Trust and compliance

Evidence, not adjectives

You are considering giving a supplier a map of your weaknesses. This page sets out who we are, what we hold, how the platform actually works, and what we will put in writing.

  • UK Sovereign
  • NCSC ACD 2.0 Supplier
  • UK sovereign
  • Government Commercial Agency
  • JOSCAR
  • G‑Cloud 15
  • DSIT Software Security Ambassador
CREDENTIALS

What we hold, and what each one actually means

Certifications are only useful if you know what they cover. Here is the plain version.

ORGANISATION

Cyber Essentials Plus

An independently verified assessment of our own security controls as an organisation, including hands-on technical testing rather than self-assessment.

PRODUCT TRIAL

NCSC ACD 2.0 supplier

Hexiosec ASM was one of the suppliers chosen by the National Cyber Security Centre (NCSC) for its Active Cyber Defence (ACD) 2.0 trials, which contributed to the resulting external attack surface management (EASM) buyer’s guide.

PROCUREMENT

Government Commercial Agency

Available to buy through the Government Commercial Agency (GCA), which removes a procurement hurdle for public sector organisations.

SUPPLY CHAIN

JOSCAR registered

Supplier assurance for the aerospace, defence and security sector, which matters if you sit in a defence supply chain. JOSCAR is the Joint Supply Chain Accreditation Register.

COMMITMENT

DSIT Software Security Ambassador

We support the UK government code of practice for software vendors, published by the Department for Science, Innovation and Technology (DSIT), and we build to it rather than just referencing it.

FRAMEWORK

G‑Cloud 15

Hexiosec ASM is listed on G‑Cloud 15, so public sector buyers can purchase through a framework they already hold rather than running a separate procurement exercise.

NCSC ACD 2.0

Chosen for the trials that shaped UK guidance

Hexiosec ASM was one of the suppliers chosen by the National Cyber Security Centre (NCSC) for its Active Cyber Defence (ACD) 2.0 trials, which contributed to the resulting external attack surface management (EASM) buyer’s guide. The trials validated external attack surface management as a security practice and deemed it essential for effective cyber defence. The guide helps buyers assess the category on its merits rather than on vendor claims.

  • Selected as a supplier for the ACD 2.0 trials
  • Contributed to the resulting EASM buyer’s guide
  • The trials validated EASM as a practice, not one product
  • Read the guide and assess us against it
Read the NCSC EASM buyer’s guide →
NCSC External Attack Surface Management Buyers Guide
Map of the UK made of Hexiosec hexagons
UK SOVEREIGNTY

British built, British hosted, British operated

Hexiosec is a UK company based in Cheltenham, founded by engineers from UK government, defence and intelligence backgrounds. The platform runs on UK infrastructure and your estate data does not leave the country. For public sector, legal and financial buyers, this is usually the first question and the one that decides whether a tool can be bought at all.

  • Designed, built and operated in the United Kingdom
  • Estate data stored and processed in the UK
  • A UK company, subject to UK law
  • Support from the people who built the product
HOW DISCOVERY WORKS

Non-intrusive by design, so nothing has to be taken offline

Hexiosec ASM assesses exposure using publicly available information: DNS records, certificate transparency logs, routing data and what services voluntarily disclose about themselves. We do not exploit, brute force, or send traffic intended to test a weakness. That is what makes it safe to run against your own estate without a change window.

  • No exploitation, no brute forcing, no interference
  • Nothing sent that could disrupt a production service
  • Nothing installed, and no change window required
  • The same method whether the estate is yours or a supplier’s
Hexiosec ASM dashboard with abstract lines
PLATFORM AND DATA

How we handle what we find

Everything we discover about your estate is sensitive. These are the controls around it.

UK data residency

Estate data is stored and processed in Google Cloud’s London data centres, the same UK infrastructure Hexiosec Transfer runs on. It is not replicated outside the United Kingdom.

Least privilege by default

Where you connect a cloud account, access is read-only and scoped to inventory metadata. We cannot change anything in your environment.

Access control and separation

Customer data is separated, and internal access is limited to the people who need it to support you.

Audit logging

Platform and connector activity is logged, so you can see what was done and when.

Encryption in transit and at rest

Your estate data is encrypted both in transit and where it is stored.

Documentation and questionnaires

We complete your security questionnaire, share our published procurement documents, and answer specific technical questions in writing.

FRAMEWORKS

Evidence for the frameworks you answer to

Hexiosec ASM produces asset and vulnerability evidence that sits behind several UK and EU frameworks. The detail for each one is covered on our compliance page.

NCSC CAF

Asset management and vulnerability evidence for Cyber Assessment Framework (CAF) outcomes and GovAssure submissions.

NIS2

Visibility and risk management duties under the second Network and Information Systems Directive (NIS2) for in-scope operators and their supply chains.

DORA

Information and communication technology (ICT) risk management and third-party oversight duties under the Digital Operational Resilience Act (DORA) for financial entities.

DSPT

Asset and vulnerability evidence for the Data Security and Protection Toolkit (DSPT), for health and care organisations.

Cyber Essentials

Supporting evidence for the boundary and patching questions in the assessment.

Lexcel and client audits

Evidence for law firms answering client due diligence and panel requirements.

See how Hexiosec supports compliance across both products →
VULNERABILITY DISCLOSURE

We publish a disclosure route, and we use it

Security questionnaires ask whether a supplier has a vulnerability disclosure process. Ours is published, staffed and linked below, rather than described in a policy nobody can find.

Tell us directly

Report it to our security team with the detail. We will acknowledge it, keep you updated, and tell you what we did about it.

Contact the security team →

We will not come after you

Good faith research reported responsibly is welcome. We are engineers and we would want the same treatment.

FAQ

The questions security teams actually ask

Which frameworks can we buy you through?
Hexiosec ASM is listed on G‑Cloud 15 and available through the Government Commercial Agency (GCA). We also hold Cyber Essentials Plus and are registered on JOSCAR, the supplier assurance register for the aerospace, defence and security sector.
Where is our data held?
In the United Kingdom. Hexiosec ASM is UK-built, UK-hosted and UK-operated.
Do you need credentials for our systems?
No. External discovery needs nothing from you beyond a domain. The optional Cloud Connectors use read-only, least-privilege access to your cloud accounts and cannot make changes.
Could scanning disrupt our services?
No. Hexiosec ASM is designed to assess publicly accessible systems without disrupting their operation. Much of its discovery uses publicly available information without directly interacting with your infrastructure. Where direct interaction is required, our non-intrusive checks use ordinary network requests similar to those of a typical visitor accessing services over the public internet. We do not attempt to exploit vulnerabilities, modify systems or trigger weaknesses that could disrupt services.
Is it legal to scan a supplier?
Yes. Hexiosec ASM is designed to assess publicly accessible systems, including those belonging to third parties such as suppliers. Much of its discovery uses publicly available information without directly interacting with target systems. Where direct interaction is required, scanning is non-intrusive and does not attempt to exploit vulnerabilities, gain unauthorised access or modify systems. Compliance with the UK Computer Misuse Act 1990 has been a fundamental consideration in the platform’s design.
Will you complete our security questionnaire?
Yes. Send it over and we will complete it properly rather than pointing you at a portal. Tell us what contractual documentation you need and we will work through it with you.
Who owns the data you produce about our estate?
Your organisation retains ownership of its own data. Hexiosec ASM collects publicly available information about your internet-facing assets and produces security findings and analysis to help you understand your external attack surface. You can access and export this assessment data using the reporting and export features available with your subscription.
GET IN TOUCH

Ask us the hard questions

We will answer them in writing, and put you in touch with the engineers who built it.

Book a demo Contact us