Your starting point
A product and version inventory, or SBOMs, linked to the relevant systems. Scoping identifies missing data and useful context: exposure, criticality and maintenance constraints.
Loading page…
A turnkey service: CyberLifeCycle sets up and runs monitoring, assessment, false-positive handling, prioritisation, alerts and progress reports.
We match your software and versions against security advisories and vendor information. We check which vulnerabilities affect you and alert you to priority treatments.
Your products, versions and systems define the scope to monitor.
We monitor security advisories and support deadlines for your software estate.
Applicability checked, false positives documented and priorities recommended.
Alerts, metrics, reports, actions and remediation evidence tracked.
A product and version inventory, or SBOMs, linked to the relevant systems. Scoping identifies missing data and useful context: exposure, criticality and maintenance constraints.
Monitoring, matching findings to your software, checking applicability and fixes, handling false positives and setting priorities. Assessments evolve as new advisories and information become available.
Targeted alerts, an evidence-based register, an action plan, metrics and reports for your reviews. Track fixes, blockers and support deadlines.
A version remains deployed, a vendor advisory changes, a fix is postponed: monitoring continues between reviews.
Identify products, versions, systems, contacts and authorised data. Agree the decisions required, the evidence and the conditions for reassessment.
Organise sources and match findings to the versions actually deployed. Assess vulnerabilities and establish initial priorities using information from your teams.
Analyse new advisories, reassess cases and communicate relevant alerts. Update metrics and reports, track actions and prepare decisions.
An inventory export or SBOM is enough to get started. If you already use a CMDB, scanners or a build pipeline, their data can enrich the service, depending on available formats and access.
We organise receipt and updates of your exports, then link them to the relevant systems and versions. Monitoring continues while those versions remain in scope.
APIs, build pipelines and scanner results can enrich the data. Exchanges are defined during scoping, based on the interfaces and information available.
We maintain the service’s sources and methods so monitoring, assessment and reporting evolve with your requirements.
New vendor sources, CVSS updates, formats such as OSV: we assess what improves monitoring and assessment within your scope.
Read: keep tracking versions after releaseReceive relevant vulnerability and end-of-support alerts, plus reports at the agreed frequency. This example shows the management overview, assessment case files and actions to track.
The 6 instances comprise 2 confirmed, 1 uncertain, 1 excluded with evidence and 2 monitored for support.
Each action remains linked to the affected systems and the evidence needed to confirm treatment.
An action is closed on the basis of the expected evidence. A row disappearing from a report does not, on its own, prove a fix.
End-of-support tracking links every date to a vendor source, a version and the terms of the maintenance agreement.
Prepare validation work, compare migration with extended support and decide which work to commission.
Less manual triage, fewer duplicate tickets and less unnecessary work. Your teams focus on useful fixes, migrations are planned ahead and decisions are backed by clear tracking.
| Situation | Work and outcome | Benefit for your organisation | Metric |
|---|---|---|---|
| Results that need reprocessing | Assess applicability and retain the rationale | Assessment time returned to your teams | Assessment hours; reopened cases |
| Irrelevant alerts | Check the version, distribution, context and vendor fix | Unnecessary interventions avoided | Cases excluded with evidence; effort avoided |
| Duplicates | Consolidate findings while retaining affected instances | Fewer duplicate tickets | Distinct cases; affected instances; actions |
| Priorities based on CVSS alone | Combine severity, exploitation, exposure and constraints | Available capacity focused on worthwhile treatments | Priority actions; deadlines and blockers |
| Overdue actions | Assign owners, follow up and prepare decisions | Clearer, more predictable coordination | Action age; overdue items; pending decisions |
| End-of-support dates discovered too late | Verify deadlines and plan the way forward | Better-planned maintenance budgets | Advance notice; deadlines covered; approved plans |
| Scattered evidence | Organise decisions and treatment evidence | Faster review preparation | Search time; complete case files |
| Underused tools | Improve available data and exchanges | Make better use of existing investments | Manual reprocessing; useful interfaces |
Illustrative example: freeing up 20 hours a month at a fully loaded cost of €65 per hour represents €1,300 in monthly capacity, before the service fee. This is a valuation of time, not a cash inflow.
Compare the same scope and a comparable service level. If the service extends coverage, assess that benefit separately.
Setup is counted once, in the first year. If left blank, it is treated as zero.
Calculated locally: your inputs are neither transmitted nor stored. You can use a comma or a full stop for decimals. This estimate does not replace a quote.
Applicability depends on the organisation, product and role. Vulnerability management supplies technical information and evidence to support this work.
| Framework and actor | Question and contribution | Example evidence | Responsibility retained |
|---|---|---|---|
| NIS2: entities within the applicable scope | Which systems need action? Inventories, assessments and treatment tracking support risk management. | Register, dated exceptions, owners and treatment evidence. | Determine applicability, decide on and implement the required measures. |
| CRA: digital products and economic-operator role | Which supported versions are affected? Link components, new information, decisions and support. | Usable version-specific SBOMs, assessments and treatment history. | Secure development, fixes, documentation, assessment and applicable reporting. |
| DORA: financial entities under the relevant regime | How are vulnerabilities and patches tracked? Document sources, priorities, delays and decisions. | Action plans, fix tracking, retrievable evidence and decisions. | Manage ICT risks and providers; outsourcing does not transfer that responsibility. |
Official references: NIS2, Article 21, CRA, Annex I, Part II, DORA, Delegated Regulation 2024/1774, Article 10. Checked: 30 October 2026. The articles explain the scope and timetable.
| Work | CyberLifeCycle | Organisation and authorised teams |
|---|---|---|
| Information and scope | Specify required data and coverage limits | Authorise access, provide and update information |
| Monitoring and alerts | Monitor security advisories and end of support, match information to the software estate and issue assessed alerts | Update inventories and report changes in scope |
| Assessment and priority | Document applicability, unknowns and the proposed priority | Provide business context and approve the criteria |
| Decisions and exceptions | Prepare options, decisions and reassessment conditions | Decide, allocate resources and approve residual risks |
| Implementation | Track actions and blockers | Implement fixes and validation, unless specifically agreed otherwise |
| Verification and evidence | Review the agreed evidence and maintain the history | Provide evidence and validate business outcomes |
The proposal defines sources, access, confidentiality, reporting frequency and deliverables. Your teams or technical provider implement fixes; CyberLifeCycle tracks progress and supporting evidence.
CyberLifeCycle handles monitoring and vulnerability management for clients of IT service providers and managed service providers. The client retains decisions, the provider retains technical interventions, and everyone has clear responsibilities.
Explore a managed service for your clientsProducts and versions, affected instances, inventory quality, complexity, sources and interfaces, frequency, confidentiality and reporting requirements. The service is designed for continuity and priced after scoping.
Read the article for IT service providersA scoping conversation connects the service to your actual constraints.
Starting with your inventories or SBOMs, we establish the process: monitoring, vulnerability and false-positive assessment, prioritisation, alerts, metrics and reports. Your teams receive the case files and actions needed to make decisions and implement fixes.
No. Your software inventories or SBOMs provide the starting point; we handle monitoring and security information processing. If you already use scanners, ticketing tools or dashboards, we assess useful exchanges with them. Formats can include Excel, CSV, JSON, CycloneDX and SPDX.
We check the component, version, origin and conditions described in vendor sources. An exclusion retains its rationale and reassessment date. If information is missing, the case remains under investigation.
Technical severity, exploitation information, exposure and service importance are considered alongside remediation constraints. The recommended priority is explained; it is not simply the CVSS score.
Your technical teams or provider implement them unless a specific intervention is agreed. CyberLifeCycle tracks owners, deadlines, blockers and the evidence required to confirm treatment.
Scoping defines the systems, applications and versions to monitor, sources, alert channels, deliverables and review frequency. The quote reflects this scope, inventory quality and the assessment work required.
Before technical exchanges begin, we define the required data, authorised people, transfer channels and retention rules. The public form is for describing your requirements; sensitive information is exchanged separately.
The register brings together sources, assessments and decisions. The action plan links each treatment to an owner, deadline and evidence. These documents let you retrieve the reasoning and status at review time.
Yes. CyberLifeCycle can run vulnerability management from the end client’s inventories while your IT provider implements the fixes. Together we define shared data, alerts, deliverables and decision channels.
Tell us which software needs monitoring, which inventories or SBOMs are available and what you expect. A conversation defines the service to set up or improve, followed by a proposal detailing support and pricing.
Describe your scope and the problem to solve. Together we define the useful support before preparing a proposal.