When you go to a hairdresser, on the other hand, you are not buying the scissors. They are part of the service, of course, but above all there are twenty years of craft: the hand that knows where to cut, the eye that understands which cut works on your face. You are paying for the result, not for the tool.

Something similar happens in cybersecurity, and almost nobody says it out loud: when you buy a security product, you are not buying the skills to use it. Those stay with whoever sold it to you.

That is why, at Orizon, we do not develop products but services. And a service, unlike a product, is not described with a data sheet: it is told as a journey. What follows is ours, in four questions.

To make it concrete we will use a fictional company — we will call it Acme Enterprise & Co.: one hundred and eighty employees, three plants, a supplier portal, a cloud ERP and an IT department of four people who, as in most companies, look after everything. It is not a real case, but every step is plausible, and you will probably recognise some of them.

And it is not the kid in a hoodie in a basement: that image has done us harm, because it got us used to thinking of attacks as random and amateurish. Today's attacker is an organisation, with a business model, roles and profitability targets. Before investing, they study the market: your turnover, what a day of downtime costs you, how exposed you are, who your suppliers are. They do exactly what you would do before opening a negotiation.

The first question, then, is theirs: what does someone looking at me from the outside see?

RECON Essentials answers that one. It is an External Attack Surface Management service: it analyses what your company exposes on the Internet by looking at it from outside, exactly as an attacker would, in a completely passive way. No agent to install, no credentials to hand over, no impact on the systems. All it takes is the main domain and the VAT number; for groups, the domains of the individual companies are added and a consolidated view is produced.

Within minutes the engine enumerates domains and subdomains, resolves IP addresses, identifies exposed ports and services, recognises the technologies in use and correlates them with known vulnerabilities — the CVEs — with CVSS scores and a flag for those in the CISA KEV catalogue, that is, the ones whose exploitation in the wild is documented. The result is an aggregated risk score and a report that a non-technical reader can follow, including a NIS 2 classification.

Acme Enterprise & Co. thus discovers sixty-three subdomains, not the twelve it thought it had. Among them is the supplier portal of a project closed two years ago, still online, still reachable. And there is a VPN concentrator running a firmware version that appears in the catalogue of exploited vulnerabilities.

Nobody had hidden anything. It was simply that nobody was looking in that direction.

This is not a theoretical scenario. An attacker who compromises a single computer — a stolen credential, an opened attachment, a hijacked session — does not stop there: they move laterally towards everything else. And from the inside the landscape is different: misconfigurations, software never updated, forgotten hosts, services nobody is monitoring.

RECON Internal looks at the network from that point of view. It is the internal counterpart of Essentials: a dedicated virtual machine is started on the corporate network and, from that moment, works on its own. It maps hosts and devices on private IP addresses, internal ports and services, recognises the technology stack of every asset, correlates vulnerabilities from several sources and detects misconfigurations. An Evidence Gating step automatically discards false positives, because a list full of noise helps no one. The virtual machine analyses in read-only mode, without modifying the systems.

The report has the same format as Essentials, with the addition of a comparison between the external and the internal view: and it is precisely that comparison that proves most useful, because it shows the distance between what you expose and what you risk.

At Acme Enterprise & Co. the internal view tells a different story. The server that handles production orders has a file-sharing service with a configuration left open during a migration back in 2023. Two shop-floor machines run an out-of-support operating system, kept alive because they drive a piece of equipment the vendor no longer updates. None of this appears in the external view. None of it is a glaring mistake. Together, they are a corridor.

For years we measured risk in bits — vulnerabilities, severity scores, three-hundred-page reports with thousands of red lines. But knowing you have a vulnerability tells half the story. The other half is knowing whether that vulnerability, in your specific context, is really exploitable, and what would happen if it were.

Risk is not a technical attribute: it is tailored to you. The same vulnerability has completely different consequences for a bank, for a three-person professional firm, for a make-to-order manufacturer.

Fireline answers this third question. It is our AI-powered penetration test: it takes the surface and the candidate vulnerabilities and puts them to the test the way an attacker would — with written authorisation, in an isolated environment, without installing anything or interrupting the company's work.

The engine works in phases: reconnaissance, multi-source CVE validation, false-positive filtering, construction of the attack graph with complete chains mapped to MITRE ATT&CK, and finally active validation against the real targets. Priority is set not by theoretical severity alone, but also by the likelihood that the vulnerability is actually exploited, as measured by its EPSS score.

The principle that holds the whole service together is the discipline with which findings are reported: nothing is inflated beyond what has been demonstrated. In a typical analysis the engine starts from hundreds of potential findings and discards the vast majority as irrelevant or not exploitable. What remains in the report is what matters, verified one by one.

For Acme Enterprise & Co. the result is not a list but a sentence: from the forgotten supplier portal, an attacker can reach the ERP credentials in three steps. The VPN concentrator turns out not to be exploitable after all: an access rule protects it. The two out-of-support machines are not reachable from outside, but they are from the office network.

The plan that comes out of it is organised by timeframe: what to do now, what within the week, what in the next maintenance cycle. It is not a theoretical list: it is a list of things to do.

An attack is not a moment. It is an event that unfolds over time, often at night, often with valid credentials and legitimate tools, often without leaving obvious traces on any single system. Catching it takes someone who watches continuously.

Oversight is our SOC as a Service: a managed Security Operations Center, active 24 hours a day, 7 days a week. It collects logs from the sources already present in the company — endpoints and EDR, firewalls, servers, identity providers, cloud environments and applications — normalises them to a common schema, correlates them and retains them in a Security Data Lake. When something surfaces, the correlated alerts are reassembled into an attack story: the coherent reconstruction of an attack, from the first signal to the last step observed.

And this is where the service differs from what many customers are used to. A traditional SOC detects, triages and notifies: "suspicious activity on server X, we recommend isolating the machine". From there on, the company is on its own. Oversight instead delivers a completed investigation: the timeline of events, the evidence, the systems and accounts involved, and the remediation guidance — what to fix, on which systems, in what order and how to verify that the action has worked.

The service can be extended with three add-ons: DX Data Explorer, which lets the customer independently query the same data the analysts work on; Cold Storage, which keeps the logs in an encrypted, integrity-checked archive well beyond the short retention window of traditional SIEMs, for the audits and investigations that arrive months or years later; and Dark Web Intelligence, which finds exposed corporate credentials and sessions before they are used.

At Acme Enterprise & Co., a few months later, a night-time VPN login from an address never seen before opens a sequence that in the past would have gone unnoticed. Not this time: it is seen as it happens, reconstructed, and the company receives not an alarm but a plan.

Knowing what you expose raises the question of what happens if someone gets in. Knowing what is inside raises the question of what is really exploitable. Knowing what is exploitable raises the last and most uncomfortable one: and while we sort all of this out, who notices if something happens?

RECON Essentials shows you how they see you from outside. RECON Internal shows you what you risk from inside. Fireline tells you what can actually hit you, and in what order to act. Oversight watches, every day, over what actually happens.

You do not have to walk the whole path, and you do not have to walk it in this order: each service makes sense on its own. But the thread is there, and it is the reason these services were built on the same platform and the same ecosystem, rather than as four separate products that you then have to get talking to each other.

AI is neither the solution nor the problem: it is a multiplier. It multiplies the capability of those who attack you — and you can see it in the rising quality of phishing campaigns and in the speed of attacks. And it multiplies our ability to defend you, on one condition: that it is governed.

We use it to do what a machine does better and faster than a person: correlate large volumes of data, discard the noise, reconstruct sequences, carry out the repetitive work of investigation. But there is always someone behind it. The specialists in our SOC guide the AI, read its output and decide — because a model can be wrong, and in security an error never carries the same weight in both directions.

The same level of service we deliver to a large organisation is available to mid-sized companies, small businesses and professional firms. Not because a reduced version exists, but because we have changed the way these services are delivered and bought.

This is a practical point, not an ideological one. In Italy today, security talent is hard to find and even harder to retain: you hire, you train, and after two years that person leaves, taking the knowledge of your environment with them. In this scenario, a managed service is not a second-best alternative to doing it in-house. It is often the only viable route.

We are here to say something else: when it happens — and sooner or later it happens to everyone — the difference will not be whether you come out unscathed, but how well you manage to stay on your feet. Systems are restored from backup, with a good plan, in a few days; the trust of customers, partners and banks takes years to rebuild. Assuming it is rebuilt at all.

Our craft is to reduce the probability that this moment arrives and, if it does, to handle it so that it costs as little as possible.