Vulnerability Management

The problem with raw scanner output

Vulnerability scanning is cheap and easy. Vulnerability management — deciding what to fix, in what order, and then confirming it actually got fixed — is neither, and it is where the value is.

CVSS scores alone are a poor guide. A critical-rated vulnerability on an internal system that requires local access and has no public exploit matters less than a medium-rated authentication weakness on your internet-facing VPN portal. Prioritising by score means working through the list in roughly the wrong order.

How we prioritise

We weight findings by what determines real risk:

• Exploitability — is there a working public exploit, and is it in active use? A vulnerability on CISA's Known Exploited Vulnerabilities catalogue is in a different category from one that is theoretical.
• Exposure — internet-facing, internally reachable, or requires access you would already have lost.
• Asset criticality — the same flaw on a domain controller and on a meeting room display are not the same problem.
• Compensating controls — what else would have to fail for this to be exploited.

The output is a short, ordered list your team can realistically work through, not a spreadsheet that gets opened once and never again.

What the service includes

Continuous scanning

Authenticated scanning of internal estate and unauthenticated scanning of your perimeter, on a schedule rather than annually. Authenticated scanning is considerably more accurate — it reads installed versions rather than inferring them, which removes most false positives.

External attack surface monitoring

Your perimeter changes without anyone telling you. A developer publishes a test environment, a marketing campaign spins up a subdomain, a certificate lapses. We track what is exposed and flag additions, which is frequently how forgotten infrastructure is discovered.

Remediation tracking

Findings tracked to closure against agreed SLAs, with verification that fixes worked. "Patched" and "reboot pending so the patch is not yet active" look identical in a change record and completely different to an attacker.

Reporting that means something

Trend over time, mean time to remediate, ageing of open findings, and progress against SLA. Metrics a board can actually govern with, and evidence for Cyber Essentials, IASME and client audits.

Where this sits alongside testing

Vulnerability management and penetration testing solve different problems and neither substitutes for the other. Scanning gives breadth and frequency — it finds the missing patch across two hundred machines. Penetration testing gives depth — it finds the logic flaw and the attack chain no scanner can conceive of. Annual testing with nothing in between leaves eleven months of drift; continuous scanning with no testing means you never learn what a capable attacker would actually do.

Common questions