Key takeaway
Before work begins, agree the responsible contacts, testing targets, schedule and report delivery process. The program described by Xcitium provides reports through the Insight portal.
Gap assessment: questionnaires and report
A gap assessment identifies gaps by comparing an organization’s cybersecurity controls with a relevant industry framework. In the program described by Xcitium, administrator and IT contacts answer their sections in the Insight portal: governance, policies, vendors and incident decisions belong in the administrative section; infrastructure, access, patching, backups and logs belong in the technical section. Once both parts are submitted, responses are reviewed or audited depending on the selected service. The final report and recommendations are available in the portal.
Vulnerability scanning and penetration testing differ
Vulnerability scanning uses automated tools to identify weaknesses; it does not exploit them. A penetration test manually exercises vulnerabilities to assess possible access and control within an agreed scenario. For that reason, scope and authorization should be approved in advance for both services. Xcitium’s FAQ limits external scans and tests to the public IPs and domains supplied by the customer; interconnected external systems are not accessed.
Provide targets and a testing window
In the customer information (KYC) form, list all public IPs, domains and ranges, including those you consider inactive, and state whether you use dynamic IP addresses. This can help reveal forgotten internet-connected devices. The private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are not targets for external scans. Choose a testing window in the form and contact support if it needs to change. Xcitium’s FAQ describes scans as usually off-hours and under an hour, reports as expected the next business day, and penetration tests as averaging two to six weeks depending on scope. Agree the schedule and report delivery date for your own engagement separately. The described program provides reports through Insight; do not share login credentials.
Prepare participants for simulations and training
In the program described by Xcitium, phishing simulations are sent to organization-provided work addresses; personal email is not used. Update the participant list in the portal individually or in bulk, check addresses for typos and tell staff about Xcitium’s advance “Cybersecurity Test” notice. People added to a configured training course are enrolled automatically and receive a welcome email with login details. Course modules appear under “My courses” in the training account.