Understand the exposure
Identify the systems included in the assessment and which weaknesses could most affect the business.
How KernelHawk works
How an assessment works, start to finish.
One record ties each system to its risks, its owner and the status of the fix. Leadership reads the summary; IT reads the register behind it.
The questions we answer
Security work should lead to decisions.
Scanner exports, tickets, and spreadsheets each hold part of the answer. The report puts all of it in one place.
Agree the work
Give each priority an owner, a due date, and a test for whether the issue is resolved. Explain the decisions to leadership.
Check progress
Retest agreed fixes and record what changed. Scheduled reviews can track new exposure and overdue work.
The engagement
A defined path from concern to action.
We agree the scope before work begins. Every stage produces something you can read: a proposal, an evidence register, a report, a retest result.
Talk
Identify the concern, the systems that matter, and the decision the work has to support.
Scope
Agree in writing what we test, how, when, what you get, and the price.
Assess
Review only the approved systems, and confirm the findings by hand before they go in the report.
Report
Deliver the scorecard, executive summary, technical findings, and ordered remediation plan.
Improve
Support prioritization, retest completed fixes, and establish a recurring review cadence if useful.
The KernelHawk Baseline score
Five areas every growing business should understand.
A security professional completes 20 defined checks, each with a recorded result, a written reason, and the exact evidence behind it. The software calculates every area score from those records and ties the result to the evidence it reviewed. A check without evidence is refused, never treated as a pass.
| Security area | The business question | Examples of what may be reviewed |
|---|---|---|
| External exposure | What can someone outside the business reach or learn? | Domains, public services, remote access; websites, cloud entry points, and third-party dependencies. |
| Identity and access | Could one compromised account lead to a larger loss? | Authentication, administrative access, privilege; account lifecycle, remote access, and separation of duties. |
| Data protection | Where is important data exposed, over-shared, or weakly protected? | Data flows, storage, encryption; access boundaries, backups, and sensitive-system dependencies. |
| Patch and configuration | Are known weaknesses and unsafe settings being controlled? | Externally visible software, important configurations, cloud posture, unsupported systems, and remediation process. |
| Detection and response | Would the business notice and handle a security event? | Logging, alert ownership, escalation, recovery planning; backups, incident roles, and evidence retention. |
Our software calculates the 1-10 score from the 20 recorded checks; the assessor cannot type in a number. Any critical or high finding that is still open lowers the overall score and limits the area scores. The score is not a certification or a guarantee. Review the scoring methodology.
Executive security summary
The score and five-area profile summarize the agreed scope. The report explains the highest business risks, decisions, and limits in plain language.
Technical findings register
For each confirmed issue: the system, the evidence, the impact, the severity; what to do, who owns it, and what proves it fixed.
30 / 60 / 90-day roadmap
Containment first, then corrections, then longer improvements, with any risks you decide to accept recorded alongside.
Results meeting
One call with leadership and IT together, to settle questions and agree what happens first.
Retest plan
The findings to recheck, the evidence required for closure, and how progress will be reflected in the updated score and report.
Customer portal
The current published assessment, coverage, findings, remediation status, and evidence freshness are available to authorized users in the customer portal.
Go deeper when needed
A broad baseline with specialist depth available.
The first assessment identifies where deeper work would change a decision. Specialist reviews can also be purchased directly for a known concern.
External exposure
Review the internet-facing services and relationships that could create an entry point or expose sensitive business information.
Cloud posture
Review approved cloud accounts and high-impact access or network settings without changing the environment.
Web and API testing
Assess an agreed business application or API and validate important weaknesses within a controlled testing window.
Mobile application review
Examine Android and iOS applications for security-relevant behavior, permissions, identity, data handling, and release concerns.
Firmware and binary review
Analyze device software or compiled applications before procurement, integration, release, or a deeper runtime assessment.
Validation and retest
Confirm whether a priority issue is real, check whether an agreed fix worked, and document the remaining risk.
Where to start
Get a security picture your team can act on.
Start with the KernelHawk Baseline or tell us about a specific concern. We will recommend the smallest useful scope.
Request an assessment