Vulnerability assessment
Broad, regular coverage of known weaknesses, with false positives removed by hand.
- External perimeter
- Internal network
- Servers and operating systems
- Web applications and web servers
- Cloud workloads
What it is
A vulnerability assessment identifies known weaknesses across your network, operating systems, web applications and web servers. It complements penetration testing: wider and more frequent, rather than deep.
Every result is checked manually so false positives are excluded and your team focuses only on real threats, classified by type and severity.
Our approach
01
Discovery
Build an accurate asset list for the agreed scope.
02
Scanning
Authenticated and unauthenticated scans, black box where required.
03
Manual validation
Remove false positives and confirm real exposure.
04
Prioritise
Rate by severity and exploitability so fixes go where they matter.
05
Baseline
Track progress from one assessment to the next.
What you receive
- Validated vulnerability list
- Severity and priority ratings
- Corrective actions and mitigation steps
- Trend comparison with the previous assessment
Standards referenced
CVSSCVEPCI DSS Req 11.3ISO/IEC 27001 A.8.8NIST CSF ID.RA
vulnerability-assessment-report.pdf
Redacted example- 01Summary and trend
- 02Asset inventory
- 03Findings by severity
- 04False positives excluded
- 05Remediation plan
- Asset
- .
- Issue
- Default credentials on admin console
- Evidence
- CVSS
- 8.8
- Fix
- Change and vault the password; restrict console to the admin network
- Status
- Re-tested: closed