Security testing
Vulnerability assessment services
Find your weaknesses before attackers do, and know which to fix first. Our vulnerability assessment covers your network, cloud, Microsoft 365 and web applications, validated by specialist analysts and turned into a clear, prioritised fix plan.
Definition
What is a vulnerability assessment?
A vulnerability assessment is a structured check of your systems for known security weaknesses, such as missing patches, outdated software, weak configuration and exposed services. Automated scanning finds the candidates; specialist analysts then validate the results, remove false positives and rank what is left by real risk, so you know which issues to fix first.
It answers a different question from a penetration test. A vulnerability assessment asks “what weaknesses do we have, and how serious are they?” across a broad scope. A penetration test asks “how far could an attacker actually get?” by exploiting them. Most organisations need both, at different frequencies.
Scope
What we assess
- External infrastructure: everything you expose to the internet, including firewalls, VPNs, remote access and public services
- Internal network: servers, workstations and network devices, scanned with credentials so the results reflect what is really installed
- Cloud: Microsoft Azure, AWS and Google Cloud configuration, plus the workloads running in them
- Microsoft 365: identity, sharing and tenant settings that attackers commonly abuse
- Web applications: the applications and APIs you publish, checked for common weaknesses
- Endpoints: laptops and desktops, including remote and hybrid workers
Process
How a vulnerability assessment works
Most assessments run over a few days, with the report following within about a week or two, depending on the size of the scope.
- Scoping: agree the systems, IP ranges, applications and cloud accounts in scope, and any fragile systems to handle with care
- Scanning: external and authenticated internal scans using established commercial tools, scheduled to avoid disruption
- Manual validation: analysts confirm findings and remove false positives, so your team does not chase issues that are not real
- Risk rating: each finding rated Critical, High, Medium or Low, using its technical severity and how exposed and important the affected system is
- Report: an executive summary and technical findings, walked through with you
- Remediation plan: a prioritised fix list your IT team or provider can work through
- Retest: a follow-up scan to confirm the critical and high findings are closed
Deliverables
What you get from a vulnerability assessment
- An executive summary for leadership: overall exposure, the most serious issues and trend over time
- Technical findings with severity, affected systems and evidence
- Clear remediation steps for each finding
- A prioritised plan mapped to the frameworks you answer to: Cyber Essentials, ISO 27001 (control A.8.8, management of technical vulnerabilities), DORA and PCI DSS
- Retest results showing what has been closed
Comparison
Vulnerability assessment vs penetration testing
The two are complementary. A vulnerability assessment gives broad, regular coverage; a penetration test gives depth on the systems that matter most. A common pattern is regular vulnerability assessment all year, with penetration testing annually or after major change.
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Purpose | Find and rank known weaknesses across your estate | Show how far an attacker could get by exploiting them |
| Method | Automated scanning plus expert validation | Manual, tester-led attack simulation |
| Breadth and depth | Broad coverage, less depth | Narrower scope, much more depth |
| Frequency | Monthly or quarterly, and after change | Typically annually, and after major change |
| Relative cost | Lower, so it can run often | Higher, as it is skilled manual work |
| When to use it | Ongoing hygiene, compliance evidence, before an audit | Assurance for clients, regulators and the board |
Related
Ongoing
One-off assessment or ongoing vulnerability management
A single assessment is a snapshot: new vulnerabilities are published every day, and your estate changes every week. Vulnerability management turns the assessment into a regular cycle of scanning, prioritising, fixing and confirming, usually monthly or quarterly, so exposure is caught while it is still small.
We set up the scanning service through a specialist partner, agree the cadence and reporting with you, and track remediation alongside the rest of your security programme.
Related
Wider view
Cyber security assessment for your whole organisation
A vulnerability assessment looks at technology. A broader cyber security assessment also looks at the controls, policies, people and processes around it: governance, incident readiness, supplier risk and how you would recover. If you want to know where you stand overall, and what to invest in first, start there.
Related
Cost
How much does a vulnerability assessment cost?
The cost of a vulnerability assessment depends on how much there is to scan and how often. Pricing is on application: we scope first, then quote.
- The number of external IP addresses and internal hosts in scope
- The number of web applications and APIs
- The number of cloud accounts and Microsoft 365 tenants
- One-off assessment or a recurring monthly or quarterly service
- Whether you want retesting and remediation tracking included
Who delivers it
Independent testing, one point of accountability
Assessments are delivered through vetted specialist testing partners that we select, contract and oversee, independent of whoever builds and runs your systems. Threat Protect scopes the work, sits alongside the findings and stays your single point of contact, so the results turn into fixes rather than a report that gathers dust.
We work with organisations across the UK, with on-site meetings in London and the South East where they help.
FAQ
Questions buyers actually ask
- At least quarterly for internet-facing systems, and after any significant change such as a new system, a cloud migration or a major update. Many organisations scan monthly. PCI DSS requires internal and external vulnerability scans at least every three months, and Cyber Essentials expects critical and high-risk updates to be applied within 14 days, which is hard to evidence without regular scanning.
- No. A vulnerability assessment finds and ranks known weaknesses across a broad scope using scanning plus expert validation. A penetration test uses skilled manual testing to show how far an attacker could get by exploiting them. They work best together: regular vulnerability assessment, with periodic penetration testing.
- It should not. Scans are designed to be non-disruptive, and fragile or legacy systems are identified at scoping so they can be scanned gently, excluded or scheduled out of hours. Nothing is exploited, which is one of the differences from a penetration test.
- It is not a separate requirement, but it helps. The Cyber Essentials Plus audit itself includes vulnerability scanning of your external and internal systems, and the assessor checks that patches are applied. Running a vulnerability assessment beforehand finds the issues in time to fix them, so you pass first time.
- Established commercial vulnerability scanners, chosen by the testing partner to suit your environment, with authenticated scanning wherever possible. Tools alone are not enough, so every assessment includes manual validation by experienced analysts to remove false positives and set priorities.
- For most organisations the scanning itself runs over a few days, and the validated report follows within about a week or two. Very large or complex estates take longer. Recurring vulnerability management runs on a monthly or quarterly cycle.
- The fixes are usually made by your own IT team or your IT provider, using the prioritised remediation plan. We track progress, answer questions on the findings and run the retest to confirm issues are closed. If you need extra hands to remediate, we can source that help too.
- Yes. Assessments can cover Microsoft Azure, AWS and Google Cloud configuration and workloads, and your Microsoft 365 tenant, where weak sharing, identity and security settings are a common route in.
Find out what an attacker would find first.
Tell us what you run and where it worries you. We’ll scope the right assessment and make sure the findings get fixed, not filed.
Book a call