We spend most of our time helping clients build security from the inside out. Policies, access reviews, phishing simulations, vulnerability scans, compliance monitoring, audit prep. That's the core of what a vCISO engagement looks like, and it works.
But attackers don't start on the inside. They start on the outside.
They're scanning your external infrastructure for exposed services. They're searching for leaked credentials on paste sites and dark web marketplaces. They're looking for misconfigured cloud resources, forgotten subdomains, open ports, and anything else that gives them a foothold before they ever touch your internal network.
Most security programs focus heavily on internal controls and compliance requirements. That's necessary. But it leaves a gap: what does your environment look like to someone on the outside who's actively looking for a way in?
That's the gap we're closing.
What the program is:
We've partnered with a vetted security research network to continuously assess our clients' environments from the outside in. Think of it as ongoing external threat hunting, performed by experienced security researchers who approach your infrastructure the way a real attacker would.
These aren't automated scans. These are skilled researchers who look for real, exploitable vulnerabilities: exposed credentials, misconfigured services, data leaks, authentication bypasses, and anything else that creates external risk.
When a researcher finds a legitimate vulnerability, they submit it through a structured process. We review and validate every finding before it reaches you. If the finding is verified and actionable, the researcher receives a bounty based on severity. You only pay when something real is found.
How it works:
(i) No upfront cost. There's no enrollment fee, no monthly add-on, and no commitment. The program is included as part of our vCISO and managed security services.
(ii) Vetted researchers. The researchers in the program are screened and operate under clear rules of engagement. They're testing what's externally visible and accessible, not attempting to breach internal systems or access customer data.
(iii) Structured submission and validation. Every finding goes through our team before it reaches you. We validate the vulnerability, confirm it's real and relevant, assess the severity, and provide remediation guidance. You're not getting a raw feed of unfiltered submissions. You're getting verified findings with context and a fix.
(iv) Severity-based bounties. Bounties range from $200 to $1,500 based on the severity of the finding. A low-severity misconfiguration that poses minimal risk is on the lower end. A critical exposure that could lead to data access or account compromise is on the higher end. You only pay bounties on findings that are verified and actionable.
(v) Remediation coordination. We don't just hand you a report and walk away. We coordinate the remediation, verify the fix, and document everything. The finding, the response, the timeline, and the resolution all get captured in your compliance program as evidence of proactive security testing.
(vi) Compliance documentation. Every verified finding and its remediation becomes part of your security program's evidence base. When your auditor asks about vulnerability management and proactive security testing, you have documented proof that you're not just running internal scans but also actively hunting for external exposures.
Why we built this:
Three reasons.
1) Pen tests are point-in-time. A typical penetration test happens once a year. It covers a 1 to 2 week window. Your environment changes every week: new services deploy, configurations drift, employees leave, infrastructure scales. A pen test that was accurate in March may not reflect your environment in September. Continuous external research fills the gap between annual pen tests.
2) Internal vulnerability scans don't catch everything. Automated scanners are good at finding known CVEs and configuration issues from the inside. They're not good at finding what's visible from the outside: leaked credentials on third-party sites, exposed admin panels on forgotten subdomains, misconfigured S3 buckets, open API endpoints that bypass authentication, or data that shouldn't be publicly accessible. External researchers think differently because they're approaching your environment the way an attacker does.
3) Our clients shouldn't have to choose between security and budget. A full-scope external penetration test costs $8,000 to $15,000 per engagement. For companies that need continuous coverage, that's $24,000 to $45,000 a year if you're testing quarterly. The bounty model flips the economics: there's no cost until something is found, and when something is found, you're paying $200 to $1,500 to learn about a real vulnerability before an attacker exploits it. That's the best ROI in security.
What this doesn't replace:
This program complements your existing security program. It doesn't replace the fundamentals.
It doesn't replace penetration testing. A structured pen test with defined scope, methodology, and a comprehensive report is still valuable. The pen test goes deeper within a defined scope: testing business logic, chaining vulnerabilities, attempting privilege escalation, and simulating a full attack path. The vulnerability research program casts a wider net but doesn't go as deep on any single vector. You need both.
It doesn't replace vulnerability scanning. Internal and external vulnerability scanning on a regular cadence catches known CVEs and configuration drift. That's automated, continuous, and covers your entire asset inventory. The research program catches the things scanners miss: logic issues, credential exposures, misconfigurations that require human judgment to identify.
It doesn't replace your security program. Policies, access management, incident response, compliance, training, monitoring. The program adds a layer on top of all of this. It's the “what are we missing?” check that most companies never do continuously.
What we've seen so far:
Without naming specific clients or findings, here's what external security researchers typically uncover:
Exposed credentials. API keys, database connection strings, and authentication tokens committed to public repositories or cached in publicly accessible files. This is more common than most companies think, especially at startups where developers move fast and don't always check what's in their commit history.
Forgotten infrastructure. Staging environments, development servers, and test instances that were stood up months ago and never decommissioned. They're running outdated software, have weaker access controls than production, and sometimes contain copies of real customer data.
Misconfigured cloud resources. S3 buckets, Azure blobs, or GCP storage with overly permissive access. Elasticsearch instances exposed to the internet. Admin panels accessible without VPN. These findings are routine and they're exactly the kind of thing that leads to headlines.
Email and DNS misconfigurations. Missing SPF, DKIM, or DMARC records that enable email spoofing. Dangling DNS records pointing to decommissioned services that can be hijacked. Subdomains pointing to services you no longer control.
Information disclosure. Verbose error messages, directory listings, server version headers, and debug endpoints that leak information about your technology stack. Individually these are low severity. Combined, they give an attacker a roadmap.
Who this is for:
The program is available to all Com-Sec clients on vCISO and managed security engagements. If you're already working with us, this is rolling out to your environment as part of your existing services.
For new clients, the vulnerability research program is included in our standard vCISO engagement alongside access reviews, phishing simulations, vulnerability scanning, GRC monitoring, policy management, and all the other services we provide.
If you're a company that handles sensitive data, operates cloud infrastructure, and wants to know what your environment looks like from the outside, this is built for you.
The compliance angle:
For companies pursuing or maintaining SOC 2, HIPAA, HITRUST, or ISO 27001, this program directly supports several control areas:
Vulnerability management. Evidence of continuous vulnerability identification beyond automated scanning. Auditors increasingly expect more than just quarterly Nessus scans.
Risk assessment. External findings feed directly into your risk register and risk treatment plans. Real vulnerabilities identified and remediated are stronger evidence than theoretical risk assessments.
Monitoring and detection. The program demonstrates that you're actively monitoring for external threats, not just internal ones.
Incident response readiness. Finding vulnerabilities before they're exploited is the best form of incident prevention. Documented remediation of external findings shows your program is proactive, not reactive.
Third-party testing. The research is performed by independent, external security professionals. This satisfies the “independent testing” expectation that many frameworks and enterprise customers require.
How to think about the cost?
The math is straightforward.
A verified critical finding that could have led to a data breach costs you a $1,500 bounty. A data breach at a startup costs $50,000 to $500,000 in incident response, legal fees, customer notification, regulatory penalties, and lost business. The bounty is a rounding error compared to the alternative.
Most clients will see 2 to 5 verified findings per quarter, typically in the $200 to $800 range per finding. That's $400 to $4,000 per quarter for continuous external security research. Compare that to a quarterly pen test at $8,000 to $15,000.
And if the researchers don't find anything? You pay nothing. That's either because your external posture is solid (good news) or because you have a small attack surface (also good news). Either way, you've confirmed something valuable.
Getting started:
If you're an existing Com-Sec client, there's nothing you need to do. We're rolling this out across our client base and we'll include findings in your regular reporting.
If you're not a client and you're interested in the program as part of a vCISO or managed security engagement, reach out. We'll walk you through the scope, the rules of engagement, and how it integrates with your existing security program.
The best security programs don't just build walls. They check whether the walls have gaps. That's what this program does.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.