Security assessments
Vulnerability Assessment
A vulnerability assessment identifies, validates, and prioritizes technical weaknesses across authorized systems so you can make informed, risk-based remediation decisions. It is a structured discovery and analysis exercise, not an attempt to exploit or compromise systems.
Problems this addresses
- Unclear exposure across servers, endpoints, and network services
- Difficulty prioritizing a growing list of known vulnerabilities
- No recent, independent view of technical security posture
- Preparing for a compliance, insurance, or customer security questionnaire
Who this is for: Organizations that need an independent, evidence-based view of technical vulnerabilities across authorized infrastructure, without the cost or disruption of a full penetration test.
Scope
- Authorized asset discovery and inventory confirmation
- Host and service identification
- Automated vulnerability scanning
- Manual review of scan results for accuracy
- Configuration-related weaknesses identified during scanning
Methodology
- 01Scope confirmation and written authorization
- 02Asset discovery and service enumeration
- 03Vulnerability scanning against in-scope systems
- 04CVE and CVSS-based severity analysis, cross-referenced against CISA's Known Exploited Vulnerabilities catalog
- 05Manual validation and false-positive review
- 06Business-context risk prioritization
- 07Remediation guidance and optional retest
Deliverables
- Executive summary for non-technical stakeholders
- Asset coverage summary
- Vulnerability findings register with severity ratings
- Supporting evidence for each finding
- Prioritized remediation roadmap
- Optional post-remediation validation report
Frameworks referenced
- CVSS v3.1
- CISA Known Exploited Vulnerabilities (KEV) Catalog
- NIST SP 800-115 (methodology reference)
What we need from you
- Written authorization for all in-scope systems
- A current asset or IP range inventory
- A named technical point of contact for the engagement window
Out of scope
- Exploitation of identified vulnerabilities
- Social engineering or phishing simulation
- Physical security testing
- Denial-of-service testing
Frequently asked questions
Is this the same as a penetration test?
No. A vulnerability assessment identifies and prioritizes weaknesses; a penetration test goes further and attempts to exploit them to demonstrate real-world impact. We're explicit about which one you're engaging for, and can discuss whether a penetration test is more appropriate for your goals.
Will scanning disrupt our systems?
Scanning is scheduled and scoped to minimize operational impact, and sensitive or fragile systems can be excluded or scanned with adjusted settings by agreement.
Do you validate findings or just hand over a scanner report?
Findings are manually reviewed to remove false positives and add business context — you receive an analyzed report, not a raw scanner export.