One MSSP instead of five SaaS subscriptions
Kordax replaces the Vanta + MSSP + scanner + pen-test bundle with one platform and one accountable team. SLA-backed, globally available, and priced per seat — not per control.
What’s included
Continuous vulnerability scanning
Orchestrated across OpenVAS, ZAP, Nikto, Lynis, Wapiti, and w3af. Findings deduplicated, triaged, and assigned to owners.
Attack-surface & exposure monitoring
External asset discovery, TLS and DNS hygiene, and Have I Been Pwned (HIBP) monitoring for your corporate and customer domains.
Secure Score & posture tracking
Microsoft Secure Score and Google Workspace posture baked in, with weekly delta reporting and remediation playbooks.
Dependency & supply-chain watch
Dependabot, advisory tracking, and SBOM drift detection across your repos and container images.
Vendor & third-party risk
Ingest vendor SOC 2 reports, ISO 27001 certificates, and DPAs. Monitor expiry and flag changes before auditors ask.
Incident response on retainer
A named incident commander, a 24/7 phone line, and pre-agreed forensic partners ready for the worst day.
SLAs and response times
| Severity | Trigger | Acknowledgement SLA |
|---|---|---|
| P1 – Critical | Active exploitation or customer data at risk | 15 minutes |
| P2 – High | Exploitable vulnerability, no active incident | 1 business hour |
| P3 – Medium | Configuration drift, hygiene regression | 1 business day |
| P4 – Low | Informational, best-practice guidance | 3 business days |
Service credits apply for any missed acknowledgement SLA. Full SLA document shared under NDA during scoping.
Why SaaS teams choose Kordax over Vanta + MSSP bundles
- Senior analysts, GDPR-native data handling, and global delivery coverage.
- A single pane of glass — scanning, exposure, compliance, and vendor risk in one console.
- No Vanta + MSSP + pen-test bundle to knit together — one contract, one relationship, one invoice.
- Transparent per-seat pricing with no evidence-ingestion or control-count surcharges.
Frequently asked questions
How is this different from Vanta plus a separate MSSP?
The Vanta + MSSP bundle is essentially two SaaS contracts and two integrations that you have to stitch together. Kordax runs the scanners, the evidence, the vendor register, and the incident response from one platform and one accountable team. There is one contract, one SLA, and one escalation path.
What size company is Kordax built for?
We are opinionated about SaaS and regulated SMEs between 10 and 500 staff. Under 10 you may be better served by our self-serve tier; over 500 we introduce additional analysts and a dedicated customer success manager.
Do you replace our in-house security team or work alongside it?
Both are common. For earlier-stage teams we act as a fractional security function. For teams with a CISO or Head of Security we act as the delivery engine — running the scans, triaging findings, and owning vendor risk so your internal team can focus on architecture and strategy.
What happens during an active incident?
Call the 24/7 line or trigger the in-platform P1 alert. A named incident commander engages within 15 minutes, and we co-ordinate containment, forensic partners (if needed), and regulator communications alongside your team. You get a formal post-incident report within five working days.
How do you price managed security services?
We price per employee per month, with clear tiers for seat count and optional add-ons (pen testing, compliance consulting). Typical SME engagements land between $1,800 and $10,000 per month, all in.
Can we see what your dashboards and reports look like?
Yes. Book a demo and we will walk you through a live environment (with sanitized data) showing the scanner console, vendor register, Secure Score tile, and monthly board report.
Related work
Consolidate your stack, not your risk
Book a 30-minute demo. We will walk you through the console on a representative asset and quote a fixed monthly fee before you leave the call.
Book a demoRelated insights and breach analysis
Recent reporting and incidents that connect to this service.
- InsightDevelopment of Incident Response Plans in Security Briefings
Organizations are updating their incident response plans based on insights from security briefings.
2026-07-30
- InsightNew Malware Strain Evades Detection
Sophisticated malware strain evades traditional security measures, posing a significant threat to organizations' digital assets.
2026-07-29
- InsightRansomware Attacks Research Update
New research reveals a surge in ransomware attacks targeting organizations of all sizes, prompting urgent security response strategies.
2026-07-25
- Breach reportCISA warns of spike in attacks on water systems as Minnesota incidents probed
The Cybersecurity and Infrastructure Security Agency said in a public alert on Thursday that facilities should “remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible."
2026-07-31
- Breach reportAnthropic says its AI hacked real-world companies in three incidents
Claude maker Anthropic said its AI models escaped test environments and breached networks at three companies on the open internet.
2026-07-31
- Breach reportGoogle AI Supercharges Chrome Security, Fixing 1,072 Bugs
Google says AI found and helped fix 1,072 Chrome security bugs in two releases, dramatically accelerating vulnerability detection and patching Google’s Chrome Security team published a detailed account of how AI models have transformed their vulnerability management pipeline, and the headline figure is difficult to dismiss: in the last two Chrome releases alone, the team […]
2026-07-31