Skopein — Vulnerability Management | Pistos Information Protection

Aegis is the CISO enablement layer that runs PCS — Pistos Compliance Sentinel, the platform that turns each regulatory requirement into a scored question and keeps the evidence behind every answer. Aegis delivers CISO-level accountability two ways: Pistos supplies a named senior advisor as your designated CISO, or your internal CISO runs the program backed by the full capability of PCS.

Skopein is the built-in scanner suite inside PCS. Its seven read-only scanners read what is actually configured in your environment — not what vendor dashboards report — and map that against what attackers can see from the internet.

Each scanner is scored out of 25 into the PCS risk assessment, and every finding is prioritized, attributed, and paired with remediation guidance. The point is not to produce a longer list; it's to close gaps before an attacker or an examiner finds them first.

Windows Endpoint Scanner

Read-only checks of Windows workstations and servers — patch state, disk encryption, endpoint protection, account and firewall configuration, and drift from the written baseline.

Linux Endpoint Scanner

Read-only checks of Linux systems — package and patch currency, hardening, service exposure, and configuration drift against the standard you set.

Microsoft 365 Scanner

Reads your Microsoft 365 tenant configuration — MFA enforcement, admin roles, mail and sharing policy, and the identity settings that decide whether an account can be taken over.

Google Workspace Scanner

Reads your Google Workspace tenant configuration — two-step enforcement, admin roles, sharing controls, and the identity settings that govern access to your data.

Active Directory Scanner

Reads your Active Directory — privileged group membership, stale and dormant accounts, password policy, and the misconfigurations that let an attacker move laterally.

External Perimeter Scanner

Maps what an attacker sees from the internet — exposed services, open ports, expired certificates, and misconfigured DNS across your internet-facing devices.

Web Application Scanner

Scans agency-facing sites, client portals, and custom web applications for OWASP Top 10 flaws and the authentication weaknesses that lead to account takeover.

How Skopein fits the program

Skopein is the technical arm of the program — the one that produces evidence rather than documentation. Every finding lands on the control it answers, with the date it was found: nobody retypes anything, and the score moves because the scan moved it. Those findings drive the PCS risk assessment (inherent risk ratings are defensible because scan data stands behind them), the quarterly posture reviews (controls are scored against what was actually observed, not what was written down), and Mathisi's training content (phishing simulations pivot toward the attack patterns Skopein saw last month).

The difference between Skopein and running a vulnerability scanner once a quarter is continuity. Every scanner is read-only — it reads configuration and reports, it does not change your systems — and each is scored out of 25 into the risk assessment, so the number the scan produces is the number your assessment carries. Findings are tracked to closure, and the next scan proves the fix.

See Skopein against your environment.

Request a briefing and we will outline a Skopein engagement scoped to your stack — endpoint count, cloud footprint, public-facing assets, and the frameworks that will consume its findings.

Request a briefing