Vulnerability Assessment
A repeatable, evidence-first sweep of your external and internal attack surface.
- Outcome
- See what an attacker sees — before they do.
- Timeline
- 4 phases1 week · 2–4 weeks · 1 week · 3 days
- Mapped to
- NISTOWASP · ISO 27001:2022 · PCI DSS 4.0
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
A broad scan of everything you expose, with every serious result checked by a person, so you know what's weak before an attacker does.
- You don't have a full list of what's reachable from the internet
- You've never had any security testing and want a baseline
- You need recurring evidence of vulnerability management for an audit
- Your team wants a ranked fix list, not a raw scanner export
- You need proof of what an attacker could actually do with a weaknessPenetration Testing
- Your main risk is one web application or APIWeb Application Pen Testing
- A list of domains, IP ranges and cloud accounts in scope
- Credentials for authenticated scanning, if wanted
- Preferred scan windows and any fragile systems to avoid
Still not sure? Take the 2-minute check
What you walk away with.
- A ranked list of confirmed vulnerabilities — every high/critical hand-verified
- False positives cut at machine scale by AI triage, then killed for good by an operator
- Board-ready summary and engineer-ready remediation, in one report
- Optional recurring monthly assessment for continuous coverage
What we cover
Agreed in writing before testing starts.
- External perimeter — every internet-facing IP, subdomain, and exposed service
- Internal network — authenticated scanning of production and staging segments
- Web applications, APIs, and cloud endpoints in scope
- Third-party dependencies via Software Composition Analysis (SCA)
- Configuration review of edge devices, load balancers, and WAFs
- Social engineering (available as a separate engagement)
- Physical-security assessment (available separately)
- Full exploitation & lateral movement (see Penetration Testing)
How we run it.
- 01
Reconnaissance
Confirm the authoritative asset list, then reconcile it against passive discovery. The assets you forgot are already on ours.
- 02
Enumeration
Multi-tool fingerprinting across the agreed surface — Nmap, Nuclei, custom probes — rate-tuned for production.
- 03
Vulnerability Analysis
The heart of a VA. Authenticated + unauthenticated scanning (Nessus, Nuclei, SCA), AI triage to rank and de-duplicate, then manual validation of every high/critical — screenshots, request/response pairs, reproduction steps.
- 04
Prioritization
CVSS is the starting line, not the finish. We rank by exploitability × business impact × remediation cost.
- 05
Reporting & retest
Executive summary, technical detail, remediation roadmap. Encrypted PDF + optional JSON for your GRC platform. One free retest of critical/high within 60 days.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- External perimeter and internal segments
- Authenticated and unauthenticated scans
- Software composition analysis of dependencies
- Every high and critical confirmed by hand
- AI triage to de-duplicate and rank
- False positives removed before reporting
- CVSS as the starting point
- Adjusted for exploitability and business impact
- Remediation effort estimated per item
- Executive and technical report
- JSON export for GRC or ticketing
- Retest of fixed criticals and highs
What lands in your inbox.
- Vulnerability Assessment Report (executive + technical)
- Prioritized remediation roadmap with effort estimates
- JSON export mappable to your GRC / ticketing tool
- 60-minute readout call with engineering + leadership
- One free retest of critical/high findings within 60 days
Defensible under audit.
- NIST
- OWASP
- ISO 27001:2022
- PCI DSS 4.0
From call to report.
- 01Scoping
1 week
- 02Assessment
2–4 weeks
- 03Reporting
1 week
- 04Retest
3 days
Asked before every engagement.
How is this different from just running a scanner?
A scanner produces noise; we produce a decision. AI triage ranks and de-duplicates the raw output, then an operator validates every high/critical by hand and calibrates the fix to your stack. You get findings you can act on Monday — not a PDF nobody reads.
Will this impact production?
We coordinate scan windows, rate-limit, and can run entirely from authenticated hosts. Production impact is single-digit-percent CPU on scanned targets.
Can you retest after we fix things?
Yes — one full retest of critical + high findings is included, delivered within 60 days of report acceptance.
Understand your exposure. Fast.
A 60-minute scoping call brackets effort, timeline, and cost. Report typically shipped within 4–6 weeks of kickoff.