How exposed are you, really, if the ColdFusion box dies tonight?

Adobe publishes a support lifecycle per release, with core support followed by a limited extended-support window, after which no security updates are issued at all. Versions from the 2016 and 2018 era are well past that point, and 2021 is in the late part of its life. The practical test is simple: if you cannot download a current security hotfix for your exact version, published vulnerabilities against it will never be fixed. Our assessment confirms exactly which build you run and what is outstanding against it.

ColdFusion has a history of severe, actively exploited vulnerabilities — several have carried critical severity ratings and appeared on national cyber agency exploited-vulnerability lists, including unauthenticated remote code execution. Once your version is out of support these are permanent. Beyond the security exposure there is availability risk (no vendor to escalate to during an outage), compliance risk (many frameworks and cyber insurance policies require supported software), and key-person risk.

If you are still inside the support window, yes, and you should — patch promptly and get the containment basics right. That buys you time to migrate deliberately rather than in a panic. What does not work is treating patching as the permanent strategy, because the support window closes on Adobe schedule regardless of your roadmap. Patch to buy time; use the time to leave.

Yes. The assessment can run entirely on your premises or in your VDI with read-only credentials, under your NDA and your logging. We do not need write access, production credentials or customer data at any point during discovery — and a lot of what matters is in server configuration and network exposure rather than the application code.

A pen test tells you which doors are currently unlocked. This tells you why the building keeps producing unlocked doors and what it costs to move out. There is overlap on the security findings, but we also cover support status, key-person concentration, recovery capability and the cost of the exit — and we deliver a funded plan, not just findings. The two complement each other; several clients run both.

Then we tell you that and you have a documented, defensible position for your auditor, which is worth having. We would rather write a short report saying the containment is sound than manufacture urgency. It does happen — well-isolated CF applications with no public surface and a tested restore path are a genuinely different risk profile.

Almost never. Most estates have a small number of applications carrying most of the risk and most of the business value, and a long tail that is low-traffic, internal and nearly dormant. The exit plan sequences by risk, and it is entirely reasonable for the tail to sit behind network isolation for years while the important systems move first.

Discovery needs read-only access and a couple of hours from whoever knows the estate best. From signature to a draft risk register is typically two to three weeks. If you are dealing with an active incident rather than planning ahead, say so in the form and it goes to the top of the queue.