External
Internet-facing hosts, services and exposed applications, from an attacker's starting point.
PYXA Consulting · services
We test it, we fix the program, we prepare the audit.
PYXA is the product. PYXA Consulting is the team behind it, available for penetration tests, vulnerability management programs, compliance audits and CISO advisory. We work with the platform underneath or with whatever you already run; buying one never requires the other.
Fixed scope and a written deliverable, not open-ended staffing.
Practitioners only. The people who built the platform run the work.
We leave you with something your own team can run without us.
EU-based · English and French · on-site or remote
Services
Four services, one team.
Penetration testing
Find what an attacker would find first, prove it, and retest until it is closed. Every finding comes with the evidence, the business impact and the fix, ranked the way a remediation team can act on.
Internal and Active Directory
Lateral movement, privilege escalation and the attack paths to Tier Zero from an internal foothold.
Web applications and APIs
Authenticated and unauthenticated testing following the OWASP Web Security Testing Guide.
Retest
Each fixed finding is tested again. A finding closes when the retest says so, not when a ticket does.
You end up withA report your engineers can act on. If you run PYXA, the findings are imported straight into it and tracked to a verified retest.
From scan results to a program that closes findings
Most programs do not fail on detection. They fail on ownership, on a priority nobody agrees with, and on closure nobody verifies.
Exposure assessment
Scanner coverage against your real asset inventory, the blind spots, and a ranked view of what matters this quarter rather than a severity histogram.
- Coverage gap analysis
- Asset inventory reconciliation
- Ranked remediation shortlist
You end up withA written assessment and a 90-day plan your CISO can take to the board.
Remediation program
Asset ownership, priority policy, SLAs the business has agreed to, campaign cadence, verification and the reporting line upward, run with your team until the rhythm holds without us.
- Ownership model
- SLA policy
- Campaign cadence
- Platform rollout
You end up withOwners, deadlines, verified closure and a monthly report nobody argues with.
Compliance audit and readiness
A gap assessment against the framework you are held to, the evidence wired into your tooling rather than assembled by hand, and a dry run of the questions an auditor will ask.
NIS2
Article 21 risk-management measures and the Article 23 reporting process: 24-hour early warning, 72-hour notification.
TISAX
The information security assessment for the automotive supply chain, ahead of the audit provider's visit.
Cyber Resilience Act
Vulnerability handling, SBOM, coordinated disclosure and the reporting clocks for products placed on the EU market.
PCI DSS v4.0
Requirements 6 and 11: vulnerability identification, timely patching and quarterly scanning, with evidence that regenerates.
The limit, statedWe are not a certification body. We assess you against the framework and prepare you for the accredited auditor, who issues the certificate.
CISO advisory
Fractional support for the part of the job that is not technical: the roadmap, the board narrative, the budget case, vendor selection, and the conversations with engineering leadership about why this quarter's patching matters more than the feature. A second practitioner in the room when the decisions are made.
How an engagement runs
How an engagement runs: four phases, and a handover that is the point.
We are not trying to become a dependency. The last phase exists to make us unnecessary.
- Phase 01 · week 1
Read the ground
Interviews with security, infrastructure and the business. What is scanned, what is owned, what is actually being fixed today.
- Phase 02 · weeks 2–4
Agree the model
Priority policy, SLA bands and ownership signed off by the people who will be held to them. This is where programs are won or lost.
- Phase 03 · months 2–4
Run it together
First campaigns, first verified closures, first honest report. We sit in the weekly meeting and fix what breaks.
- Phase 04 · close
Hand it over
Runbooks, policy documents, dashboards and the training so the program survives the next reorganisation.
What the program runs on
A monthly report nobody argues with.
When a mission runs on PYXA, the report is the Command Center: one estate score with its contributions, a chain of counts from open findings down to the ones that reach a crown jewel, and SLA performance stated with its denominator.
When it runs on your existing tools, we build the same discipline into them: a number with a denominator beats an adjective, and an unscanned asset is never reported as clean.
PYXA Consulting and the PYXA product have the same owner, and that is disclosed in writing before PYXA is discussed with a client. PYXA is never the only remediation recommendation in a paid assessment, and the product and the consulting are separate contracts.
First call
Tell us what your last quarterly report cost you in hours.
A first call is 30 minutes with a practitioner, not a qualification script. If a mission is not the right answer, we will say so.