All services Vulnerability Assessment

Find known weaknesses, then fix them in the right order.

We scan your networks, systems and web apps for known vulnerabilities, check the results by hand, and give you a short, ranked list your team can work through.

Schedule a Vulnerability Assessment
Risk map · 8 findingsSample · synthetic data
  1. VA-01Remote Desktop (RDP) open to the internet, 192.0.2.14:3389
  2. VA-04Multi-factor authentication missing on 6 of 41 Microsoft 365 accounts
  3. VA-02FortiOS VPN vulnerable to CVE-2024-21762 (actively exploited)
  4. VA-05File server on Windows Server 2012 R2, out of support since October 2023

The four lower-risk findings are in the full report, each with its fix.

What we look for

  • Missing patchesSoftware and systems behind on security updates.
  • MisconfigurationsDefault settings, open shares, risky permissions.
  • Weak credentialsDefault passwords and accounts without MFA.
  • Insecure protocolsOld encryption and unencrypted services still in use.
  • Exposed servicesRemote desktop, databases and admin pages reachable from outside.
  • Outdated softwareSystems past end of support that no longer get fixes.

From hundreds of raw results to the few that matter

Raw scan output is mostly noise. We remove duplicates and false positives, confirm what’s real and rank it.

  1. 214Raw scanner results
  2. 61After duplicates and false positives are removed
  3. 23Confirmed findings, each with a fix
  4. 4Fix this week

Two different goals

Vulnerability assessmentPenetration test
The question it answersWhat known weaknesses do we have, and which do we fix first?Could an attacker actually get in, and how far would they go?
GoalBreadth: find as many known issues as possibleDepth: prove real impact on what matters most
HowAutomated scanning, reviewed by a personSkilled people attacking like a real adversary
How oftenMonthly or quarterlyYearly, or after major changes
What you getA ranked list of known weaknessesProof, attack paths and business impact

What you get

  1. Executive summaryYour risk at a glance, in business terms, for leadership.
  2. Ranked findingsEach finding with its severity score, where it is and how to fix it.
  3. Trend over timeRepeat assessments show whether your exposure is shrinking.

How it works

  1. Scoping callWe agree on what is in scope, what is out, and what a good result looks like for you.
  2. The workThe expert who scoped it leads it, and keeps you posted on anything urgent.
  3. ReportFindings ranked by risk, with the fix for each, walked through with your team.
  4. Follow-upWe answer questions and check your fixes where it is part of the engagement.

When to get one

  • You need a baselineIf you’ve never been assessed, you don’t know what’s exposed.
  • Compliance requires itPCI DSS, SOC 2, ISO 27001 and Law 25 programs expect regular scanning.
  • Your environment changes oftenNew systems and cloud moves bring new weaknesses.
  • You want to check your patchingConfirm updates were actually applied everywhere.
  • Before a penetration testFix the easy issues first, so the test goes deeper.
  • Your insurer requires itMany policies ask for proof of regular scanning.
Want a fixed-price first look?The Security Health Check covers your internet exposure, email, Microsoft 365, leaked passwords and the basics, at a fixed price.Security Health Check Want this running all the time?Vulnerability management keeps scanning continuously and tracks fixes for you.Vulnerability management

Examples on this page are illustrative.

Schedule a Vulnerability Assessment

Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.

Book a Free Consultation