Establish the asset boundary
- Identify in-scope systems, owners, internet exposure and business importance
- Review asset inventory and existing scanner coverage for gaps
- Agree credentials, scan windows and systems requiring special handling
Find, prioritise and track security weaknesses
Vulnerability Management
Turn vulnerability findings into a manageable order of work. Identify weaknesses across the agreed systems, check which findings matter, assign actions and validate agreed fixes.
- Validated, risk-prioritised vulnerability register
- Remediation owners, actions and exception tracking
- Agreed rescan results and management reporting
The question we help answer
A scanner produces findings. Your team needs priorities.
A long list of vulnerabilities does not tell an owner which exposure threatens an important system or who should deal with it. We connect findings to the assets, exposure and business impact in scope, then help your team track remediation and remaining risk.
Inside the service
What the engagement covers
Find and validate weaknesses
- Use authorised discovery and vulnerability scanning where agreed
- Review available evidence and validate material findings to reduce false positives
- Record affected assets, relevant identifiers and evidence limitations
Prioritise and coordinate action
- Consider severity alongside exposure, exploitation information and business impact
- Assign remediation owners, dependencies and agreed target dates
- Track exceptions, compensating controls and accepted risk with the business owner
Validate and report progress
- Rescan or recheck the agreed findings after changes
- Distinguish closed, partially addressed, accepted and unverified items
- Report coverage, priority exposures and remediation progress at the agreed cadence
What you receive
A vulnerability register your team can work through
- Agreed asset and scan-coverage summary
- Validated findings with evidence and business-relevant priorities
- Remediation tracker with owners, target dates and exceptions
- Agreed validation results and a business-level progress summary
What we need
Information and permissions agreed first.
- Authorised asset inventory and named system owners
- Available scanner reports, patching records and relevant exposure information
- Written permission for the agreed discovery, scanning and credentials
- Change windows and remediation contacts for your team or IT provider
Fictional example — not client work
Which of these findings should the team address first?
The situation
A fictional scan flags an exposed business application and several isolated test machines with similar severity scores.
The practical response
The review considers exposure, known exploitation information and the application’s role in handling customer information before setting priorities and owners.
What this example shows
An agreed rescan records whether the exposure has changed. This is an illustration of prioritisation, not a client incident or a promise that a scan finds every weakness.
A clear process
From the question to practical action.
- Define coverage
Agree the assets, permissions, scan windows and reporting cycle.
- Identify and validate
Collect authorised findings and check material results.
- Prioritise and track
Agree owners, actions, target dates and exceptions.
- Recheck and report
Validate the agreed changes and explain the remaining risk.
Keeping the scope clear
What is outside the engagement
- Penetration testing, exploit chaining or social engineering unless separately authorised
- Automatic patch deployment, unlimited remediation or 24/7 incident monitoring
- A guarantee that all vulnerabilities are detected or that an incident cannot occur
Common questions
Before you start
How are price and timing agreed?
Before work begins, we agree the scope, deliverables, fee and delivery schedule in writing. Tell us about any deadline in your initial enquiry. Submitting the form does not confirm a booking or start paid work.
Is this the same as penetration testing?
No. Vulnerability management identifies, prioritises and tracks weaknesses over an agreed cycle. Penetration testing uses separately authorised testing to examine exploitability and impact within defined rules of engagement.
Can this be a recurring service?
Yes. We can agree a recurring scan, review and validation cadence for a defined asset set. The contract states the coverage and reporting expectations; it is not an implied 24/7 monitoring service.
Who applies patches or other fixes?
Your system owner or IT provider normally owns the changes. Any hands-on remediation must be explicitly included in the engagement scope.
Discuss vulnerability management
Tell us which systems need coverage, whether you already use a scanner and whether you need a baseline or recurring review. Please keep passwords, sensitive records and configuration exports out of the initial enquiry.
Discuss vulnerability managementRelevant guidance
These links provide background for the review approach. Cyber Evident is not affiliated with or endorsed by the publishers.