Vulnerability & Incident Management

How flaws are found and fixed, and how security events are detected and handled.

Covers the NIST SP 800-171 Risk Assessment (RA), Security Assessment (CA), Incident Response (IR), and remediation portions of System & Information Integrity (SI).

Finding flaws

• Container image scanning on every push — images are checked against a continuously updated vulnerability database before they can be deployed.
• Continuous posture assessment — AWS Security Hub and AWS Config evaluate the environment against security standards around the clock, not just at audit time.
• Threat detection — Amazon GuardDuty watches for indicators of compromise using automatically updated threat intelligence.
• Application code changes pass linting and automated tests in CI before they can merge, and the API uses parameterized SQL exclusively, which structurally prevents SQL injection.

Fixing them

Rebuilding is the patch mechanism: container images are rebuilt on current base images and re-scanned with every deployment, and the serverless infrastructure (Fargate, managed database) receives provider patching underneath. Findings from scans and Security Hub are triaged by severity and tracked to closure; the working state lives in our internal compliance repository alongside the SSP.

Malicious code protection

• AWS WAF blocks malicious payloads (injection attempts, cross-site scripting, known exploit patterns) at the boundary, with managed rules that update automatically.
• Uploaded files are stored as inert objects in object storage — they are never executed by the platform.
• The platform contains no ActiveX, Java applets, Flash, or other legacy mobile-code surface.

When something happens

• Detection findings and operational alarms route to Foxx Cyber's support channel for triage and investigation, with the full multi-layer audit trail (application, API, control plane, network) available to reconstruct events.
• If an incident affects your organization's data, we notify you and share what we know as the investigation progresses.
• As a company serving the defense industrial base, we recognize DFARS 252.204-7012 cyber-incident reporting obligations (72-hour reporting) and factor them into our response procedures.