What is a vulnerability assessment?

A vulnerability assessment finds the known security weaknesses in your applications, APIs, servers and cloud setup, checks which ones are real, and ranks them by risk so your team knows what to fix first. It combines automated scanning with manual verification by experienced testers.

How is a vulnerability assessment different from a penetration test?

A vulnerability assessment is broad: it finds and ranks known weaknesses across everything in scope. A penetration test is deep: testers try to exploit weaknesses and chain them together, the way a real attacker would, to show what could actually happen. Many teams run assessments regularly and a penetration test once or twice a year.

Is a vulnerability assessment the same as a vulnerability scan?

No. A scan is the automated part, and on its own it produces a long list that usually includes false alarms and duplicates. An assessment adds people: we tune the scans to your systems, verify each result by hand, rate it in the context of your business and give you a prioritised fix plan.

Websites and web apps, APIs, iOS and Android apps, external and internal networks and servers, cloud accounts on AWS, Azure and Google Cloud, container images, Kubernetes settings and open-source dependencies. You choose the scope; we confirm what is actually reachable before scanning.

What is the difference between authenticated and unauthenticated scanning?

Unauthenticated scanning shows what an outsider can see without signing in. Authenticated scanning uses test accounts, so we can check the parts of your app and systems behind the login, where most data and permissions live. We usually recommend both.

How do you rate and prioritise findings?

Each finding gets a CVSS rating, then we adjust its priority for your context: whether it is internet-facing, what data it could expose and whether a public exploit exists. The result is a fix order based on real risk, not just a score.

How do you handle false positives?

Every finding is checked by a tester before it reaches your report. Results we can’t confirm are removed or clearly marked, and duplicates across tools are merged, so your developers only spend time on real issues.

Will scanning slow down or break our systems?

We agree the scope, rules of engagement and scan windows in writing first. Scans are tuned for your environment, run in staging where possible, and live scans run in approved windows with a named contact on call and a way to stop at any time.

Which tools do you use?

Nessus, OpenVAS and Nmap for networks and servers; Burp Suite, OWASP ZAP, Acunetix and Nikto for web apps and APIs; MobSF for mobile; Prowler, ScoutSuite, Trivy, Kubescape and Snyk for cloud, containers and dependencies; and DefectDojo, Jira and Confluence to track findings to closure. Tools find candidates; our testers confirm them.

Which standards do you follow?

OWASP Top 10 for web apps, OWASP API Security Top 10 for APIs, OWASP MASVS for mobile, NIST SP 800-115 for how testing is run and CVSS for ratings. For compliance we map findings to SOC 2, ISO 27001, PCI DSS, HIPAA and GDPR.

How often should we run a vulnerability assessment?

Quarterly is a good default, plus after infrastructure changes and before audits. Teams that release often add dependency and dynamic scans to their pipeline so new issues are caught between full assessments.

What will we receive?

A technical report with every verified finding, its CVSS rating, evidence and steps to fix; an executive summary for leadership; a remediation plan in priority order; and a closure report after the retest. Recurring assessments also include a trend report across cycles.

Do you retest after we fix the issues?

Yes. Once your team has fixed the findings, we retest them at no extra cost and update the report to show which issues are closed.

How long does it take and how much does it cost?

It depends on the number of assets, whether we scan signed in, internal access and how many retest rounds you need. We agree the scope with you first, then you receive a timeline and a fixed quote before any testing starts.

Vulnerability Assessment Testing Services

Find the known weaknesses in your apps, APIs, servers and cloud before someone scanning the internet finds them for you.

We scan everything in scope, check each result by hand to remove false alarms, and rank what’s left by the real risk to your business. You get a clear fix list, support while your team works through it, and a free retest to confirm each issue is closed.

Get in touch Scope your assessment

Web, API, mobile, network and cloud
Every finding verified by hand
CVSS-rated, OWASP-mapped
Free retest after fixes

What we assess

Web appsOWASP Top 10 APIsAccess and tokens Mobile appsiOS and Android Network & serversExternal and internal Cloud configurationAWS, Azure, GCP Dependencies & containersLibraries and images Recurring assessmentsQuarterly or monthly Pre-audit assessmentAudit-ready evidence

[ Why vulnerability assessment ]

Known weaknesses are the easiest way in

Many of the weaknesses attackers use are not new. They are published, given a CVE number and added to scanning tools anyone can point at the internet. The question is whether your outdated server, open admin port or vulnerable library is found by you or by them. A vulnerability assessment finds those weaknesses across everything in scope, removes the false alarms that make raw scan output hard to act on, and tells your team what to fix first.

Need real attacks proven end to end? See penetration testing or all security testing services →

Know what’s exposed

A confirmed list of the systems, services and versions an attacker can reach.

No false alarms

Every finding is reproduced by a tester before it reaches your report.

Fix in the right order

CVSS ratings adjusted for exposure and data, so the first fix is the one that matters most.

Evidence when asked

Reports, fix records and retests ready for auditors and customer security reviews.

[ What we assess ]

Eight vulnerability assessments, one verified fix list

Pick the assets you need covered, or combine them into one assessment. Each card lists what we check, when you need it and the problem it prevents.

Web application vulnerability assessment

Sites and web apps

We scan your website or web app from the outside and while signed in, then check each result by hand against the OWASP Top 10.

What we check

Injection, cross-site scripting and file upload weaknesses
Sign-in, session and password handling
Security headers, TLS and cookie settings
Outdated frameworks, plugins and server software

When you need it

Before launch, after major releases and at least quarterly.

The problem it preventsCommon web flaws that automated attack tools look for first

API vulnerability assessment

REST and GraphQL

Your APIs checked directly, outside the app that normally calls them, with the OWASP API Security Top 10 as the baseline.

What we check

Object- and function-level access control
Token, key and authentication handling
Excessive data returned in responses
Rate limits and exposed or undocumented endpoints

When you need it

When you open an API to partners or mobile apps, and after changes to sign-in or data models.

The problem it preventsOne user reading or changing another user’s data through the API

Mobile app vulnerability assessment

iOS and Android

The app build, the data it keeps on the device and the traffic it sends, checked against OWASP MASVS.

What we check

Sensitive data in local storage and logs
Network traffic, TLS and certificate pinning
Hard-coded keys and secrets in the app package
The backend APIs the app depends on

When you need it

Before store releases and after changes to sign-in, payments or stored data.

The problem it preventsCustomer data left readable on a lost or rooted phone

Network & server vulnerability assessment

External and internal

Every host, port and service in scope, from the internet-facing edge to the internal network if you need it, checked for known vulnerabilities.

What we check

Open ports and services that should not be exposed
Missing operating system and software patches
Weak protocols, ciphers and default credentials
Remote access, VPN and admin interfaces

When you need it

Quarterly, after infrastructure changes and before audits.

The problem it preventsAn unpatched server that is already on an attacker’s target list

Cloud configuration assessment

AWS, Azure, Google Cloud

Your cloud accounts reviewed for the settings that most often cause exposure, using Prowler, ScoutSuite and manual checks.

What we check

Identity and access rules with more rights than needed
Public storage buckets and snapshots
Security groups and network exposure
Logging, encryption and key management settings

When you need it

After a migration, a new account or region, and alongside each assessment cycle.

The problem it preventsA single misconfigured setting exposing data to the internet

Dependency & container assessment

Libraries and images

Open-source libraries, container images and Kubernetes settings checked for published vulnerabilities, with an upgrade path for each finding.

What we check

Vulnerable open-source packages (SCA)
Container base images and OS packages
Kubernetes and infrastructure-as-code settings
Secrets left in code, images and config

When you need it

On a schedule and in your pipeline, so new advisories are caught quickly.

The problem it preventsA known library flaw shipping in every release without anyone noticing

Recurring vulnerability assessment

Quarterly or monthly

The same scope assessed on a fixed schedule, so new weaknesses are found quickly and you can see risk going down over time.

What we check

Scheduled scans across every asset in scope
New findings verified and added to your tracker
Fixed issues retested and closed
Trend report: open, fixed and overdue by severity

When you need it

When you want ongoing assurance between yearly penetration tests.

The problem it preventsA clean report in January and a new exposure by March

Pre-audit vulnerability assessment

SOC 2, ISO 27001, PCI DSS

An assessment timed and documented for an audit, a renewal or a large customer’s security review. We don’t issue certificates; we give you the evidence behind them.

What we check

Scope mapped to the systems your auditor will ask about
Findings mapped to SOC 2, ISO 27001, PCI DSS, HIPAA or GDPR controls
Records of scans, fixes and retests
Answers for security questionnaires

When you need it

Ahead of audits and customer reviews, with time left to fix what we find.

The problem it preventsAudit findings and stalled deals over open vulnerabilities

Want flaws caught in code before they ship? See SAST & DAST in your pipeline →

[ Vulnerability assessment vs other security tests ]

An assessment answers one question: which known weaknesses do we have, and which matter most?

Other security tests answer different questions, and many teams pair a regular assessment with a yearly penetration test. On the right is what a verified finding looks like.

Test	Question it answers	Depth
Automated scan only	What do our tools flag?	Raw list, false alarms included
Vulnerability assessment This page	Which known weaknesses do we have, and which matter most?	Broad, verified by hand, ranked
Penetration testing	What could an attacker actually do?	Deep: exploits and attack chains
SAST & DAST	Are new flaws slipping in with each build?	Code and running app, in CI/CD
Security compliance testing	Do our controls meet the framework?	Controls and audit evidence

Sample verified findingNetwork scan

Asset: Internet-facing web server
Finding: Outdated server software with a published vulnerability (CVE)
Verified: Version confirmed by a tester with a safe, non-destructive check
Rating: CVSS Critical; kept Critical because it is internet-facing
Fix: Upgrade to the patched release and close the unused admin port
Retest: Patched version confirmed; finding closed

Example only. Real reports use your assets, evidence and ratings.

[ How we work ]

Six steps from scope to a closed finding

You approve the scope before any scan runs. Every finding is verified, explained in plain words and retested once it’s fixed.

Step 1 of 6
Scope and rules of engagement

Assets, URLs and IP ranges, test accounts, scan windows and contacts agreed and signed.

You getScope and rules of engagement
Step 2 of 6
Discover and confirm assets

We map what is actually reachable, such as hosts, ports, subdomains and APIs, and you confirm what is in scope.

You getConfirmed asset inventory
Step 3 of 6
Scan, signed out and in

Scans tuned to your stack run in the agreed windows, from outside and with test accounts where needed.

You getScan records kept for audit
Step 4 of 6
Verify by hand

Testers reproduce each result safely, remove false positives and merge duplicates across tools.

You getVerified findings list
Step 5 of 6
Rate and report

CVSS ratings adjusted for exposure and data, plain-language fix steps and a summary for leadership.

You getTechnical reportExecutive summary
Step 6 of 6
Fix and retest

A fix plan agreed with your developers, then a free retest to confirm each issue is closed.

You getRemediation planRetest and closure report

NDA before accessWe sign your NDA before we see a single test account or IP range.
Agreed scan windowsScans run only in the windows you approve, with a named contact on call and a way to stop at any time.
Encrypted findingsReports and evidence are encrypted in transit and at rest, shared only with named people.

[ Tools ]