Discover the gaps
Check the agreed IPs, domains, servers, applications or network devices. Record scope and coverage so omissions are visible.
02 / Vulnerability assessment
See the gaps.
Know what
to fix first.
Turn a vulnerability scan into a practical plan. Discover exposure, validate the findings and prioritise the work that matters.
Identify.
Understand assets and weaknesses.
Prioritise.
Connect severity with business context.
Improve.
Remediate and verify agreed fixes.
VA Scan / IT Health Check
A clearer view of
your security exposure.
A Vulnerability Assessment uses scanning and analyst review to identify known weaknesses, missing security updates and relevant configuration issues within your agreed environment.
Verify the signal
Review scan results, validate relevant findings and document uncertainty. A raw tool output is not the final assessment.
Make the fix actionable
Group issues into clear remediation priorities, assign context and verify the agreed changes through a follow-up scan.
VA is one component of an IT Health Check. Backups, performance, resilience, identity governance or wider architecture reviews are included only when separately agreed.
Risk-informed prioritisation
A high score
is only part
of the picture.
Explore the signals that turn a long findings list into a focused remediation conversation.
PRIORITISATION LENSILLUSTRATIVE MODEL
How serious is the weakness?
CVSS describes technical severity. Record the score and version, then consider how the issue affects this environment.
CONTEXT CHANGES THE PRIORITY↗
Conceptual visualisation. No live scans, customer data or measured risk scores are shown.
Choose with confidence
VA or Pentest?
Start with your objective.
Use VA for broad visibility and recurring hygiene. Use Pentest to investigate how weaknesses may combine into a meaningful attack path.
| What matters | Vulnerability Assessment | Penetration Testing |
|---|---|---|
| Main objective | Find and prioritise known weaknesses. | Validate exploitability and business impact. |
| Approach | Scanning with analyst review and verification. | Manual investigation with controlled exploitation. |
| Coverage | Broad coverage of the agreed asset inventory. | Deeper testing of selected systems and journeys. |
| Cadence | Recurring, and after relevant changes; based on risk. | Based on criticality, major changes and obligations. |
| Result | A remediation backlog and re-scan outcomes. | Evidence, attack scenarios and technical fixes. |
An assessment that leads somewhere
From asset list
to verified improvement.
Scope & prepare
Agree assets, exclusions, windows and access. Confirm whether credentialed scanning is appropriate.
Scan
Use relevant checks for the environment with agreed scan intensity and operational safeguards.
Analyse
Review findings, reduce noise and validate relevant issues with evidence and limitations.
Report
Deliver executive context, a technical inventory and a prioritised remediation plan.
Re-scan
Check agreed fixes after remediation. Record resolved items, remaining exposure and exceptions.
Re-scan coverage and timing are agreed in the proposal. Critical systems and operational technology may need a dedicated assessment method.
What your team receives
Less noise.
A better backlog.
Move from discovery to ownership with a clear record of what was assessed, what was found and what to do next.
Executive summary
Exposure themes and priorities for decision-makers.
Technical findings
Affected assets, evidence, relevant CVEs and severity context.
Remediation plan
Recommended actions with priorities for the responsible teams.
Verification record
Results and limitations of the agreed follow-up checks.
Before we begin
Good questions.
Clear answers.
Is a VA scan enough to prove that we are secure?
No. It is a point-in-time assessment of the agreed scope and checks. It may not reveal business logic flaws, unknown vulnerabilities or attack chains. Combine it with other controls and deeper testing where appropriate.
Do you use credentialed scanning?
Where appropriate and authorised, credentialed checks can provide deeper visibility into installed software and configurations. We agree least-privilege access, handling and cleanup before the assessment.
Can scanning affect production?
Active checks can place load on systems or affect sensitive services. We agree scan intensity, maintenance windows, exclusions, monitoring and stop conditions to reduce risk.
Does the report guarantee ISO 27001 or PDPA compliance?
No. Findings can support risk management and evidence of security review. Certification and legal compliance depend on a wider set of organisational, technical and procedural measures.
How often should we assess?
Base the schedule on asset criticality, exposure, change frequency and applicable obligations. Recurring scans and checks after important changes are more useful than treating VA only as an annual event.
Let’s make the next move
Make your next fix
the right one.
Share your asset scope and operational constraints. We will help shape an assessment your IT team can put to work.
