Vulnerability assessment
Vulnerability assessment without the noise
A wide, systematic check of your servers, networks and applications for known weaknesses. Every result is reviewed by a person before it reaches you, so your team spends time fixing real problems, not chasing false alarms.
VPN gateway missing a critical vendor security update
Apply the vendor's security update and review gateway logs for signs of earlier access.
Coverage
What we test
We agree the exact scope with you on the scoping call. These are the areas we typically cover.
Discovery
- Asset discovery and inventory
- Open services and exposed ports
- Shadow IT and forgotten hosts
Infrastructure
- Servers and operating systems
- Network devices and firewalls
- Missing patches and end-of-life software
Configuration
- Encryption and certificate settings
- Default or weak configurations
- Cloud security posture
Applications
- Known issues in web applications
- Outdated frameworks and libraries
- Security headers and cookie settings
Deliverables
What you receive
- Verified findings with false positives removed
- Risk ranking based on severity and business impact
- Clear fix guidance for each issue
- Trend comparison on repeat assessments
- Summary dashboard for management
Aligned to CVSS 3.1 / 4.0 · NIST SP 800-115
Is it right for you?
Choose this if…
- You need regular coverage across many systems
- Compliance requires quarterly or annual scans
- You want a baseline before a deeper penetration test
- Your IT team needs a prioritised patching list
Process
How the engagement runs
Scope
A 30-minute call to agree on targets, testing windows and rules of engagement. You get a fixed quote.
Map
We map what's in scope: features, user roles, integrations, and anything exposed that wasn't on the list.
Test
Hands-on testing by certified testers. Critical issues are reported to you straight away.
Report
A summary for leadership, plus a detailed finding for each issue with evidence and a specific fix.
Retest
We verify your fixes and issue an updated report and attestation letter.
FAQ
Vulnerability assessment: common questions
How is this different from a penetration test?
A vulnerability assessment looks wide and identifies known weaknesses. A penetration test goes deep and proves what an attacker could actually achieve. Many clients run assessments quarterly and a penetration test once a year.
How often should we run one?
Quarterly suits most organisations. PCI DSS requires scans at least every three months, and after significant changes.
Do you just run a scanner?
Scanners do the first pass. Our analysts then verify each result, remove false positives and adjust the severity to fit your environment.
Related
Often combined with
Penetration testing
Hands-on security testing of your web applications, networks and cloud by certified testers.
PTES · OWASP WSTG · NIST SP 800-115 Learn moreAPI security testing
In-depth testing of REST, GraphQL and gRPC APIs, covering access control, authentication and business logic.
OWASP API Security Top 10 Learn moreMobile security testing
Android and iOS app testing, including the backend APIs each app depends on.
OWASP MASVS · MASTG Learn moreFind out where you're exposed before an attacker does.
Tell us what you need tested. We'll reply within one business day with questions or a fixed quote.