Vulnerability Assessment · Scanning
Service group: CybersecurityFind the known weaknesses in your systems before someone else does
We scan your internet-facing and internal systems for known vulnerabilities and misconfigurations, separate the urgent from the noise, and give you a remediation plan ranked by real-world risk.
At a glance
- Service
- Authenticated and unauthenticated vulnerability scanning with risk-based prioritization, as a one-time or recurring engagement
- Best suited to
- Organizations of roughly 5 to 200 employees with servers, internet-facing services or client requirements for vulnerability scanning
- Core inclusions
- External and internal scans, authenticated device scanning, false-positive review, prioritized findings and a rescan after remediation
- Explicitly not
- A penetration test: we do not attempt exploitation unless a penetration test is separately scoped and authorized in writing
- Pricing basis
- Fixed fee per engagement or monthly for recurring scanning, based on IP and device counts and confirmed in a written quotation
- Authorization
- Scanning starts only after written authorization listing the targets, windows and contacts
- How to start
- Book a consultation to list your targets and agree scan windows
What a vulnerability assessment does
A vulnerability assessment uses scanning tools to compare your systems against databases of known weaknesses, such as published CVEs, missing patches, outdated software, weak encryption settings and default or exposed services. It answers a narrow, practical question: which known weaknesses exist on the systems in scope, and which should be fixed first?
Unauthenticated scans look at a system from the outside, the way an attacker on the internet or your network would see it. Authenticated scans log in with a read-only account and inspect installed software and configuration directly, which finds far more and produces fewer false positives. We use both, depending on the target.
A vulnerability assessment is not a penetration test. We identify and verify findings, but we do not try to exploit them, chain them together or move through your network. If you need that level of assurance, a penetration test can be scoped separately, usually with a specialist firm.
Problems this addresses
Unknown internet exposure
Remote desktop, old VPN appliances, admin pages or forgotten servers are reachable from the internet without anyone realizing.
Patching that misses things
Operating system updates run, but third-party applications, firmware and server components fall behind unnoticed.
Scan reports nobody can act on
A previous scan produced hundreds of pages of findings with no indication of which ones matter.
Client and insurer requirements
Contracts or insurance applications ask for evidence of regular vulnerability scanning and remediation.
What the engagement includes
External scanning
Unauthenticated scanning of your public IP addresses and domains to identify exposed services, outdated software and weak TLS configuration.
Internal network scanning
Discovery and scanning of devices on your office networks, including servers, printers, network equipment and unmanaged devices.
Authenticated device scanning
Credentialed scans or agent-based assessment of Windows and macOS devices and servers to find missing patches and vulnerable applications.
Verification
Findings are reviewed by a person to remove obvious false positives and confirm the affected version or setting.
Risk-based prioritization
Findings ranked using severity scores, whether the vulnerability appears in the CISA Known Exploited Vulnerabilities catalogue, internet exposure and the business importance of the system.
Remediation plan and rescan
Specific fix actions grouped by owner, followed by a rescan to confirm what has been resolved.
What is in and out of scope
Targets, scan windows and contacts are agreed in a written authorization before any scanning starts.
Included
- Unauthenticated external scanning of agreed public IP addresses and hostnames
- Internal discovery and scanning of agreed network ranges
- Authenticated scanning of agreed Windows, macOS and server systems
- Manual review of findings to reduce false positives
- Prioritized findings report with remediation guidance
- One verification rescan after remediation
Not included unless separately scoped
- Penetration testing, exploitation or lateral movement
- Web application testing beyond automated checks
- Social engineering, phishing or physical testing
- Scanning systems you do not own or have no authority to approve
- Remediation work, which is quoted separately or done by your team
Tools and references
- Commercial and open-source network vulnerability scanners
- Microsoft Defender Vulnerability Management where licensed
- Common Vulnerability Scoring System (CVSS) severity ratings
- CISA Known Exploited Vulnerabilities catalogue
- Canadian Centre for Cyber Security alerts and advisories
- CIS Controls guidance on continuous vulnerability management
Who it suits
Organizations with on-premises servers
Businesses running file, database or line-of-business servers that are hard to keep fully patched.
Teams with internet-facing services
Organizations hosting VPNs, remote access, web portals or email gateways.
Contract-driven requirements
Firms whose clients, insurers or industry bodies expect periodic scanning evidence.
Benefits
- A verified list of known weaknesses instead of guesswork
- Remediation effort focused on what attackers actually exploit
- Visibility into internet exposure you may not know about
- Evidence of scanning and remediation for clients and insurers
- A repeatable baseline when scanning is recurring
How it works
Scoping and authorization
We list IP ranges, hostnames and devices, agree scan windows and emergency contacts, and obtain written authorization.
Preparation
Read-only scan credentials or agents are set up and any fragile systems are identified for careful handling.
Scanning
External, internal and authenticated scans run in the agreed windows.
Analysis and report
Findings are verified, prioritized and written up with specific remediation steps.
Remediation and rescan
After fixes are applied by your team or ours, we rescan and update the report.
Engagement options
All fees are proposed and confirmed in a written quotation.
One-time assessment
A single round of scanning with a report and one rescan, useful as a baseline or before a renewal.
Recurring scanning
Monthly or quarterly scanning with trend reporting, often paired with managed patching.
Broader posture review first
A Security Assessment if you also need to understand governance, identity and backup gaps.
Frequently asked questions
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and prioritizes known weaknesses. A penetration test goes further and attempts to exploit them to show what an attacker could achieve. We perform vulnerability assessments; penetration testing is only done when separately scoped and authorized, usually with a specialist partner.
Can scanning break anything?
Scanning is generally safe, but older devices, printers and some industrial or medical equipment can react badly. We identify fragile systems during scoping and exclude them or scan them gently in agreed windows.
How often should we scan?
Many frameworks, including the CIS Controls, recommend scanning at least quarterly and after significant changes. Internet-facing systems benefit from more frequent checks.
Do you fix the vulnerabilities?
Remediation is not part of the assessment fee. Your team can carry it out, or we can quote the work separately or cover it under a managed services plan.
Related services
Products and packages
Industries we support
Service areas
Know which vulnerabilities matter in your environment
Tell us what you want scanned and we will propose targets, scan windows and a fixed fee in writing.