[{"data":1,"prerenderedAt":295},["ShallowReactive",2],{"service-vulnerability-assessment-en":3},{"doc":4},{"id":5,"title":6,"body":7,"description":269,"extension":270,"faq":271,"lastReviewed":287,"link":288,"meta":289,"navigation":290,"path":291,"seo":292,"stem":293,"__hash__":294},"servicesEn\u002Fservices\u002Fvulnerability-assessment.md","Vulnerability Assessment",{"type":8,"value":9,"toc":259},"minimark",[10,19,24,27,40,50,62,66,69,75,91,97,122,129,133,136,183,187,190,222,226,237,241,248],[11,12,13,14],"p",{},"Most organisations do not know what is running on their own estate: which hosts are exposed, which services are unpatched, which known vulnerabilities have accumulated across hundreds of IP addresses since the last time anyone looked. A vulnerability assessment answers exactly that question: it sweeps your network, web, and mobile surface for known weaknesses, wide and repeatable, so the answer is a current inventory rather than a guess. Scanner output on its own contains false positives that cost your team time to triage. Our vulnerability assessment pairs authenticated and unauthenticated scanning with manual validation by an analyst, so every finding in the report is a real issue, rated by severity, with guidance on how to fix it. For a longer discussion of when a VA is the right tool, our team wrote one here: ",[15,16,18],"a",{"href":17},"\u002Fblogs\u002Fva-pentest-service","VA and pentest: which service do you need?",[20,21,23],"h2",{"id":22},"vulnerability-assessment-vs-penetration-testing","Vulnerability assessment vs penetration testing",[11,25,26],{},"The two services answer different questions, and neither substitutes for the other.",[11,28,29,30,34,35,39],{},"A ",[31,32,33],"strong",{},"vulnerability assessment"," answers: ",[36,37,38],"em",{},"what vulnerabilities exist across my estate?"," It is breadth-first: coverage across many hosts, applications, and services, catching the known-CVE surface systematically and repeatably. It is the right tool for maintaining an ongoing picture of exposure: after a patching cycle, after infrastructure changes, or on a regular cadence so drift does not accumulate unseen.",[11,41,29,42,45,46,49],{},[31,43,44],{},"penetration test"," answers a different question: ",[36,47,48],{},"what could actually happen if someone tries to break in?"," It is depth-first: a tester takes the most promising weaknesses and chains them into real impact, proving through exploitation what an attacker could reach. A VA identifies a vulnerable service; a pentest shows whether it leads to your database.",[11,51,52,53,56,57,61],{},"A VA does not prove impact, and a pentest does not give you coverage across every host. Most organisations need both, at different cadences: assessment frequently for coverage, testing periodically for depth. If you already know you need proof of exploitation, start at our ",[15,54,44],{"href":55},"\u002Fpenetration-test"," page instead; if you are still weighing the two, the ",[15,58,60],{"href":59},"\u002Fblogs\u002Fva-pentest-service-faqs","VA and pentest FAQ"," covers the questions we hear most often.",[20,63,65],{"id":64},"what-we-assess","What we assess",[11,67,68],{},"Scope is agreed along two dimensions before any scanning starts.",[11,70,71,74],{},[31,72,73],{},"Location",": where we assess from:",[76,77,78,85],"ul",{},[79,80,81,84],"li",{},[31,82,83],{},"External",": assessed from the Internet, the way an outside attacker sees you: your public-facing hosts, exposed services, and everything reachable without credentials to your network.",[79,86,87,90],{},[31,88,89],{},"Internal",": assessed from inside your intranet, the view an attacker gains after a foothold, or that a malicious insider already has.",[11,92,93,96],{},[31,94,95],{},"Type",": what we assess:",[76,98,99,105,116],{},[79,100,101,104],{},[31,102,103],{},"Network VA",": servers, network devices, and infrastructure services, scoped by the number of IP addresses. This is where the bulk of the known-CVE surface usually lives: unpatched services, insecure configurations, deprecated protocols.",[79,106,107,110,111,115],{},[31,108,109],{},"Web application VA",": your web applications, scoped by the number of applications. A scanner covers the technical surface (known component vulnerabilities, misconfigurations, common injection points), though it has limits our team has written about: ",[15,112,114],{"href":113},"\u002Fblogs\u002Fan-untold-story-about-web-application-vulnerability-assessment","an untold story about web application vulnerability assessment",".",[79,117,118,121],{},[31,119,120],{},"Mobile application VA",": your mobile applications, scoped by the number of apps: known-vulnerable components, insecure configurations, and weaknesses detectable through assessment tooling.",[11,123,124,125,128],{},"We also agree up front whether a ",[31,126,127],{},"revisit"," is included (a retest after your team has remediated), so the final report reflects what is closed.",[20,130,132],{"id":131},"how-we-work","How we work",[11,134,135],{},"Every engagement runs through the same phases.",[137,138,139,145,159,165,171,177],"ol",{},[79,140,141,144],{},[31,142,143],{},"Scoping",": We agree location (external, internal, or both), type (network, web, mobile), the counts that size the work (IP addresses, applications, apps), and whether a revisit is included. Anything left out of scope is agreed at this stage.",[79,146,147,150,151,154,155,158],{},[31,148,149],{},"Scanning",": We run both ",[31,152,153],{},"unauthenticated scans"," (the exposure any outsider can probe) and ",[31,156,157],{},"authenticated scans"," (credentialed access that sees patch levels, local configurations, and weaknesses invisible from outside), using well-known, trusted commercial and open-source tools. The two views together give a far more complete picture than either alone.",[79,160,161,164],{},[31,162,163],{},"Manual validation",": An analyst reviews the raw results by hand: confirming that reported issues are real, discarding false positives, and merging duplicates. Only confirmed findings reach your report.",[79,166,167,170],{},[31,168,169],{},"Risk rating",": Each confirmed finding is rated Critical, High, Medium, or Low, so your team can prioritise remediation objectively.",[79,172,173,176],{},[31,174,175],{},"Reporting",": Findings are written up with reproduction detail and remediation guidance, alongside an executive summary for management.",[79,178,179,182],{},[31,180,181],{},"Retest (when included)",": After your team has remediated, we re-verify the findings and update the report to reflect what has been closed.",[20,184,186],{"id":185},"what-you-get","What you get",[11,188,189],{},"Every report contains, at minimum:",[76,191,192,198,204,210,216],{},[79,193,194,197],{},[31,195,196],{},"Executive summary",": the business-level risk picture, suitable for management and auditors.",[79,199,200,203],{},[31,201,202],{},"Findings by Risk Level",": each confirmed issue rated Critical, High, Medium, or Low, so remediation can be prioritised objectively.",[79,205,206,209],{},[31,207,208],{},"Reproduction detail for every finding",": what we found, where, and the exact steps to reproduce each finding.",[79,211,212,215],{},[31,213,214],{},"Remediation guidance",": practical fixes tied to your environment.",[79,217,218,221],{},[31,219,220],{},"Retest verification",": when a revisit is in scope, findings are re-checked after your fixes and the report is updated to reflect closed items.",[20,223,225],{"id":224},"team-credentials","Team credentials",[11,227,228,229,232,233,115],{},"Assessment and validation are performed by our in-house team holding industry certifications including ",[31,230,231],{},"OSCP, OSCE, CREST CRT, CREST CPSA, and GIAC GREM",", each earned through hands-on practical examination. The same offensive-security background that drives our penetration testing is what makes the manual validation step meaningful: the analyst confirming a finding knows what an exploitable issue actually looks like. ",[15,234,236],{"href":235},"\u002Fcertifications","See the full list of certifications the team holds",[20,238,240],{"id":239},"standards","Standards",[11,242,243,244,247],{},"Our methodology follows ",[31,245,246],{},"NIST SP800-115"," (Technical Guide to Information Security Testing and Assessment), which defines vulnerability assessment as part of a structured security testing programme. Tell us during scoping what your audit or compliance needs are.",[11,249,250,251,253,254,258],{},"A vulnerability assessment gives you coverage: a current, validated picture of the known weaknesses across your estate. When you need proof of what those weaknesses mean in practice, that is a ",[15,252,44],{"href":55},". And when the findings need closing rather than confirming, ",[15,255,257],{"href":256},"\u002Fsecurity-hardening","security hardening"," is the engagement that does it, bringing the underlying configuration up to a baseline so the same issues stop reappearing each round.",{"title":260,"searchDepth":261,"depth":261,"links":262},"",2,[263,264,265,266,267,268],{"id":22,"depth":261,"text":23},{"id":64,"depth":261,"text":65},{"id":131,"depth":261,"text":132},{"id":185,"depth":261,"text":186},{"id":224,"depth":261,"text":225},{"id":239,"depth":261,"text":240},"Vulnerability assessment in Thailand: authenticated and unauthenticated scanning with manual validation across network, web, and mobile, mapped to NIST SP800-115.","md",[272,275,278,281,284],{"q":273,"a":274},"What is a vulnerability assessment?","A vulnerability assessment sweeps your network, web, and mobile surface for known weaknesses (wide and repeatable), so you get a current inventory of what is exposed rather than a guess. We pair authenticated and unauthenticated scanning with manual validation by an analyst, so every finding is a real issue, rated by severity, with guidance on how to fix it.",{"q":276,"a":277},"Vulnerability assessment or penetration test: which do I need?","A VA answers 'what vulnerabilities exist across my estate?' It is breadth-first coverage across many hosts, ideal for an ongoing picture after patching or on a regular cadence. A pentest answers 'what could actually happen if someone tries to break in?' It is depth-first, chaining weaknesses into proven impact. A VA tells you a host is running a vulnerable service; a pentest shows you that service leads to your database. Most organisations need both, at different cadences.",{"q":279,"a":280},"What do you assess, and how is it scoped?","Scope is agreed along two dimensions before scanning starts. Location: external (assessed from the Internet) or internal (from inside your intranet). Type: network VA (servers and infrastructure, scoped by IP count), web application VA (scoped by number of applications), and mobile application VA (scoped by number of apps). We also agree up front whether a revisit (a retest after remediation) is included.",{"q":282,"a":283},"What is the difference between authenticated and unauthenticated scanning?","Unauthenticated scans probe the exposure any outsider can see. Authenticated scans use credentialed access to see patch levels, local configurations, and weaknesses invisible from outside. We run both, because the two views together give a far more complete picture than either alone. Then an analyst validates the results by hand, discarding false positives and merging duplicates.",{"q":285,"a":286},"Which standard do you follow?","NIST SP800-115, which treats a vulnerability assessment as a recurring part of a testing programme rather than a one-off exercise. That shapes what you receive: every finding is severity-rated and confirmed by an analyst first, so an auditor reads validated issues. Tell us at scoping which audit or compliance regime the report has to answer to and we will align it then.","2026-10-12","\u002Fvulnerability-assessment",{},true,"\u002Fservices\u002Fvulnerability-assessment",{"title":6,"description":269},"services\u002Fvulnerability-assessment","Kf8UQ5nJeMYT6vaZo4CMRiCt33jMYgUOQ-DHkvttjjM",1791794279921]