Cybersecurity
Vulnerability assessment
A vulnerability assessment gives you coverage: a broad, validated picture of known weaknesses across your assets, ranked by what is likely to be exploited, not just by score.
Why a raw scan is not enough
A default scan produces thousands of lines. Many are informational, duplicated, or false positives. Some are real but unreachable. A few are urgent and buried. Handing that file to an operations team does not get anything fixed.
We run the scans, then do the work that follows: confirm which findings are real, group them by the fix that resolves them, and rank them using the likelihood of exploitation and the importance of the asset.
Who asks for it
-
IT operations
A fix list grouped by patch and configuration change, not by individual CVE.
-
Security managers
Defensible prioritization for a remediation plan.
-
Auditors and customers
Evidence of regular assessment and follow-up.
What is in scope
-
Network and infrastructure
Servers, network devices, virtualization, storage and remote access across defined ranges.
-
Endpoints
Workstations and laptops, with agent-based or credentialed scanning where possible.
-
Web applications
Automated checks for common issues in known applications, as a lighter alternative to a full application test.
-
Containers and images
Image and registry scanning for known component vulnerabilities.
-
Cloud workloads
Virtual machines and images in AWS, Azure or Google Cloud.
-
Configuration
Baseline checks against CIS Benchmarks where agreed.
How the work runs
Prepare
Make sure scans will be accurate.
-
1
Asset scoping
Confirm ranges and owners, and identify systems that need special handling.
-
2
Credential setup
Create scan accounts so checks can see patch levels and configuration. Authenticated scans find far more than unauthenticated ones.
Scan and validate
Reduce noise.
-
3
Scanning
Run scans within agreed windows and rates to protect fragile systems.
-
4
Validation
Manually confirm high and critical findings, remove false positives and merge duplicates.
Prioritize and report
Rank for action.
-
5
Risk-based ranking
Combine CVSS with CISA KEV status, EPSS probability, exposure and asset importance.
-
6
Fix grouping
Group findings by remediation action, so one patch closes many entries.
-
7
Review session
Walk through the top issues with asset owners.
What you receive
- Executive summary and trend view
- Validated findings, ranked and grouped by fix
- Asset coverage report: what was and was not scanned
- Quick wins list
- Rescan results after remediation
Tooling and technique
We use the scanners you own where possible, or open-source options. Listing a tool is not a claim of partnership.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Asset ranges and owners
- Scan credentials or agent deployment
- Change windows for fragile systems
- A named owner for each business-critical system
What this service is not
- A penetration test
- A compliance certification
- A substitute for a continuous program
What changes afterwards
- You know your real exposure instead of a count of findings
- Operations teams receive work grouped by the fix
- Rescans prove that remediation worked
Questions people ask
How is this different from a penetration test?
A vulnerability assessment aims at coverage: it finds known weaknesses broadly. A penetration test aims at depth: a specialist tries to exploit weaknesses and chain them. We often recommend a vulnerability assessment first, then a penetration test on the most important systems.
How often should we scan?
Internet-facing systems benefit from continuous or weekly scanning. Internal assets are commonly scanned monthly. Frameworks and customers may set a minimum frequency.
What does EPSS add?
EPSS estimates the probability that a vulnerability will be exploited in the next 30 days, based on observed internet activity. It helps pick among many findings with the same severity. It is not a measure of risk to your organization specifically.
Related
-
Enterprise vulnerability management
Design and run a vulnerability management program: ownership, prioritization rules, ticket routing, exceptions and measurement.
-
Penetration testing
Authorized, manual testing of applications, networks, cloud and identities to show what an attacker could reach and what to fix first.
-
Vulnerability intelligence lookup
Look up a CVE and see its CVSS severity, whether CISA lists it as exploited and its EPSS exploitation estimate, side by side.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response