Vulnerability assessment
Establish a prioritised view of known weaknesses across agreed systems. A vulnerability assessment has a different depth and objective from an adversarial penetration test.
What we examine
Coverage
Define the systems, services and assessment access.
Validation
Review relevant results and distinguish actionable issues from tool output.
Prioritisation
Consider exposure, exploitability and operational context.
Next steps
Identify changes and where deeper manual testing would add value.
A baseline for known exposure
Useful for an initial view of known vulnerabilities and configuration issues across an agreed estate. Application logic and attack chaining can be assessed in a separate manual pentest.
Information needed for a quote
Asset counts, IP ranges or URLs, access and authenticated checks permitted. Confirm operational constraints, software versions and vendor patch information where available.
Evidence included
Reviewed results, exposure and validation limits. The report records validation status and any recommended follow-up testing.
Scope, test, report.
Then verify the fixes.
Scoping, testing, reporting and verification, with direct access to the tester.
Agree the scope.
Applications, roles, access and deadlines. We agree the scope, fee and deliverables before testing.
Run the assessment.
Test the controls and the workflows around them. Significant findings are communicated during the engagement.
Document the findings.
Reproducible findings, demonstrated impact and practical recommendations for your developers.
Verify remediation.
Discuss remediation and validate agreed fixes. Retesting terms are set out in the proposal.