4 articles on monitoring — what goes wrong, how to fix it, and how to tell the fix held.
The line between observing a site and attacking one is sharper than vendors make it sound. What passive scanning can honestly find, what genuinely needs active testing, and the tests we refuse to run — with reasons.
Two very different things are sold under one name. What posture monitoring actually watches, what a regression looks like, which checks belong on a schedule — and the honest cases where a single scan is all you need.
Before the first call, somebody on the buyer's side points a scanner at your domain. What they see, the questionnaire answers passive monitoring writes for you, and the posture ladder to climb before paying for an audit.
An agency's security surface is every site it ever shipped, including the ones nobody bills for any more. The risks specific to running many sites with a small team, the per-client baseline worth standardizing, and the honest case for monitoring as a service line.
Contact
Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.