Start from your deadline. Leave with a deliverable ready for review.
Four situations where Risk Hunter saves your experts the most time, without compromising on traceability.
CISOs and security teams
Continuous exposure & remediation
With frontier AI, disclosed vulnerabilities now number in the thousands. Your teams cannot fix everything: you need to know which ones threaten a critical service, what to do, and how to justify it.
Explore this use case: click the views
1
Collect exposure
Scan results, inventories, CMDB: assets, services, versions and vulnerabilities consolidated.
2
Link to the business
Every vulnerability is mapped to the asset, the service it supports and the relevant MITRE ATT&CK and ATLAS techniques.
3
Simulate attack paths
Attack paths and blind spots: the scenario’s likelihood is recalculated.
4
Propose the response
Fix, mitigate or accept, with a deadline and a rationale, prioritised by risk reduction.
5
Approve and prove
The CISO approves; the action is dated, attributed and linked to the requirements it covers.
Attack path · fictitious example
From a fake portal to encrypted servers
T1566.002 Spearphishing link
T1539 Steal web session cookie
T1078.004 Cloud accounts
T1087.004 Cloud account discovery
T1133 External remote services
T1018 Remote system discovery
1 · T1566.002 Document management administrators receive a targeted email leading to a fake portal, an exact copy of the cloud platform.
2 · T1539 The fake portal relays the login in real time and captures the session cookie: multi-factor authentication is bypassed.
3 · T1078.004 The attacker opens the document management cloud admin console with a legitimate account. Their activity looks normal.
… then 7 more steps through to encryption: accounts, admin VPN, data-centre servers, defences disabled, backups deleted.
Illustration: an attack path as Risk Hunter generates it, fictitious example.
Operational scenario, fictitious example
A ransomware attack, told end to end
1The attacker spots a provider’s VPN portal exposed to the Internet.
2They get in with stolen credentials, as there is no multi-factor authentication.
3They pivot to the internal network through remote desktop: a blind spot.
4They exfiltrate customer data to their server.
5They encrypt the servers: billing stops.
High likelihoodEstimated impact ≈ €1.2M
The action that breaks the chain
Multi-factor authentication and segregated provider access: breaks steps 2 and 3.
AI finds vulnerabilities by the thousand. The bottleneck is the decision.
In a single month, Claude Mythos Preview, Anthropic’s model reserved for cyber-defence partners, reported more than 10,000 high- or critical-severity vulnerabilities. The window between disclosure and exploitation keeps shrinking: detection is no longer enough, you have to decide what to fix first.
Triage by business risk
Every vulnerability is linked to your assets, your critical services and attack techniques. You see the ones that threaten the business, not just the ones with the highest score.
Propose the right response
Fix, mitigate or accept: for each vulnerability, a response with its deadline and rationale, prioritised by the risk it reduces.
Prove every trade-off
What is fixed, deferred or accepted stays dated, attributed and linked to the requirements it covers. Ready for the auditor and the regulator.
Risk Hunter does not replace your detection tools: it helps you decide which of their findings matter. At its core are our exposure decision engine and our continuous evidence engine, covered by two filed patents.
A managed service provider administers your servers remotely. If it is compromised, the attacker gets in with legitimate access. DORA and NIS2 require you to control that risk.
Explore this use case: click the views
1
Map the ecosystem
Suppliers, providers, managed service providers, and their role in your critical services.
2
Assess every third party
Dependency, penetration, cyber maturity and trust: the threat level of every third party.
3
Build the scenario
The attack that comes through the third party, and its impact on your operations.
4
Require the right measures
Your own audit templates become contractual requirements and supplier security assurance plans; likelihood is recalculated.
5
Track and prove
Measures tracked over time, linked to DORA requirements (ICT third-party risk) and NIS2 (Art. 21(2)(d)).
Actual screens: the ecosystem threat map (before or after treatment), then each third party scored on dependency, penetration, cyber maturity and trust. Demo data.
Strategic scenario, fictitious example
The attack that comes through your partner
SourceAn organised cybercrime group seeking a ransom.
Third partyYour managed service provider, which administers your servers remotely.
PathThey compromise the provider, then use its legitimate access: a blind spot.
A map of critical third parties, a threat level per supplier, your supplier audit templates, contractual clauses and security assurance plans, and a record of their implementation.
Your supplier requirements are justified by risk, and documented.
