When to run it
A board or LP question about portfolio cyber risk, an incident at one company, or a cyber insurance renewal.
Every portfolio company.One view of cyber risk.
Running a portfolio-wide vulnerability program
The playbook in one paragraph
Operating partners need to know which portfolio companies carry real cyber risk and whether it is going down. Ana normalizes findings across companies, ranks them by real exposure, routes fixes to named owners and verifies closure.
Works with
- Each company’s existing scanners and cloud accounts (read-only)
- Ticketing at each company
- Fund-level reporting
What Ana needs from you
- Companies in scope
- Owner at each company
- Reporting cadence for the operating team
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Connect per company
Ana connects read-only to each company’s scanners and cloud, so nothing has to be replaced.
- 02
Normalize and rank
Findings from different tools are normalized into one model and ranked by real exposure - reachable, internet-facing, privileged - across the portfolio.
- 03
Route to owners
The top risks become tickets for named owners at each company, with the fix described; where a company uses Ana’s Security Engineer, the fix PR is drafted too.
- 04
Verify closure
Closure is confirmed by re-scanning, not by a ticket status, and recorded with evidence.
- 05
Report up
Operating partners get a portfolio view of exposure and trend, company by company, for boards, LPs and insurers.
Who approves what
Approval gates
- Access at each company
- Company CTO / CISO
- Remediation changes
- Owners at each company
- Reporting outside the fund
- Operating partner
What you get
Deliverables
- 01Normalized, exposure-ranked findings per company
- 02Owner-routed remediation tickets
- 03Verified closure evidence
- 04Portfolio cyber risk dashboard
What usually goes wrong
And how Ana handles it.
Risk
Comparing apples to oranges across tools
Findings are normalized to one model before ranking.
Risk
Tickets closed without fixes
Closure is verified by re-scan.
FAQ
Common questions.
No. Ana reads from the tools they already use.
Keep going
Related playbooks.
Private equity
Technology diligence before investment committee
A deal is heading to investment committee and the technology picture is a management deck. Ana reads the whole codebase, cloud and contract set in the data room and returns an evidence-linked view of risk and value-creation levers.
Read the playbook →Private equity
The first 100 days: a technology baseline
The deal has closed and the value-creation plan depends on technology. Ana builds a baseline of code, cloud, cost and delivery health in the first weeks, so the 100-day plan rests on evidence and progress can be measured.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.