pentaROOT / independent practice

Turn vulnerability scanning into vulnerability reduction.

I design and automate vulnerability management programs and produce evidence that stands up to compliance review. I work with enterprise VM teams, mid-market IT and security leads, and defense industrial base subcontractors.

Book a 30-min scoping callor hello@pentaroot.com

Services

  1. 01

    Vulnerability Management Program & Automation

    Program build or rescue, often starting with an assessment, then scanner tuning, KEV/EPSS prioritization, scan-to-ticket pipelines and SLA reporting.

    Scope this

  2. 02

    Compliance Evidence

    NIST 800-171 / CMMC Level 2, HIPAA and PCI. Scan and remediation data turned into evidence an assessor can trace, with an honest account of what scanning can't prove.

    Scope this

  3. 03

    Security Architecture & Advisory

    Reviews of segmentation, identity, logging and new applications, advisory hours, or a retainer.

    Scope this

Running a large program? I rescue stalled programs and automate scanner operations at scale.

How it works

  1. Scope.

    A 30-minute call about your environment, scanner, compliance driver and timeline, then a written scope.

  2. Deliver.

    Fixed scope or retainer, with a check-in cadence agreed at kickoff.

  3. Hand off.

    The automation, evidence and runbooks stay with your team.

Credentials

10 years in security, after 10 in IT operations.

Industries: healthcare and medical devices · defense and government · financial services and insurance · manufacturing, retail and consumer goods · technology and security

From the lab

A vulnerability scanner that shows its work, and admits what it didn't see. In private development. What I'm building, and why

EXAMPLE-0001
  verdict : [ok] NOT AFFECTED
  basis   : vendor fix included in installed build

EXAMPLE-0002
  verdict : [?] NOT ASSESSED
  reason  : package inventory incomplete
  note    : this is not a clean result

Control evidence (synthetic set; scanner-assessable portion only)
  CTRL-A  [ok] checks satisfied  scanner checks ran, no open findings
          (not a whole-control attestation)
  CTRL-B  [?] not assessed       policy can't be evaluated from observed state
  CTRL-C  [!] GAP                1 open finding cites this control
Illustrative. Synthetic test fixtures only; no customer or lab-run data.

Tell me about your environment, your scanner and what is driving the work.

Book a 30-min scoping call