Reduce the vulnerability backlog on systems you can't take offline.
Vulnerability Remediation
A vulnerability backlog on OT and legacy systems is weak cipher suites, old TLS, and scanner and pentest findings waiting on an outage window. We reduce it two ways: we fix what each system can take, retest it, and hand you the evidence it's closed, and every finding that needs a vendor patch or hardware that can't support the fix gets a documented decision with the compensating controls your assessor needs to accept it. Inside an Electronic Security Perimeter, we deliver the verified change for your team to apply.
When the question is where your encryption lives and how long it has to hold, start with PQC Readiness, the cryptographic inventory, priced per production environment.
We work the platforms and infrastructure you have, whatever the framework or toolchain. Findings close with auditable evidence, and status reports back to whoever is running the engagement. Delivered by a principal whose vulnerability-management background runs through NERC/FERC-CIP-regulated critical infrastructure and OT/ICS penetration-test remediation, where a finding disposition has to survive an audit.
Engineered by Jeremiah Coakley, Principal Security Architect
Encryption findings we close
The finding your scanner named, closed with evidence.
These are the encryption findings that show up in scans, audits, and customer reviews. We fix each one inside your systems and hand you the evidence that it's closed.
Protocols and ciphers
- →TLS 1.0 or 1.1 still enabled
- →Weak cipher suites (SWEET32, 3DES)
- →RC4 cipher suites enabled
Key exchange
- →Weak Diffie-Hellman parameters (Logjam)
- →SSL Labs grade capped at B (no forward secrecy)
Keys and certificates
- →Incomplete certificate chain
- →DKIM key too short (1024-bit)
We also close hardcoded secrets and keys in code, MD5 or SHA-1 password hashing, key rotation turned off, and data not encrypted at rest.
When you can't fix it
Some findings stay open for good reasons. Document them the way your assessor expects.
Legacy hardware, a vendor appliance, an OT controller on a utility network, or a system at end of support may not run a modern cipher suite. Those findings get a treatment decision: remediate, mitigate, or accept with compensating controls. Accepting one takes documentation an assessor will read.
Frontier AI models now find vulnerabilities in old code faster than outage windows open, so this list grows. Every finding on it still needs a recorded treatment. What AI-driven discovery means for the backlog →
NERC CIP
A Technical Feasibility Exception for a device that can't meet the requirement, with the mitigating measures in place and a plan to retire or replace it.
NIST 800-53
A risk response under RA-7, with the open work tracked on the plan of action and milestones (CA-5) and the evidence that supports it.
PCI DSS
Compensating controls under Appendix B, written up on the Appendix C worksheet: the constraint, the original objective, the added risk, the control that covers it, and how it's validated and maintained.
Every accepted finding lands in your Risk Register with a named owner and a date to revisit it. Critical infrastructure environments →
Findings Remediation pricing
A published price for the findings we see most.
Fix it, or document why you can't, at a list price you can put in a budget or a proposal. Each item closes with evidence your assessor can follow.
TLS Hardening Pack
$2,500 per pack
One environment, up to 5 listeners (host:port) on up to 2 platform types. Every standard TLS finding: protocol versions, SWEET32/3DES, RC4, weak Diffie-Hellman, forward secrecy, incomplete chain. Evidence pack: before/after scan, config diff, closure memo. One retest within 30 days.
+$350 per additional listener up to 20; 21 or more are quoted
Email Authentication
$2,000 per domain
SPF, DKIM at 2048-bit, and DMARC moved to reject over 60 days, covering up to 8 sending services.
+$900 per additional domain on the same sending stack; +$150 per additional sending service
Edge and Header Hardening
$1,250 first hostname
HSTS, Content Security Policy in report-only then enforced, the standard security headers, and a WAF baseline.
$600 each for hostnames 2 to 10 on the same configuration; $350 each from 11
Risk-Acceptance Memo
$1,750 per system
For the system that can't take the fix. Default format is a NIST SP 800-53 RA-7 / POA&M record: the constraint, compensating controls, residual risk, owner, review date, and sunset triggers.
+$400 per additional finding on the same system
Remediation Validation
$1,250 per retest
A standalone retest of up to 10 findings, for fixes your own team or another vendor applied.
Terms. List prices are tax-inclusive. Application code, vendor firmware or patches, certificate purchases, and PKI rebuilds are change orders. A fix that needs a vendor patch converts to a Risk-Acceptance Memo. Client-caused delay past 45 days closes the job as delivered.
Anything outside the list, or a standing monthly backlog? Scoped in 24 hours, priced off your Risk Register.
Integrators and partners buy the same list at partner rates. See the partner program →
What needs to be closed?
Where this fits
Your vulnerability backlog, driven to closed.
Findings come from everywhere: a penetration test, an MCP security audit, or your compliance platform. This is the engagement that drives that backlog to closed, with evidence, and updates your Risk Register as each finding is disposed.
When You Need This
Four contexts. The same workflow.
The engagement is structured the same way regardless of what generated the finding inventory. The intake source, the environment, and the output format vary; the workflow does not.
Post-assessment or post-pentest
The assessment or test delivered the finding inventory. Implementation help is what it takes to close it, not more advisory output. We work from any prior engagement: an assessment, third-party pentest, internal scan, or GRC platform export.
Post-incident hardening
A breach, near-miss, or security event produced a finding list. The window before the next exposure is the constraint: the backlog needs to close, not be documented.
Pre-M&A / due diligence
Transaction timeline requires a defensible posture picture. Findings on the board before close create risk for both sides. A scoped sprint closes what needs to close before the conversation happens.
Compliance deadline
Framework audit in scope: NIST 800-53, NIST 800-171, NERC/FERC CIP, NIST AI RMF, ISO 27001, SOC 2. Finding queue needs to move before fieldwork begins. Evidence must be at the fidelity the auditor will require, beyond a status update in the platform.
Engagement Structure
Four shapes. Scope confirmed at kickoff.
Where the findings come from and the environment they land in shapes the engagement. The workflow is the same: intake, triage, remediation, validation. Standard findings use the published price list; larger scopes are priced off your Risk Register.
Which scanners & GRC platforms?Scanner / GRC platform
Control Closure
A scanner or GRC-platform backlog (Archer, ServiceNow, Vanta, Drata) worked down against the standing program: each control failure engineered to pass and wired to evidence, so the platform reflects what is actually deployed.
OWASP WSTG / API Top 10
Pentest Closure: Web App / API
Findings from a web application or API pentest, closed against the same coverage the test ran: authentication and session handling, access control, injection, and business-logic fixes, each remediated, verified, and evidenced.
Cloud-native / Kubernetes
Pentest Closure: Your Infrastructure
Findings from an infrastructure pentest, closed on the systems you operate yourself, whether cloud-native, Kubernetes, or hybrid: each one remediated, retested, and evidenced so the report shows it closed.
Critical infrastructure
Pentest Closure: OT/ICS
Pentest findings closed inside a live OT/ICS environment, under the change-control and OT/IT boundary constraints critical infrastructure requires: no disruptive patching in a live process environment, compensating controls where a fix cannot be applied in place.
Any of the four against a named audit deadline? The same workflow runs compressed to your audit window: Framework Readiness applies across all four shapes, scope confirmed against the date.
Assessment
Scoped per engagement
Plain-language findings plus a client-owned Risk Register that prices every finding: the cost to fix it and the cost to leave it. One system is one environment we assess: a web app, a database, a server, a Kubernetes cluster, or a cloud account.
Remediation
From $1,250
Standard findings at the published list price; larger scopes priced off that register. You approve what gets worked before anything is touched, so you never pay for scope you don't have. Milestone-billed, Net 15, delivered as the sprint above that fits the inventory.
Most engagements open with the assessment, because the Risk Register is what prices and sequences everything after it. If you already hold a current finding inventory from a pentest, scan, or GRC export, we can work from it directly and move to remediation. Either way, scope is confirmed on a short scoping call before anything starts.
For MSP and advisor partners
Remediation capacity for partners
The engagements above are fixed-scope, billed direct to the client. When an integrator, MSP, or vCISO needs findings closed inside their client's program, FEDLIN works behind them at partner rates off the same published list.
Hourly or fixed scope?The partner keeps the client and the relationship. FEDLIN closes the findings and hands back the evidence. Anything outside the list is scoped in 24 hours. Partner terms →
Also: PCI ASV scans
Your quarterly ASV scan failed on TLS. Here's how to reach a passing rescan.
PCI DSS 11.3.2 requires a passing external scan by an Approved Scanning Vendor every quarter. These encryption findings commonly fail it: TLS 1.0 or 1.1 enabled, weak cipher suites (SWEET32, 3DES, RC4), weak Diffie-Hellman parameters, no forward secrecy, and an expired or incomplete certificate chain.
Fix it
Change the configuration that caused the finding, confirm it from the outside, then rescan.
Dispute it
If the finding is a false positive, send the ASV the evidence through its dispute process.
Document it
Where a documented constraint keeps it open, the ASV Program Guide lets you submit compensating-control documentation for the ASV to evaluate.
The Workflow
Intake to closure: structured, traceable, evidence-backed.
Every engagement runs four stages. What varies is the backlog size, the environments in scope, and the platforms we're working in.
Intake
We ingest the existing finding inventory (from Archer, ServiceNow, Vanta, Drata, Tenable, Qualys, Jira, or a spreadsheet) and establish the working baseline. Every item is accounted for and attributed to a technical control, risk classification, or framework requirement before remediation begins.
Triage
Findings are prioritized by risk impact and remediation sequence. Blocked items are flagged. Quick wins that move the posture most are sequenced first. By the end of triage, the client and partner have a confirmed working order with estimated closure timelines per priority tier.
Remediation
We work findings. Reconfiguring cloud IAM, patching Kubernetes RBAC, correcting misconfigurations at the infrastructure layer, updating access records, closing GRC platform items with evidence. Status updates flow to the partner or engagement lead on the agreed cadence.
Validation
Closed findings are validated against the control or risk requirement. Evidence is confirmed at the fidelity the context requires: auditor-grade where a framework is in scope, technical closure documentation where one is not. A before/after posture snapshot is produced at delivery.
Environments & Platforms
We work where the findings are.
Remediation is executed inside the actual environment using the platforms you already have. No scanner requirement, no platform change as a condition of the engagement.
Cloud
GCP, AWS, Azure: IAM findings, misconfigured services, overprivileged roles, storage exposure.
VPC / Private Cloud
Network segmentation, ingress/egress exposure, internal service reachability, and isolation between operational control and telemetry paths and the cloud pipelines that ingest their data.
Kubernetes
RBAC findings, network policy gaps, runtime detection coverage, node-level hardening.
On-Premises / Hybrid
Legacy infrastructure, mixed-trust zones, patch governance, host hardening.
OT / ICS
Electric substations, water and wastewater systems, and remote sites with strict change control, OT/IT boundary requirements, and post-pentest finding closure.
SaaS Stack
Identity and access hygiene, admin privilege exposure, OAuth app governance, integration surface.
Platforms
Where This Leads
Closed findings open the next engagement.
A remediation sprint produces a clean posture baseline: the right starting point for adversarial validation, AI security depth, or surface-layer control deployment.
Penetration Testing
Findings closed and controls hardened. Validate that the remediation held under adversarial pressure. A pentest after a remediation sprint tests the actual posture, not the posture as-documented.
Penetration Testing →Data Sovereignty Engineering
If the engagement surfaced AI infrastructure (LLM integrations, MCP servers, agentic pipelines) as an exposure area, that surface has a dedicated engagement. Boundary controls, access scope, and audit logging for AI-native components.
Data Sovereignty Engineering →Edge Security
Surface-layer findings from an assessment or pentest: headers, TLS posture, WAF coverage, and DMARC feed directly into the Edge Security engagement. Controls deployed at the edge, fast.
Edge Security →Questions about the engagement
How is this different from vulnerability management?
Vulnerability management is an ongoing operational discipline: continuous scanning, triage workflows, ownership cadence, and remediation tracking as a standing program. Vulnerability Remediation is a scoped engagement: a contractual commitment against a named CVE and finding inventory, each item worked to closure or an explicit risk decision, with documentation attached at delivery. The commitment shape is different (sprint vs. retainer), the deliverable is different (closed queue with evidence vs. running program), and the price model reflects it. If the vulnerability management program does not exist yet, GRC Engineering builds it. If it exists and the queue is stalled, that is this engagement.
How is this different from a vCISO engagement?
A vCISO advises: gap identification, risk prioritization, policy decisions, POA&M ownership. Vulnerability Remediation implements. We work from whatever the advisory layer produces (a gap report, a finding export, a prioritized backlog) and close items at the technical level: reconfiguring controls, producing evidence, updating GRC records, validating closure. The roles do not overlap; neither do the deliverables. MSSPs deliver continuous scanning, alert triage, and managed detection: an ongoing operational service. This engagement is scoped, finite, and ends with a closed queue and a documented posture snapshot. One sprint, one deliverable.
Does this require a compliance framework to be in scope?
No. Compliance is one context where the engagement applies, not a prerequisite. Post-pentest backlogs, incident hardening queues, pre-M&A posture cleanup, and board-driven security remediation all run the same workflow (intake, triage, remediation, validation) with documentation appropriate to the context. Framework mapping is included where one is in scope; when no framework applies, closure documentation focuses on the technical finding and the control it addresses.
Do you require us to use a specific scanner or GRC platform?
No. We work the platforms you already have: Archer GRC, ServiceNow GRC and ITSM, Vanta, Drata, FutureFeed, Tenable, Qualys, Jira. We do not bring our own scanner or require platform changes as a condition of the engagement. If the finding inventory lives in a spreadsheet, that works too.
What environments do you work in?
Cloud environments (GCP, AWS, Azure), VPC and private cloud, Kubernetes clusters and containerized workloads, on-premises and hybrid infrastructure, OT/ICS environments with strict change control, and SaaS stack access hygiene. The workflow is the same across environments; what varies is the technical surface and the tooling we use to validate closure.
Can vCISO partners white-label this?
Yes. Delivery goes to the partner first: status updates, closure reports, and evidence packages flow to you. The client relationship stays yours. If you run multiple client engagements, contact us through the partner program for volume arrangements.
Do you work hourly, or at fixed prices?
Fixed scope, at a fixed price. Standard findings use the published Findings Remediation price list (TLS Hardening Pack, Email Authentication, Edge and Header Hardening, Risk-Acceptance Memo, and Remediation Validation); anything outside the list, including a standing monthly backlog, is scoped in 24 hours and priced off your Risk Register. Integrators and partners who bring FEDLIN in behind their client's program buy the same list at partner rates.
What frameworks do you remediate against?
NIST 800-53, NIST 800-171, NERC/FERC CIP, NIST AI RMF, ISO 27001, and SOC 2. Most engagements span more than one framework; findings are triaged and closed with evidence mapped to all applicable frameworks simultaneously. Engagements without a compliance driver produce closure documentation tied to the technical control and risk classification instead.
Do you remediate findings from an OT/ICS penetration test?
Yes. OT/ICS pentest findings close under the same workflow, with the change-control and OT/IT boundary constraints that critical infrastructure requires: no disruptive patching in live process environments, compensating controls where a fix can't be applied in place, and validation methods appropriate to the equipment. The principal's own background includes NERC/FERC-CIP-regulated remediation and OT security pentest remediation, on the OT side as well as IT.
What does a typical Sprint deliverable look like?
Closed findings with evidence attached, a before/after posture snapshot showing which items moved from open to closed, and documentation confirming what changed and why it closes the gap. Where a compliance framework is in scope, findings are mapped to the relevant controls. Where one is not, documentation reflects the technical finding, the remediation applied, and the validation method.
How do we reduce our vulnerability backlog fast?
Triage by what is exploitable and what the next audit will look at first, then close configuration findings (TLS versions, cipher suites, certificates) in batches, since one change often clears many findings at once. Findings the systems cannot take a fix for get a documented treatment: risk acceptance with compensating controls an assessor can follow. Every closure ships with evidence, and your Risk Register updates as each finding moves.
What remediation timelines do assessors expect?
It depends on the framework. FedRAMP continuous monitoring expects high-risk findings remediated within 30 days, moderate within 90, and low within 180. PCI DSS Requirement 6.3.3 expects critical security patches installed within one month of release. Where a finding cannot meet its timeline, the expectation is a documented plan: a POA&M entry or deviation request for FedRAMP, and a compensating-control worksheet for PCI DSS.
What's the difference between this and GRC Engineering?
GRC Engineering builds a compliance program: GRC platform setup, control deployment, evidence pipeline, SSP development, and continuous monitoring. Vulnerability Remediation closes gaps in a security posture, with or without a compliance program in the picture. If the sprint reveals the program infrastructure needs to be built from scratch, GRC Engineering is the path forward.
Ready to move the queue?
Book a scoping call below. We'll review the finding inventory, confirm the environments and frameworks in scope, and structure the engagement from there.
From the Blog
From the field notes
How the 2026 Water-Utility Attacks Worked
The July attacks on water systems turned on internet-exposed controllers reachable with no novel exploit. An account of the compromise, how the access worked, and what closes it.
How Araptus' PNPM Security Scanner Caught Malware in My Dependencies
Self-hosting Araptus' PNPM Supply Chain Security Scanner led to discovering protest-ware hiding in transitive dependencies—before it reached production.
Anthropic's Mythos is Coming. Is your business ready?
Mythos autonomously discovers and chains zero-day vulnerabilities. The barrier to sophisticated exploitation has collapsed — and the pool of actors who can target your organization has expanded to match.
What needs to get closed?
Tell us what's open and we'll scope the remediation from there.