The weak spots attackers use first get fixed first.
Missing updates, vulnerable software, risky settings and exposed web services, ranked by what is being exploited today and confirmed fixed by the next scan.
Five places weaknesses hide.
Each module finds one kind of exposure and gives it an owner, a priority and a way to fix it. They share one console, one agent and one view of risk.
Vulnerabilities
Installed software and installed updates on every machine, matched against public vulnerability catalogues and ranked by exploitation.
Hardening
Risky settings found by the agent, fixed on every failing machine with one action and kept fixed afterwards.
Ransomware readiness
A score built from the controls that decide how far one opened attachment can spread, with the gaps listed worst first.
Web application scanning
Authorised scans of the web services you own, from subdomains through to the application itself.
Attack surface
The hosts under your domains that the internet can see, found without sending them a request.
Patch rollout
Updates for exploited vulnerabilities go out through staged rings in Endpoint Management.
Exploited beats highest score.
Severity alone sends teams after the wrong things. Tracemark weighs known exploitation and the likelihood of exploitation next to severity, gives each finding a due date, and shows which single update closes the most findings.
- Software and updates. The agent reports what is installed; your Tracemark server matches it against the catalogue.
- Exploit context. Known-exploited and ransomware-linked flags, and an exploitation likelihood for every CVE.
- Due dates by risk. Critical findings are due in 7 days and low ones in 90. The clock starts when a finding is first seen and a rescan does not reset it.
- Fix from the finding. Approve the updates for exploited CVEs in one dialog. They roll out ring by ring and count as fixed only when a later scan agrees.
- Isolated networks. Catalogues and exploit data can be imported from files.
A risky setting is fixed everywhere, then kept fixed.
The agent checks how each machine is configured. A failing check can be fixed on every machine it fails on with one action, and kept in force so it is corrected again when something changes it back.
- One-step fix on all failing machines, now or tonight at 22:00 machine time.
- Baselines assign a set of checks to endpoint groups, including machines that join later.
- Drift enforcement re-applies a fix after each audit, with a guard so two policies never fight forever.
- Accepted risk needs a written reason and can carry a review date. It leaves the score and stays on the record.
- Rollback restores the saved value, offered only where reverting is safe.
One opened attachment should stay one machine.
Readiness groups the controls that matter for ransomware by attack stage and weights them. A control that fails on every machine costs its full weight. Tracemark measures what the endpoint can show. It does not take backups or test restores.
- Entry. Office macro warnings, Office child processes, SmartScreen, remote desktop without Network Level Authentication.
- Execution. Defender real-time and tamper protection, the ransomware protection rule, script hosts.
- Spread. SMB1, SMB signing, plain-text credential caching, LSA protection, credential theft rules.
- Impact. Controlled folder access, network protection, writable removable drives.
- Recovery. Restore points, the shadow copy service and installed backup products, reported as present only.
- Behaviour watch. An alert when a command tries to delete shadow copies or the number of copies drops.
A number you can trust.
The console shows what is true on the machine, and says plainly what it could not measure.
Fixed means rescanned
An installer that finished or a script that ran shows as applied. It counts as fixed when a later scan no longer reports the problem.
Not measured is not clean
A machine that never sent an inventory, or a host nobody scanned, is listed with the reason. It never adds a zero to the totals.
Exceptions have reasons
An accepted risk carries the reason and the person who accepted it, and drops out of the score without disappearing.
Findings are never deleted
A finding that goes away is marked fixed. A human decision such as false positive is never overturned by the next scan.
One authorised target, a full scan in order.
Add a web service you own and confirm you are allowed to scan it. Nothing is sent before that. A full scan then runs every stage in turn, and the scanner only ever touches the host you named.
Subdomains
Names under the target's domain.
Live hosts
Which of them answer over HTTP.
Ports
Open ports, with risky services flagged.
TLS
Old protocols and weak ciphers.
Content discovery
Sensitive paths left reachable.
Known flaws
Safe checks for published weaknesses.
App scan
A passive scan of the application.
An active scan that sends attack payloads is a separate choice, off by default and meant for test instances or quiet hours.
Every host the internet can see.
Tracemark lists the hosts under your watched domains from certificate records, DNS and public internet data. Discovery is passive and sends no request to the hosts.
- Takeover risk first. A name that points at a cloud resource which no longer exists is flagged, because it needs no exploit at all.
- Network context. Whether each address sits behind a CDN, in a cloud, with a hosting provider or on your own network.
- Certificates. The certificate each host presents and when it expires.
- Risk from real findings. A host's risk comes from the web scanner's open findings. A host nobody has scanned shows as not assessed.
- One step to the scanner. Offer any host to the web scanner, where it waits for authorisation like any other target.
What is included.
Exposure Management is five modules on one console and one agent. Turn on the ones you need.
Missing updates and vulnerable software across the fleet, ranked by risk, with due dates and a direct path to the fix.
- Public catalogues for Windows software and Linux packages
- Known-exploited and exploitation-likelihood data
- Due dates set by the risk score
- The updates that close the most findings, first
- End-of-life software and a port audit
- Offline import for isolated networks
Configuration checks read locally by the agent, with fixes applied as the system account and confirmed by the next audit.
- Checks on Windows and Linux
- A severity-weighted score with a daily trend
- Fix now, or tonight in quiet hours
- Baselines assigned to endpoint groups
- Drift corrected automatically
- Accepted risks with reasons, and rollback where safe
A stage-weighted readiness score for the fleet and a list of what to fix first. It measures controls and recovery signals on Windows endpoints. It does not take backups or test restores.
- Controls grouped by entry, execution, spread and impact
- Open CVEs used in real ransomware campaigns
- Restore points and the shadow copy service
- Installed backup products, reported as present
- Alerts on shadow copy deletion, without blocking
- A CSV report built from the same data as the screen
Scans of the web services you own, run from your Tracemark server. Each target is authorised first and the scanner is fenced to that one host.
- Subdomains, live hosts, ports and TLS
- Content discovery for exposed paths
- Known-flaw checks and a passive app scan
- Scheduled scans at an hour you choose
- Token, basic or form login for authenticated scans
- Findings tracked until a scan shows them fixed
The hosts under your watched domains that the internet can see, found without sending them a single request.
- Hosts from certificate records and scan results
- Dangling DNS names and takeover risk
- The network that owns each address
- Certificate expiry
- Risk from the web scanner's open findings
- Any host offered to the scanner in one step
Where each finding comes from.
| Module | What it finds | How it is measured |
|---|---|---|
| Vulnerabilities | Vulnerable software, missing updates, end-of-life software, open ports | Agent inventory, matched on your Tracemark server |
| Hardening | Risky settings, with fixes and drift | Agent checks on Windows and Linux |
| Ransomware readiness | Missing controls by stage, recovery signals, shadow copy tampering | Hardening results and the agent on Windows |
| Web application scanning | Weaknesses in web services you own | Your Tracemark server, against authorised targets only |
| Attack surface | Internet-facing hosts and dangling names | Passive: certificate records, DNS and public internet data |
Questions.
How do you know a fix worked?
A fix counts as done only when a later scan of that machine no longer reports the problem. Until then it shows as applied.
What about machines that have not reported yet?
They are listed as not measured, with the reason. A machine that has never sent an inventory is never counted as free of vulnerabilities.
Does ransomware readiness back up our data?
No. It measures the controls that limit ransomware and the recovery signals visible on the endpoint, such as restore points. It cannot tell whether your backups run or whether a restore was ever tested, and the screen says so.
Can the web scanner reach a service by accident?
Every target must be authorised before any scan runs, and the confirmation is recorded in the audit log. The scanner is given only the authorised host, and results for any other host are discarded. Loopback and cloud metadata addresses are refused.
Does attack surface discovery send traffic to our hosts?
No. Hosts are found from certificate records, DNS and public internet data. A host is contacted only after you offer it to the web scanner and authorise it there.
Our server has no internet access. Does it still work?
Yes. Vulnerability catalogues and exploit data can be imported from files, so matching and ranking work on an isolated network.
Works well with
See it on your own estate.
We scan a few test machines and a web service you own, and walk through what to fix first.