ACE Networks

When a project closes, the SharePoint folder shared externally for that project does not close with it.

The external users — contractors, vendors, agencies — retain access until someone manually removes it from the SharePoint admin centre. In most environments that removal never happens because no process triggers it.
A SharePoint environment running for two or three years has external sharing enabled on folders that reflect every collaboration ever set up, not the current access requirements.
ACE Networks reviews external sharing configurations and identifies folders where access was granted for a specific project and never removed.

→ Get a free consultation

Cyber insurance applications ask whether MFA is enforced. A shared admin account with no MFA enrolled means it was not — regardless of what the policy document says.

When a claim is made the insurer audits the actual environment. Gaps between what was declared and what was running give grounds to reduce or decline the payout.

ACE Networks reviews security controls against insurance requirements before the renewal date.

→ Get a free consultation at acenetworks.eu

East-west traffic between internal hosts is not inspected — and that is where attackers move.

Perimeter monitoring does not see lateral movement inside the trusted zone. A single compromised endpoint reaches domain controllers with no alert fired.

ACE Networks assesses internal traffic inspection architecture to identify exactly where that movement would go undetected.

→ Get a free consultation at acenetworks.eu

A scan generates findings. It does not assign owners.

In most environments, vulnerability reports land in a shared inbox or a ticketing system with no routing logic. Critical findings sit next to low-severity items. No priority order. No owner. No deadline.

The pattern is consistent: the scan runs on schedule. The backlog grows faster than it clears.

This is not a tooling issue. It is a process governance issue.

Vulnerability findings are routed by asset criticality — critical CVEs on domain controllers and perimeter devices are prioritised, assigned, and tracked to verified closure.

→ Get a free consultation