Enterprise VOC services

Use Cases

The VOC (Vulnerability Operations Center) is a system that manages IT and OT vulnerabilities within an organization. This operational center ensures 360-degree visibility over your internal and external security flaws, handles contextual prioritization, and suggests, orchestrates, or performs remediations for you. Our VOC platform and services allow your organization to reduce its attack surface, master cyber risks, and reinforce data protection, limiting the pressure on the SOC, as most attacks can't simply happen!

Features & Modules

VOC Platform (core)

Our platform allows agnostic data aggregation from all the security tools in your organization (CTI, VM, EASM, ITDR, CSPM, CTEM, Endpoint and OT sensor, etc.), whereas it can benefit from solutions that are offered as part of our VOC pillar. Onboarded Vulnerability Intelligence enables your teams to evaluate the real threats posed to your specific attack surface by each of the known 300,000+ CVEs. Risk-based vulnerability management is no more a dream: aggregate and standardize all of your threat assessment practices, whether automated or hand-crafted, and enrich them with business context and your risk analysis so that you (or we) can finally create risk-based remediation plans and align their priorities with your organization's business challenges. Regardless of the security tools deployed in your organization, you (or we) ruled them all through a single console to manage data, risks and the vulnerability management cycle.

The following modules, described as standalone components part of a Continuous Threat Exposure Management suite, can be added to the core VOC platform and services:

• Brand Protection and External Attack Surface Management (EASM)
• Endpoint, Network, and Application Vulnerability
• Cloud Security Posture
• Identity Security Posture
• Bring Your Own Tools (BYOT) as our VOC platform offers 100+ connectors

Managed Services

Abilene Solutions offers a tiered model to address your vulnerability management and remediation goals. Our QOP approach with three tiers map naturally to an "advise → coordinate → execute" progression, which fits with any customers wherever they sit on the capability/capacity spectrum, without going into an all-or-nothing managed service. A few things worth mentioning into all three tiers, with depth varying by level:

Risk appetite alignment. intake at engagement start: criticality definitions, SLA targets by severity, acceptable risk thresholds, exception authority. This shapes everything downstream and prevents scope disputes.

Scope coverage decisions. which vulnerability classes we cover: traditional infrastructure CVEs, web application vulns, cloud misconfigurations, container/image vulns, identity/IAM issues, code-level (SAST/SCA), exposed secrets, attack surface findings. Many providers underestimate how messy this gets; "vulnerability" means very different things across these domains.

Tooling model. operate the customer's existing tools, bring your own platform, or hybrid. Each has trade-offs for portability, margin, and onboarding speed. We usually enforce our core VOC platform and ingest the customer's existing tools without operating them solely.

Ramp paths between tiers. Many customers want to start at Qualify and graduate to Orchestrate or Perform as trust builds. We have clean upgrade paths (data continuity, tooling continuity, SLA evolution) from one tier to the upper one.

Co-delivery with MSPs. In many engagements, especially Tier 2/3, we are working alongside the customer's existing MSP or managed patching provider. RACI is key to define explicitly who patches, who validates, who owns the SLA, to avoid finger-pointing.

Compliance alignment. Given a CMMC focus, worth noting that this service line maps directly to RA (Risk Assessment), SI.L2-3.14.1 (flaw remediation), CM (Configuration Management), and the continuous monitoring expectations across multiple frameworks. Looking for a specific compliance framework is optional in tier2 and tiers3 (out of scope in tier1).

Pricing models. Tier 1 typically prices per asset / per ticket (analyst intake). Tier 2 adds a coordination/platform fee. Tier 3 prices on outcomes, per asset remediated, per SLA tier, or as a fixed managed service with volume bands.

Tier 1 — Qualify (Advisory / Analyst-Led)

Positioning: "We make sense of the noise so your team can act with confidence."

Operational model: We work alongside the customer's internal IT/security/ops staff. We don't touch production systems. The customer retains full ownership of remediation execution.

Who it's for:

• Mature organizations with capable internal IT and patching teams who are drowning in scanner output
• Customers with strict change control or regulatory constraints that limit third-party access (defense, healthcare, financial services)
• Organizations early in their VM journey who need to build internal muscle rather than outsource it
• Customers with low risk appetite for external parties making changes

Core activities:

• Ingest findings from the vulnerability scanners and consolidate across sources
• Deduplicate, correlate, and validate findings; eliminate false positives and scanner noise
• Contextual risk scoring: combine CVSS with EPSS, KEV (CISA Known Exploited Vulnerabilities), asset criticality, exposure, and compensating controls already in place
• Prioritize against business context what's actually exploitable and reachable vs. theoretical
• Produce remediation guidance: specific patches, configuration changes, workarounds, or compensating controls per finding
• Identify root causes and systemic issues (e.g., "60% of your criticals trace back to three unpatched gold images")
• Advise on SLA design, exception handling, and risk acceptance workflows
• Executive and operational reporting; metrics and trend analysis

Deliverables:

• Prioritized remediation worklist with clear ownership recommendations
• Weekly/monthly analyst reports
• inRisk acceptance documentation support
• Program-level recommendations and KPI dashboards

SLA structure: Typically, time-to-triage and time-to-prioritize SLAs (e.g., critical findings analyzed within 4 hours, prioritized worklist delivered within 24 hours). Remediation SLAs remain the customer's responsibility.

What it explicitly does NOT include: Ticketing system integration, automation, test, and hands-on remediation, and change implementation.

TAM service: the Tier 1 VOC service is available as a module of the TAM support service, focusing on high and critical findings, leveraging a consumption-based model (service units from a pre-paid retainer) or as a forfait.

Tier 2 — Orchestrate (Coordinated / Workflow-Driven)

Positioning: "We drive the remediation process end-to-end — your teams execute, we make sure nothing falls through the cracks."

Operational model: We own the process and the coordination. The customer's IT/ops teams (or their MSP) still perform the actual remediation work, but you orchestrate the workflow, track progress, escalate, and close the loop. This is the "remediation program-as-a-service" tier.

Who it's for:

• Mid-market and enterprise customers with capable execution teams but weak coordination across silos (network, server, endpoint, cloud, app teams)
• Organizations where vulnerabilities are consistently missing SLAs because no one owns the handoffs
• Customers who want measurable VM program maturity improvement without giving up operational control
• Organizations with distributed IT or multiple MSPs that need a unifying layer

Core activities:

• Everything in Qualify, plus:
• Integration with the customer's ITSM (ServiceNow, Jira, Freshservice) — automated ticket creation, assignment, and lifecycle tracking
• Workflow design: routing rules by asset type, owner, criticality, environment
• Active remediation coordination — chasing owners, facilitating change advisory board (CAB) approvals, brokering between teams
• SLA enforcement and escalation management
• Patch and remediation campaign management (e.g., coordinated rollouts of critical patches across the estate)
• Exception and risk acceptance workflow management with documented sign-off
• Verification scanning and closure validation after the customer remediates
• Compensating control design and tracking when remediation is delayed
• Integration with CMDB to maintain asset-to-owner mapping accuracy
• Regular operational reviews with customer stakeholders

Deliverables:

• Operational remediation tickets in customer's system of record
• SLA compliance reporting (per team, per asset class, per severity)
• Campaign management plans and progress reports
• Exception registers
• Monthly/quarterly program reviews

SLA structure: Time-to-ticket, time-to-assignment, time-to-escalation, and program-level SLA compliance metrics. We are accountable for the process meeting SLA; the customer is accountable for the execution. Joint SLAs work well here.

What it explicitly does NOT include: Direct test or production patching, configuration changes, or system access. We are the conductor, not the musician.

Tier 3 — Perform (Fully Managed Remediation)

Positioning: "We find it, we fix it, we prove it's fixed. You get outcomes, not tickets."

Operational model: You take operational accountability for remediation execution. Your team (or a tightly integrated delivery partner) has the access, tooling, and change authority to actually implement fixes within agreed scopes and change windows.

Who it's for:

• Customers without sufficient internal IT capacity to keep up with remediation backlog
• Organizations consolidating MSP relationships and wanting VM execution bundled in
• Mid-market customers who've tried Qualify or Orchestrate and concluded their internal execution is the bottleneck
• Customers in high-regulation environments who need demonstrable, auditable remediation outcomes (think CMMC, PCI, HIPAA)
• Cloud-heavy customers where IaC-based remediation can be automated more aggressively

Core activities:

• Everything in Qualify and Orchestrate, plus:
• Direct remediation execution within agreed scopes:
  • Patch deployment (OS, applications, firmware) via the customer's patch management tooling or yours
  • Configuration hardening (CIS benchmark alignment, secure baselines)
  • Cloud misconfiguration remediation (often via IaC pull requests or guardrail enforcement)
  • Vulnerability mitigation through compensating controls (firewall rules, WAF policies, network segmentation)
  • Certificate renewal and rotation
  • End-of-life software replacement coordination
• Change management execution within customer's CAB processes
• Maintenance window operations and rollback planning
• Emergency response for critical/zero-day vulnerabilities (KEV additions, actively exploited CVEs)
• Post-remediation validation through targeted re-scanning
• Continuous improvement: feeding remediation learnings back into hardening standards and gold images

Deliverables:

• Completed remediations with full audit trail
• Change records and rollback documentation
• Outcome-based reporting (mean time to remediate, backlog reduction, exposure reduction)
• Audit-ready evidence packages
• Continuous tuning of automated remediation playbooks

SLA structure: Outcome-based — mean time to remediate (MTTR) by severity, percentage of vulnerabilities remediated within window, backlog reduction targets, KEV remediation timelines. This is where you can offer the strongest commercial commitments because you control execution.

Scope boundaries to define explicitly:

• Which asset classes are in scope (servers, endpoints, network gear, cloud, applications, OT)
• Which remediation actions are pre-approved vs. require customer sign-off
• Change window definitions and emergency change procedures
• Exclusions (e.g., legacy/EOL systems, custom applications without source access)