Vulnerability Assessments
Vulnerability assessment services for UK organisations that need a regular, honest picture of their known weaknesses. Every result is checked by a tester before it reaches you, so the report lists what is real rather than everything a tool printed.
What the Assessment Is
A vulnerability assessment scans your systems for known weaknesses: missing patches, outdated software, default credentials and insecure configuration. It covers a lot of ground quickly and it is repeatable, which makes it the right tool for checking patch progress between penetration tests. It is not a penetration test. Nobody tries to chain findings together or prove what an attacker could do with them. We say that plainly because plenty of suppliers sell one as the other.
Why a Person Reviews It
Raw scanner output is long, repetitive and full of findings that do not apply. A version flagged as vulnerable on a system where the affected feature is switched off. The same missing patch reported as a separate critical on every host. Before anything reaches the report a tester confirms what is real, removes the noise and rates each finding on what it means in your environment. You get a list your team can work through rather than a document to file.
Where It Fits
Regular vulnerability assessments stop known issues piling up. A penetration test once a year shows what an attacker could do with the ones that remain. Most organisations need both at different intervals. If an insurer or a customer has asked you for a penetration test, a vulnerability assessment will not satisfy them and we will tell you so before you buy one.
What You Get From the Assessment
Findings That Apply to You
Every result checked by a tester. False positives are removed before the report is written.
A List in Priority Order
Findings ranked by what they mean in your environment, so the most serious are fixed first.
Progress You Can Measure
Repeat the assessment on a schedule and watch the open findings fall from one report to the next.
Ground Cleared for Testing
Known issues fixed before a penetration test, so the tester’s time goes on the problems a scan cannot find.
How the Assessment Runs
We agree the scope in writing first: the servers, workstations, network devices, cloud resources or web applications to include, internal, external or both. Scans run with tooling configured to avoid disruption, out of hours where a system is sensitive. Each result is then reviewed by a tester, who confirms what is real, removes false positives and merges duplicates. Every remaining finding is rated on severity, exploitability and impact in your environment. The report sets out what was found, what to fix first and how to fix it. A free retest confirms the fixes held.
At a Glance
Scope Definition
Servers, endpoints, network devices or cloud resources agreed in writing.
Automated Scanning
Scans for known CVEs, missing patches, default credentials and misconfiguration.
Manual Review
Every result checked by a tester. False positives and duplicates removed.
Risk Rating
Each finding rated on severity, exploitability and impact in your environment.
Report & Retest
Detailed findings with risk ratings and tailored remediation guidance. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and lists known weaknesses using automated scanning, with a tester reviewing the results. A penetration test uses that as a starting point, then tries to exploit what it finds and chain issues together to show what an attacker could achieve. An assessment is broader and faster. A test goes deeper. If someone has asked you for a penetration test, a vulnerability assessment will not meet that requirement.
How often should we run vulnerability assessments?
At least quarterly, more often if your environment changes quickly. New vulnerabilities are published every day, so a system that was clean last quarter may not be clean today. Regular assessments keep the list of open issues short enough to manage.
What systems can be included in a vulnerability assessment?
Servers, workstations, network devices, cloud infrastructure and web applications, internal, external or both. The scope is agreed with you in writing before anything runs.
Will a vulnerability assessment disrupt our operations?
It should not. Scans are configured to avoid causing outages. Fragile systems such as operational technology or legacy kit get a lighter approach and can be scanned outside business hours.