The route map
How an attacker could get from what is exposed to what matters most, and where our view stops.
Anneal
More findings than you can fix?
Fix the few weaknesses that open the most routes into your systems.
Anneal shows your security team the few fixes that close the most ways into your systems, and checks that each fix worked.
- Map the routes in
- Prove what is real
- Make those fixes, and check each one worked
Your scanners find more than any team can fix.
Every week brings new weaknesses across your cloud accounts, your code and your servers. Most tools rank them by severity alone, so hundreds look urgent at once. The list grows faster than your team can work through it.
You have to choose what to leave open. If an attacker uses the one you left open, you answer for the breach.
Your team should spend its time fixing what attackers can use, not sorting a list.
At Equifax, one missed server was enough.
76 daysattackers inside, through one server the patching missed
In March 2017 the US government warned of a serious flaw in widely used web software, and a fix was already available. Equifax patched its systems, but missed one internet-facing server, and a scan a week later did not catch it.
Attackers came in through that server, found stored usernames and passwords, and used them to reach 48 more databases. They were inside for about 76 days before anyone noticed. In the UK, the Financial Conduct Authority fined Equifax Ltd £11.2 million in 2023 for its role in the breach, and called the attack "entirely preventable".
US Government Accountability Office, 2018, and Financial Conduct Authority, 2023. GAO report, FCA notice.
Anneal tells you which system carries the flaw, which route it opens, and if your fix closed it. See how, step by step
After Anneal
What you get after Anneal.
- A short fix list your team agrees on, ranked by how many routes each fix closes.
- Findings your engineers accept, because each one comes with the steps to reproduce it.
- "Fixed" means closed: every fix is checked again after it is made.
- For systems you cannot patch, you get a firewall or web filter rule that blocks the route.
- A clear answer for your board: which routes were open, which are now closed, and what is left.
Your list of findings will always be longer than your team can clear. Anneal starts from the routes an attacker could take.
For every item on the list, Anneal shows why it is there and how to reproduce the weakness.
You can see why each fix is ranked where it is.
Every priority shows the inputs behind it, and your team can work the score out by hand from those inputs. The method is written down in full.
Anneal is built on public sources your team already trusts: the US government's list of weaknesses already being used in real attacks (CISA's Known Exploited Vulnerabilities catalogue) and the industry's published likelihood-of-attack scores (FIRST's EPSS). Anything on the government list goes straight to the top.
A weakness only reaches your list when an automated check on the sealed copy shows it is real. Anything that cannot be reproduced is dropped.
The Anneal method
Anneal works in three steps: map, prove, close.
- 1
Map
Anneal connects to one part of your systems with read-only access and maps the routes an attacker could take, from what faces the internet to the systems that matter most. Systems that sit on many routes rise to the top, because one fix there closes several routes at once.
- 2
Prove
Anneal tests the likely routes on copies of your systems, sealed off from your network. A weakness makes the list only when a check proves it is real, and it comes with the steps to reproduce it.
- 3
Close
You get the few fixes that shut the most routes. Each fix is tried on a copy first: the same check runs before and after, and the fix passes only if the weakness is gone and the system still works. When your team has made the change, Anneal runs the check again.
Our promises
What we promise before you start.
- Anneal starts with read-only access. Nothing changes in your systems without your written approval.
- Testing happens on sealed copies, with no connection to your network or your live systems.
- You set the scope: which systems, which tests, and when testing stops.
- Every priority shows its reasoning, and every finding shows how to reproduce it.
- We agree in writing what leaves your environment before anything is shared.
- Each step is scoped and agreed on its own. You decide the next step after you see the result.
- You keep the route map, the fix list and the evidence.
What you receive
Three things, all yours to keep.
The fix list
The few changes that close the most routes, each with its reasoning, its proof and a tested fix. For systems you cannot patch, a ready-to-apply firewall or web filter rule.
The re-check report
Which routes are closed after your team's fixes, and which are still open.
How to start
Recommended first step
The Anneal Pilot
One part of your systems, such as one cloud account or one internet-facing service. Anneal maps the routes in, proves which are real, gives you the few fixes that close the most, and checks them again once your team has made them. Scope agreed in writing before we start.
- Week 1Connect read-only and map the routes. You check the map.
- Week 2Test the likely routes on sealed copies. You receive the fix list.
- When your fixes are inAnneal checks again. You receive the re-check report.
Already have a penetration test report? Bring it. We can start from its findings.
Want a report for your board on how far one system could take an attacker? Email us.
Is Anneal right for you?
Who it is for
Security teams whose scanners find more than they can fix, running on AWS, Microsoft Azure, Google Cloud or Kubernetes, with code on GitHub.
What we need from you
Read-only access to the agreed part of your systems, your existing scanner results if you have them, and one person who can approve changes.
For each person in the decision
- Head of security operationsA short list your team can finish, in place of a long list it cannot. Every item shows why it is there.
- Engineering leadEach fix arrives tested on a copy, with the steps that prove the weakness and the check that proves it is gone. Your team makes the change, on your schedule.
- CISO and riskA plain answer for the board: which routes were open, which are closed, what is left, and why.
- Data protectionRead-only access, testing on sealed copies, and a written agreement on what leaves your environment before anything is shared. A data processing agreement is ready.
- Finance and procurementFixed scope, agreed stage by stage. The next step is your decision after you see the result.
Works with what you already use.
- Cloud and codeAWS, Microsoft Azure, Google Cloud, Kubernetes and GitHub, with read-only access.
- Your scanner resultsImports findings from Tenable, Qualys and Snyk, and adds endpoint information from CrowdStrike.
- Public sourcesCISA's Known Exploited Vulnerabilities catalogue and FIRST's EPSS likelihood scores.
- AlertsSlack, PagerDuty, email or your own webhook.
Questions we are asked first.
How is this different from our scanner?
Your scanner finds weaknesses. Anneal works out which of them open a route to the systems that matter, proves they are real, and checks the fix. It can start from your scanner's results.
Do you need access to our live systems?
Read-only access to the agreed part. Testing happens on copies sealed off from your network.
Will Anneal change anything in our systems?
Only with your written approval. In the pilot, your team makes every change.
Where does Anneal run?
For the pilot, inside your environment. We agree the details, and what leaves your environment, in writing before anything is connected.
What happens to systems we cannot patch?
You get a firewall or web filter rule that blocks the route, and it is tracked like any other fix.
How long does a pilot take?
Two weeks to the fix list for one part of your systems, then a re-check once your fixes are in.
Who owns what at the end?
You keep the route map, the fix list, the evidence and the re-check report.
How is it priced?
Each step is fixed in scope and agreed before it starts. Price is set out in the written scope.
How Anneal works.
Anneal connects to your cloud accounts, code repositories and existing scanner results with read-only access. It builds a map of which systems can reach which, and scores each weakness on four things: how likely it is to be used in real attacks, with anything on the US government's list of actively used weaknesses going straight to the top; how far an attacker could get from that system; how exposed it is to the internet; and whether anyone is still using it, since systems nobody has touched for months are less likely to be watched. Systems that sit on many routes score higher, because one fix there closes several.
For the top routes, Anneal tests a copy of each system in a sealed container with no network connection, and keeps a weakness only when an automated check proves it. For each proven weakness it drafts a fix, applies it to a copy and runs the same check again. The fix passes only if the weakness is gone and the system still works.
Read more: the technical detail
- The scoring, in full. Four inputs per weakness: likelihood of use in real attacks (the government list first, then the published likelihood score), how far an attacker could get from that system, how open it is to the internet, and whether the system is still in use. A system on many routes scores higher. Every input is stored with the finding, and the method is written down.
- How tests are sealed. Each copy runs in a container with no network connection at all. Nothing it does can reach your network or your live systems.
- How fixes are tried. The same automated check runs on the copy before and after the fix, together with the service's own health check. A fix that removes the weakness but breaks the service fails.
- Systems you cannot patch. A firewall or web filter rule that blocks the route, written for the system in question and tracked like any other fix.
- Approval. Nothing changes in your systems without written approval from the person you name. In the pilot, your team makes every change.
Bring us the backlog you cannot finish.
Anneal shows you the few fixes that block the most routes in.
Email us about your systems and what worries you most. We reply with a pilot plan for the part of your systems that matters most.
Sovereign