Platform
Evidence you can hand to an auditor
Every report carries the chain that produced the finding, the steps to reproduce it, the severity rationale and the route to remediation.
Anatomy of a finding
Everything needed to act, nothing that needs interpreting
A finding is only useful if somebody who was not there can act on it. Each one carries its full provenance.
- The chain
- Each step that led from initial access to impact, in order, so the path can be followed.
- Reproduction steps
- What to run to see it again, so remediation starts from fact rather than interpretation.
- Evidence
- The captured proof that the impact occurred, not a claim that it might.
- Severity with rationale
- Why this severity, in this environment, rather than a bare CVSS number lifted from a database.
- Remediation path
- What to change, and what to re-test afterwards to confirm the fix held.
Severity
Severity reflects your estate, not a generic one
A CVSS score describes a vulnerability in the abstract. It cannot know that your network segmentation makes one issue unreachable, or that a lower-scored flaw sits directly in front of production credentials.
Because Revelion validates by exploitation, severity is grounded in what actually happened in your environment. A weakness that could not be reached does not get reported as critical, and a chain that reached data does not get discounted because its component parts scored low individually.
That is the practical difference between a queue you have to triage and a report you can act on: the prioritisation work has already been done, by demonstration rather than by scoring.
Audience
Written for the people who commissioned the test
A report that only its author can read is not evidence, it is a transcript.
- For engineers
- Reproduction detail sufficient to confirm, fix and verify without a follow-up call.
- For security leads
- What is exploitable right now, ranked by demonstrated impact rather than theoretical score.
- For auditors
- Evidence mapped to control requirements, with dates and scope attached.
- For clients
- White-label output an MSP can put in front of the customer who paid for it.
- For boards
- A summary that says what was tested, what was proven and what changed since last time.
- For retests
- Findings carry forward, so closing one is recorded rather than silently disappearing.
Compliance
Where the evidence lands
| Framework | What Revelion evidences |
|---|---|
| SOC 2 | Penetration testing activity, findings, remediation and retest evidence for the relevant common criteria. |
| ISO 27001 | Technical vulnerability management and independent testing evidence, with dated scope. |
| Cyber Essentials Plus | Supporting technical assurance alongside the assessment itself. |
| PCI DSS | Segmentation and application testing evidence, retained with the scope it ran against. |
| Client due diligence | A defensible answer to "when were you last tested, and by what". |
Judge the output, not the pitch.
Request a sample report