What is included

What we implement is not a tool but a process: scan, review, remediate, verify.

Discuss the scope

Scanner deployment

Installation, configuration of the scan zones, schedules and credentials for authenticated checks.

Perimeter scanning

An external check of what is visible from the internet. Done more often than internal scanning.

Internal scanning

Servers, workplaces, network equipment, databases.

Prioritisation

Filtering out theoretical findings and ranking by the real danger to your infrastructure.

Remediation control

Tasks to fix with owners and deadlines, followed by a re check.

Reporting

The trend: are there fewer vulnerabilities, which ones have been open longest.

How the work runs

The first cycle takes two to three weeks. After that the process runs to a schedule.

01

The first run

We get the baseline picture. It almost always looks frightening, and that is normal.

02

Review

We separate the critical from the noise. A vulnerability on an isolated server and the same one on a public server are different stories.

03

Remediation

We close by priority, starting with the perimeter and the critical systems.

04

Regularity

We set a schedule and repeat checks. A one off scan is useless: new vulnerabilities appear within a quarter.

A three hundred page report is not a result, it is the start of the work. The scanner does not know what is isolated in your setup and what is reachable by everyone. A useful report is ten items with an explanation of why exactly those come first and with an owner for each.

Frequently asked questions

Configured properly, no. Aggressive modes that test exploitation really can take down old equipment, so production systems are scanned in a gentle mode and heavy checks are run in agreed windows.

The perimeter monthly and after every change. The internal network quarterly. Critical applications after every major update. Regularity matters more than depth.

Nor do you need to. The goal is not zero vulnerabilities but that the critical and externally reachable ones are closed quickly while the rest do not pile up unchecked. The maturity metric is not the number of findings but the time taken to close the critical ones.

We will set up vulnerability management

Tell us about your infrastructure. We will run the first scan and show what to close first.