows unintended senders
- DKIMValid signature on every domain
- Delivery TLSActive on every delivery
In remediationTwo DNS adjustments opened for execution.
what would the impact of an attack on the file server be?
Simulating the reach from that asset.
54/54
- accounts with access
- shared folders
- linked backups
6systems would stop with it
- Client database — reachable through the same access
- Backup — reachable on the same segment
- Invoicing — halted for the duration
In remediationSegment isolation entered the queue.
how are the corrections progressing?
Checking the tickets in the remediation plan.
21/21
- backup server
- client portal
- firewall
76%of the plan completed
- 16Closed and verified
- 4In progress, on schedule
- 1Overdue by three days
TrackedOwner of the overdue item notified.
are we vulnerable to ransomware?
Checking the vectors most used in this attack.
19/19
- remote access
- macros
- backup isolation
- CriticalRemote access exposed without two-factor
- CriticalBackup on the same network as the servers
- HighWorkstations without macro blocking
In remediationThree corrections opened for the main vector.
assess the company’s resilience
Testing recovery and continuity.
8/8
- server loss
- link failure
- backup failure
RecommendedRestoration test scheduled for this week.
schedule a weekly scan of the external network
Creating the routine in the scheduler.
4/4
- external network
- web applications
- certificates
Weekly external scanScan
- Every Monday, at 03:00
- 0 3 * * 1
- Active
ScheduledReport delivered at the end of each run.
generate the incident response policy
Drafting the document for your environment.
9/9
- classification
- escalation
- communication
ProcessPDF
Incident Response Policy
Incident classification
Escalation and owners
Containment and eradication
Notification of the ANPD
ReadyDocument available for review and signature.
Illustrative demonstration of the CyberVision interface
React or fortify
The security industry was built to react.
Antivirus, firewall, and monitoring all start from the same premise: the attack will happen, and what remains is to contain it. The alternative — eliminating the flaw before an incident exists — has always been cheaper and more effective. And it has always met the same limit: remediation demands deep technical knowledge, applied continuously, which most organizations cannot sustain.
Reactive defense
Detects and blocks what is already under way. Necessary, yet always one step behind: it presumes the door stays open.
Proactive fortification
Removes the door before anyone looks for it. A correction in a planned window, with no service interruption and no notification to clients or authorities.
The cost difference
A scheduled update costs a fraction of halted operations, emergency specialists, notification of the ANPD, and the contract that is not renewed.
That limit is what artificial intelligence removes. CyberVision performs the fortification: it finds the flaw, sets the order, and drives the correction.
The missing layer
The technical function that makes fortification possible.
Command center
Security posture on a single screen.
A grade from A to F composed over the six monitored fronts from the controls of NIST CSF 2.0 and CIS Controls v8, with every technical finding weighted by CVSS severity and asset criticality. Alongside the grade, the asset inventory, the risks requiring immediate action, and the order of execution set by business impact.
The organization’s security position becomes measurable against a recognized reference.
Artificial intelligence assistant
Specialist operations requested in ordinary language.
The request is written as it would be addressed to a professional: which risk to treat first, generate the board report, assess a suspicious message, schedule recurring scans. The platform executes, presents the result, and opens the corresponding tickets.
Tasks that would require a consultant are executed in minutes, with no prior knowledge.
Agent team
Eight artificial intelligence agents in continuous operation.
Virtual CISO, vulnerability manager, security analyst, asset manager, threat hunter, cyber threat analyst, compliance analyst, and security coordinator. Each agent performs its function without interruption. It is this installed capacity — unavailable to organizations of this size through hiring — that makes continuous remediation viable.
Permanent analysis across the whole environment, with no gap between the scan and the reading of its result.
Emerging Threats
Every published bulletin is tested in the organization’s environment.
When a serious flaw is disclosed, the platform cross-checks the bulletin against the inventory and runs the available test on the organization’s own assets. The verdict is objective: affected, with the confirmed assets, or not exposed, when verification demonstrates the flaw is not present. Whatever does not apply leaves the queue.
The decision stops depending on headlines and starts depending on verification.
Governance
The processes required by framework, drafted and versioned.
Fourteen processes, each carrying its framework reference — ISO 27001, NIST CSF, NIST SP 800-61, NIST SP 800-63, NIST RMF, ISO 27005, and CIS Controls — drafted by artificial intelligence against the organization’s own infrastructure, with a version and an implementation status. The grade measures the state of the environment; these documents are the formal evidence that accompanies a client questionnaire, an insurer requirement, or an audit.
Requests for evidence are answered with a referenced document rather than a self-declaration.
Coverage
The doors an attacker looks for, under continuous observation.
An intrusion attempt does not select one path: it covers all of them. These are the six fronts kept under permanent verification.
Internal network
Connected servers, workstations, and devices — including assets absent from the formal inventory.
External network
The entire surface visible from the internet: ports, published services, and entry points.
Vulnerability scanner
Known flaws in operating systems, with the public identifier and the applicable correction.
Emerging Threats
Bulletins disclosed today, verified the same day against the organization’s assets.
Cloud Security Agent
Excessive permissions, storage without access restriction, and unprotected backup routines.
DeepWeb Scanner
Corporate credentials circulating in restricted forums and marketplaces, before they are used.
Mechanism
What performs the verification — and what it does not yet reach.
The platform operates through sensors whose scope is authorized by contract. Each dimension of the environment requires a specific sensor and yields a specific visibility. The organization sees that entire chain, including the dimensions that remain uncovered.
Scope
External surface
Everything the organization’s domains expose to the internet.
Sensor
Managed external scanner
Active · daily scan
Operated by CyberSeven. Nothing to install.
Visibility
Exposed ports, services, and certificates under observation.
Scope
Internal network
Equipment and services inside the perimeter.
Sensor
Internal appliance
Requires installation
Runs on one machine inside the network, restricted to the authorized IP ranges. All communication is initiated by the appliance over outbound HTTPS: no inbound port is opened on the perimeter.
Visibility
Internal inventory and flaws on the connected assets.
Scope
Behind the login
Web applications in their authenticated areas.
Sensor
Authenticated scan
Requires authorization
Depends on a test credential granted by the organization and on a scope authorized in writing.
Visibility
Permissions, user data, and internal application functions.
Scope
Confirmation by attack
Practical proof that a flaw is exploitable.
Sensor
Active exploitation
Requires express permission
Nothing is injected into the environment without recorded consent.
Visibility
Confirmed risk in place of theoretical possibility.
Data handling
- What is collected
- Technical configuration and exposure data: reachable ports, published services, software versions, certificates, cloud permissions, and corporate credentials found in public breaches. There is no access to the contents of mailboxes, working files, or client databases.
- How the data travels
- The internal appliance initiates all communication over outbound HTTPS. The organization’s perimeter receives no port opening, and the platform is granted no inbound access.
- Where the data resides
- In public cloud, Brazil region, under LGPD jurisdiction. The scope of each sensor is recorded in contract and visible in the platform itself.
- What is not observed
- The platform declares the dimensions without coverage and the sensor each one requires. On an uncovered front, the absence of findings is recorded as an absence of observation, not as an absence of risk.
Evaluation
Recurring questions before the decision.
The organization has no dedicated security professional.
That is the scenario the platform was built for. The stage requiring expertise is performed by artificial intelligence — identifying, correlating, and prioritizing — and what results is a remediation plan in clear terms. Execution falls to the IT team, the infrastructure vendor, or CyberSeven under the Managed plan.
The available security budget is limited.
Contracting follows the size of the environment: it considers the monitored assets and the enabled modules, not a fixed corporate bundle. The pertinent comparison is not another tool, but the cost of one day of interrupted operations.
The team has no technical background in security.
It is not a requirement. The technical analysis is performed by artificial intelligence, which presents the recommended action for each item in order of priority. Interaction with the platform takes place in natural language.
The organization already uses antivirus and a firewall.
Both remain necessary and act on containment: antivirus over malicious files, firewall over network traffic. Neither reports where the organization is exposed today, nor which correction should be executed first. That is the field of proactive fortification, the function of CyberVision.
How is the organization’s data handled?
The monitoring scope is defined in contract and every scan depends on formal authorization. The platform collects technical configuration and exposure data — it does not access the contents of mailboxes, working files, or client databases.
Industries
The order of fortification follows what sustains the operation.
The first door to close is the one that leads to what the organization cannot lose — and that varies by activity.
Healthcare
Unavailable records interrupt care. Medical equipment without manufacturer support cannot be patched and requires protection through other controls.
Professional services
Accounting, law, and consulting operate under contractual confidentiality. A leak compromises the client relationship before it compromises revenue.
Retail and e-commerce
Platform unavailability suspends revenue for every hour down. The customer database is the asset of highest value and highest exposure.
Manufacturing and logistics
A stopped line has a known hourly cost. Production control systems and supplier integrations define continuity.
Implementation
One week to the first picture of the environment.
The evaluation runs against the organization’s real infrastructure, not a demonstration environment. At its conclusion, the contracting decision is made on the organization’s own results.
Day 1
Registration
Registration of contact and organization details. No credit card is required during the evaluation phase.
Day 2
Scoping meeting
A thirty-minute session to survey the environment, formally define the monitoring scope, and grant the required access.
First week
Scan execution
Delivery of the initial security index and the prioritized risk queue, with asset identification and a recommended action per item.
Conclusion
Contracting decision
The organization decides based on results obtained in its own environment. The technical report for the period remains with the client.
Find out today what an attacker already knows.
In one week, over the organization’s real infrastructure, the result is the security grade and the order of remediation set by business impact. No credit card and no commitment: when the evaluation ends, the technical report for the period remains with the organization.