Verity for cybersecurity companies
A security business is judged on what happened to its findings. Verity tracks every one from discovery to verified remediation, per client.
Verity runs the company. Scanners, monitoring and analysis tooling stay where they are.
Verity / Practice
LiveOpen findings
1,340
Past remediation commitment
218
Analyst time on triage
61%
Evidence requests this quarter
19
Needs attention
Illustrative figures. Verity shows your own practice in this shape.
How the business runs
A cybersecurity company produces findings. Whether the business is testing, monitoring or advisory, the deliverable is a set of identified issues with severities and agreed remediation expectations. Two hundred and eighteen findings past their agreed date, unescalated, is the company failing at the part of the job that happens after the report.
The second characteristic is that remediation usually belongs to the client. The security company found it and cannot fix it, which makes tracking, escalation and evidence the actual service rather than an administrative extra.
The third is analyst economics. Sixty-one per cent of analyst hours spent on triage rather than assessment is the cost structure of the business, and the false positive load driving it is measurable and reducible per client and per source.
The fourth is evidence. Clients undergo their own audits and ask their security provider to produce the record — what was found, when, what was recommended, what was done. Four clients whose evidence sits across several tools is four difficult conversations.
The fifth is engagement scope. Fixed-fee testing that expands during delivery is margin lost quietly, and nine engagements above scoped hours is a pattern rather than an accident.
Verity holds findings through their full life, ages remediation commitments against owners, and keeps the evidence a client audit will ask for.
What Verity calls these things
What gets in the way
Security company difficulties come from owning the discovery and not the fix.
Findings are delivered and then untracked
The report is issued and what happened next lives in client email.
In Verity Every finding carries state, owner, commitment date and verification.
Remediation commitments pass without escalation
Agreed dates expire and nobody raises it until a review.
In Verity Commitments age with escalation at threshold to a named client contact.
Triage load is unmeasured
Analyst hours disappear into noise without attribution by source or client.
In Verity Time is attributed to triage against assessment by source and client.
Audit evidence has to be assembled
A client audit request requires collecting history from several systems.
In Verity Finding history, reports and verification are retained as one record per client.
Fixed-fee engagements expand
Additional testing is performed within an agreed fee.
In Verity Scope and delivered hours are compared per engagement with variance visible.
Repeat findings are not recognised
The same issue is found again in the next assessment without reference to the last.
In Verity Findings link across assessments, so recurrence is visible and reportable.
The complete system
One system across findings, engagements, clients and evidence.
Records
Each finding carries client, asset, severity, discovery date, recommendation, owner, commitment date, state and verification.
Why it matters here The finding is the product and its state is what the client is paying to have managed.
In practice Two hundred and eighteen findings past their commitment date.
Workflows
Alerts and candidate issues move through triage, assessment, reporting and verification with time recorded at each stage.
Why it matters here The ratio between triage and assessment is the practice’s cost structure.
In practice Sixty-one per cent of analyst hours on triage.
Work
Each engagement carries scope, hours, deliverables, schedule and the findings it produced.
Why it matters here Scope and delivery have to be compared to protect fixed-fee margin.
In practice Nine engagements delivered above scoped hours.
Relationships
Clients carry their environments, assets, findings history, commitments and contacts.
Why it matters here Escalation needs a named person on the client side, not an address.
In practice Open findings by client with named owners.
Control
One permission model and one audit trail, with reports, evidence and verification retained per client and finding.
Why it matters here Clients pass their own audits using what their security provider can produce.
In practice Evidence assembled for a client audit from one record.
People
Staff carry skills, certifications, engagement assignments, hours by activity and findings produced.
Why it matters here Certification currency and utilisation are both operational facts.
In practice Analyst hours by activity and engagement.
Reports and analytics
Finding volumes by severity, remediation ageing and closure, triage ratios, recurrence and engagement margin come from the records.
Why it matters here The practice is measured on what happens to findings and on analyst utilisation.
In practice Remediation closure rate by client and severity.
Verity AI
Verity AI answers from your own finding, engagement, client and time records, respects permissions, and can create assigned follow-ups.
Why it matters here The useful questions are about what is overdue and what keeps recurring.
In practice "Which findings are past commitment?" returns them by client and severity.
Communication
Escalations, status updates and report delivery attach to the finding and client.
Why it matters here An escalation that is not recorded did not happen as far as an audit is concerned.
In practice Escalation history against an overdue finding.
Orders
Engagements carry scoped hours, delivered hours, retainers and out-of-scope work with a billing state.
Why it matters here Additional testing performed inside a fixed fee is unpriced work.
In practice Delivered against scoped hours by engagement.
Schedule
Engagements are planned against analyst availability, certifications and client windows.
Why it matters here Testing windows are client-constrained and capacity is skill-specific.
In practice Engagements scheduled against certified analyst availability.
Locations
Client environments and in-scope systems are recorded with their boundaries.
Why it matters here Scope boundaries are what separate authorised work from unauthorised work.
In practice In-scope systems recorded per engagement.
Work in motion
These already happen. Recorded, the findings pipeline stops ending at the report.
Recording scope boundaries is what keeps the work authorised.
Recording false positives against their source is what reduces future triage load.
A commitment without a named owner and a date is not a commitment.
Verification, not the client’s word, is what closes a finding.
Assembling from one record is the difference between hours and days.
Verity AI
Verity AI reads the same finding, engagement, client and time records the practice creates as it works. It answers from your own practice, respects permissions, and can turn an answer into an escalation or a scope conversation.
Verity / Ask
Verity AI only returns what the person asking has permission to see.
Without chasing
Each runs from the practice’s own records at the point the condition is met.
When
A remediation commitment approaches its date
When
A finding passes its commitment date
When
A finding recurs across assessments
When
Delivered hours exceed scoped hours
When
An analyst certification approaches expiry
What you can understand
Findings, remediation and utilisation from working records.
Verity records the practice’s operations. Scanners, monitoring and analysis tooling continue as they are.
One system, different ways of seeing it
Everyone works from the same records.
Founder
Is the practice delivering and earning?
Remediation closure by client, engagement margin, analyst utilisation, triage load.
Practice lead
What is overdue and unescalated?
Commitment ageing by severity, escalations outstanding, engagement schedule, analyst capacity.
Analyst
What am I assessing?
Triage queue, assigned assessments, finding history for the client, verification tasks.
Client manager
What does this client need to see?
Open findings, commitments, escalation history, audit evidence, scope position.
Where it is used
Every finding carrying state, client owner, commitment date and verification, so the service continues after the deliverable is issued.
Commitments ageing with escalation to a named client contact, which is the part of the job most often left to a quarterly review.
Analyst time attributed to triage against assessment with false positives recorded by source, making the practice’s cost structure visible and reducible.
Findings, reports, escalations and verification retained per client, so an audit request is answered from one record.
Scoped against delivered hours per engagement, so expanding testing becomes a scope conversation rather than absorbed work.
Findings linked across assessments, so an issue found again is reported as recurrence rather than as a new discovery.
Plain-language questions across findings, remediation, analyst time and engagements, with escalations raised in the same step.
Getting there
Scanners, monitoring and analysis tooling continue and are mapped during implementation. Clients and environments, open findings with severities and commitments, engagement history, report archives and analyst records are brought across.
Implementation runs about four weeks: discovery and mapping, configuration, migration, then an ongoing operations partnership.
Questions
Verity AI answers questions from your own finding, engagement, client and time records: which findings are past their remediation commitment, which clients have the most overdue critical issues, how much analyst time went to triage, which findings have recurred. Each answer can become an escalation or a scope conversation.
Because the client is paying for issues to be resolved, not for a document. The security company usually cannot perform the fix, which makes tracking, escalation and verification the actual service rather than an administrative extra.
Time is attributed to triage against assessment, and false positives are recorded against the source that produced them. That turns a general sense of noise into a measurable load that can be reduced per client and per source.
Findings, reports, escalation history and verification are retained per client and finding, so when a client’s own audit asks what was found and what was done, the answer is assembled from one record rather than several tools.
Scoped hours and delivered hours are compared per engagement, so testing that expands during delivery surfaces as a scope or billing conversation instead of being absorbed inside a fixed fee.
No. Scanners, monitoring platforms and analysis tooling continue as they are. Verity holds the practice around them — findings, engagements, clients, commitments, evidence and analyst time.
Findings link across assessments for the same client and asset, so an issue that reappears is visible as recurrence, which changes both the report and the conversation about root cause.
About four weeks: discovery and mapping of engagement types, finding severities, commitment practice and evidence requirements, configuration, migration of clients and open findings, then an ongoing operations partnership.
That is the part of the service that continues after the report. Tell us how remediation is tracked today.