Know what you are buying before you sign.

A tactical, authorized, evidence-backed view of a target's internet-facing security posture.

MAADD is quick to stand up and led by an operator who knows where to look. It gives deal teams a clear picture of a target company's external cyber risk without access to its internal network. Working only within a signed authorization scope, Qualified Cyber assesses the target's domains and internet-facing services: email security, encryption, exposed services and known vulnerabilities. Every finding traces back to recorded evidence. You receive a prioritized report your deal team can act on, and we can re-run it before close to show what changed.

Authorized only. External only. Work starts after a signed scope. MAADD assesses what the target exposes to the internet. It is not a penetration test or an internal assessment.

§01 What MAADD assesses

Email and domain: SPF, DMARC and DKIM posture, including DKIM key strength. Exposure to spoofing and impersonation.
Encryption: TLS configuration, certificate health, and key strength by algorithm.
Internet-facing services: Service discovery and fingerprinting (TLS/JARM fingerprints, HTTP behavior). Port and service scanning only when the authorization explicitly permits it.
Known vulnerabilities: Findings enriched with NIST National Vulnerability Database data: CVE details and severity. Existing Tenable/Nessus results from the target or a third party can be imported into the same view.
Network evidence: Packet captures can be analyzed alongside live results.

§02 How MAADD is different

Authorization-first. Every action is checked against the signed scope before it runs. Anything out of scope is refused automatically, including names that resolve to internal or private addresses.
A full audit trail. Every passive check, active probe and third-party lookup is logged with a timestamp, so you can show exactly what was done and when.
Passive by default. Active scanning happens only where the engagement explicitly allows it.
Change tracking before close. A re-run shows what was fixed, what is new and what could not be verified. A finding is never marked fixed just because a probe failed.
Honest gaps. If part of a target was unreachable, the report says so, so missing data is never mistaken for a clean result.

§03 AI-assisted triage, under your data rules

AI helps prioritize and explain findings. Every AI output is labeled DRAFT and reviewed by an analyst before delivery.

A data classification for every engagement: public, confidential or CUI. It controls which AI providers may be used.
CUI stays on premises by default. Cloud AI on a CUI engagement requires a documented authorization.
Anthropic Claude is our preferred provider, directly or through AWS Bedrock. We also support OpenAI, Azure OpenAI, Azure OpenAI Government and custom or fully local models. The provider is fixed when the engagement is set up, by design.
No long-lived API keys. Cloud AI access uses short-lived federated credentials.

§04 Defense supply-chain targets

MAADD is suited to assessing companies subject to CMMC and NIST SP 800-171 and 800-53, with CUI handling rules built into every engagement. It is not a CMMC assessment. It helps a buyer find out early whether a deal carries compliance obligations nobody planned for, and whether a target's stated readiness holds up against what it actually exposes.

§05 What you receive

A prioritized findings report (PDF), with each finding tied to its evidence.
A before-and-after comparison when the target is re-assessed before close.
The engagement audit log, on request.

§06 How an engagement runs

Scope. Targets and permissions are agreed and signed. Nothing runs before that.
Assess. Passive collection first; active checks only where the scope allows. Every action is logged.
Review. An analyst reviews every finding and every AI draft before delivery.
Report, and re-run before close if you need to see what changed.

Start a confidential conversation. hello@qualifiedcyber.com · qualifiedcyber.com/maadd

Brandon McCrillis, Principal Consultant · Seeing MAADD-Diligence in your logs? See qualifiedcyber.com/scanning.