One MSSP instead of five SaaS subscriptions
Kordax replaces the Vanta + MSSP + scanner + pen-test bundle with one platform and one accountable team. SLA-backed, globally available, and priced per seat — not per control.
What’s included
Continuous vulnerability scanning
Orchestrated across OpenVAS, ZAP, Nikto, Lynis, Wapiti, and w3af. Findings deduplicated, triaged, and assigned to owners.
Attack-surface & exposure monitoring
External asset discovery, TLS and DNS hygiene, and Have I Been Pwned (HIBP) monitoring for your corporate and customer domains.
Secure Score & posture tracking
Microsoft Secure Score and Google Workspace posture baked in, with weekly delta reporting and remediation playbooks.
Dependency & supply-chain watch
Dependabot, advisory tracking, and SBOM drift detection across your repos and container images.
Vendor & third-party risk
Ingest vendor SOC 2 reports, ISO 27001 certificates, and DPAs. Monitor expiry and flag changes before auditors ask.
Incident response on retainer
A named incident commander, a 24/7 phone line, and pre-agreed forensic partners ready for the worst day.
SLAs and response times
| Severity | Trigger | Acknowledgement SLA |
|---|---|---|
| P1 – Critical | Active exploitation or customer data at risk | 15 minutes |
| P2 – High | Exploitable vulnerability, no active incident | 1 business hour |
| P3 – Medium | Configuration drift, hygiene regression | 1 business day |
| P4 – Low | Informational, best-practice guidance | 3 business days |
Service credits apply for any missed acknowledgement SLA. Full SLA document shared under NDA during scoping.
Why SaaS teams choose Kordax over Vanta + MSSP bundles
- Senior analysts, GDPR-native data handling, and global delivery coverage.
- A single pane of glass — scanning, exposure, compliance, and vendor risk in one console.
- No Vanta + MSSP + pen-test bundle to knit together — one contract, one relationship, one invoice.
- Transparent per-seat pricing with no evidence-ingestion or control-count surcharges.
Frequently asked questions
How is this different from Vanta plus a separate MSSP?
The Vanta + MSSP bundle is essentially two SaaS contracts and two integrations that you have to stitch together. Kordax runs the scanners, the evidence, the vendor register, and the incident response from one platform and one accountable team. There is one contract, one SLA, and one escalation path.
What size company is Kordax built for?
We are opinionated about SaaS and regulated SMEs between 10 and 500 staff. Under 10 you may be better served by our self-serve tier; over 500 we introduce additional analysts and a dedicated customer success manager.
Do you replace our in-house security team or work alongside it?
Both are common. For earlier-stage teams we act as a fractional security function. For teams with a CISO or Head of Security we act as the delivery engine — running the scans, triaging findings, and owning vendor risk so your internal team can focus on architecture and strategy.
What happens during an active incident?
Call the 24/7 line or trigger the in-platform P1 alert. A named incident commander engages within 15 minutes, and we co-ordinate containment, forensic partners (if needed), and regulator communications alongside your team. You get a formal post-incident report within five working days.
How do you price managed security services?
We price per employee per month, with clear tiers for seat count and optional add-ons (pen testing, compliance consulting). Typical SME engagements land between $1,800 and $10,000 per month, all in.
Can we see what your dashboards and reports look like?
Yes. Book a demo and we will walk you through a live environment (with sanitized data) showing the scanner console, vendor register, Secure Score tile, and monthly board report.
Related work
Consolidate your stack, not your risk
Book a 30-minute demo. We will walk you through the console on a representative asset and quote a fixed monthly fee before you leave the call.
Book a demoRelated insights and breach analysis
Recent reporting and incidents that connect to this service.
- InsightWhy Point-in-Time Penetration Tests Are Leaving SMEs Exposed Between Audits
<p>Your penetration test came back clean. The report is filed, the board has been briefed, and your compliance checkbox is ticked for another year. It feels lik
2026-09-17T03:38:35.000Z
- InsightWhy Point-in-Time Penetration Tests Are Leaving SMEs Exposed Between Audits
<p>Your penetration test came back clean. The report is filed, the board has been briefed, and your compliance checkbox is ticked for another year. It feels lik
2026-09-17T03:38:35.000Z
- InsightWhy Point-in-Time Penetration Tests Are Leaving SMEs Exposed Between Audits
<p>Your penetration test came back clean. The report is filed, the board has been briefed, and your compliance checkbox is ticked for another year. It feels lik
2026-09-17T03:38:35.000Z
- Breach reportRansomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Research shows attacks on manufacturers rose 40% in early 2026, as ransomware groups increasingly exploit the supply-chain disruption caused by operational shutdowns. The post Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows appeared first on SecurityWeek.
2026-09-17
- Breach reportIsraeli contractor BlackCore trained Angolan officials in online influence operations
An Israeli influence-for-hire company trained Angolan government officials to run online influence operations, including by creating fake social media personas and media outlets, researchers found.
2026-09-17
- Breach reportEU chief wants joint response to cyberattacks, sabotage
Delivering her annual State of the Union address in Strasbourg, Ursula von der Leyen said threats were “mounting on our soil,” pointing to recent incidents in Denmark, Lithuania and Poland and an attempted drone attack in Leipzig.
2026-09-16