Vulnerability assessment: know where you stand
Gjethe scans your websites, servers, networks and cloud for known weaknesses, verifies the results by hand to remove false positives, ranks what is left by real risk and gives you a clear, prioritised plan to fix it. It is a broad health check, scheduled regularly or run as a one-off.
- Free first consultation
- Written quote for your project
- Flexible payment milestones
At a glance
- Covers
- Websites, servers, network, cloud
- Method
- Scan, then verify by hand
- Ranking
- By real risk, not raw severity
- Cadence
- One-off or on a regular schedule
Definition
What is vulnerability assessment?
A vulnerability assessment is a systematic review that identifies, verifies and ranks known security weaknesses across systems, so an organisation can fix the most important ones first.
A vulnerability assessment answers a simple question: where are the known weaknesses in what we run? It casts a wide net across your websites, servers, network and cloud, finds outdated software, exposed services, weak configuration and missing patches, then separates the real issues from the noise. Unlike a penetration test, it does not try to exploit and chain weaknesses; it maps them broadly so you can reduce risk steadily. Many teams run assessments on a regular schedule and use penetration tests for depth on the systems that matter most. The two work together: the assessment tells you where to look, and the test tells you how far a determined attacker could get once they are there.
Who is it for?
Growing businesses
As you add systems, it gets hard to track what is exposed. An assessment gives you a current picture.
Teams starting a security programme
A broad assessment is the natural first step before deeper, targeted testing.
Companies with mixed estates
Old and new systems side by side hide forgotten servers and outdated software.
Teams with compliance goals
Regular assessments support the ongoing review many frameworks expect.
What's included, and what you keep
What's included
- Agreed inventory of systems to assess
- External scanning of internet-facing systems
- Internal scanning where in scope
- Website and application scanning
- Cloud configuration review where in scope
- Software and dependency version checks
- Manual verification to remove false positives
- Risk ranking based on exposure and impact
- Prioritised remediation plan
- Clear report for technical and non-technical readers
- Optional scheduled re-assessment
- Guidance call on the findings
What you receive
Handed over at the end. Yours to keep.
- Vulnerability assessment report
- Verified, risk-ranked list of findings
- Prioritised remediation plan
- Executive summary
- Optional recurring assessment schedule
Vulnerability assessment or penetration test?
| Vulnerability assessment | Penetration test |
|---|---|
| Broad coverage of known weaknesses | Deep focus on chosen targets |
| Scans, then verifies findings | Actively tests and combines weaknesses |
| Answers "what is weak?" | Answers "what could an attacker achieve?" |
| Often run on a schedule | Run periodically and before big releases |
| A steady risk-reduction tool | A depth and assurance tool |
Why verification matters
Scanners are thorough but literal. They flag anything that looks like a known weakness, which means raw scan output is full of items that do not apply, duplicates and theoretical issues that your setup already blocks. Handing that straight to a team wastes days and buries the findings that count.
We review the results by hand: confirming which issues are real in your environment, grouping related ones and ranking them by how exposed they are and what they would cost you. You get a short, honest list of what to fix first, not a hundred-page export nobody reads.
Breadth first, then depth
The hardest part of security is often simply knowing what you have. Businesses accumulate systems: a marketing site, an app, a staging server someone spun up, an old subdomain pointing at a service nobody maintains. Attackers look for exactly these forgotten corners, because they are the least likely to be patched or watched. A vulnerability assessment starts by drawing an honest map of what is actually exposed, which is valuable on its own.
Once the map exists, the assessment measures each part against known weaknesses and ranks what it finds. This breadth-first picture is the natural foundation for everything else. It tells you which systems deserve a deeper penetration test, which old services should simply be shut down, and where routine maintenance has quietly fallen behind. Run on a regular schedule, it turns security from an occasional panic into a steady, measurable routine.
We keep the report practical. For each issue you get what it is, where it is, how serious it is for you specifically and the clearest way to resolve it, so the plan can go straight to whoever owns that system.
How vulnerability assessment works, step by step
Every step has a clear output you can review. Timing is agreed in your quote.
- 1
Scope
Systems, addresses and access for the assessment agreed in writing.
- 2
Discover
Live systems and services found, so nothing in scope is missed.
- 3
Scan
Automated scanning across the agreed websites, hosts and cloud.
- 4
Verify
Findings checked by hand to remove false positives.
- 5
Prioritise
Real issues ranked by exposure and business impact.
- 6
Report
A clear plan of what to fix first and why.
Tools, and what shapes your quote
Pricing is based on your project and agreed in your quote. These are the things that move it.
| Factor | Why it matters |
|---|---|
| Number of systems | More hosts, sites and accounts mean more to scan and verify. |
| External and internal scope | Internal scanning needs access and adds coverage and effort. |
| Cloud in scope | Reviewing cloud configuration adds to a network-only assessment. |
| Verification depth | Removing false positives by hand takes time but makes the report usable. |
| Cadence | A recurring schedule is planned differently from a one-off assessment. |
| Area | Tools |
|---|---|
| Network | Nmap, vulnerability scanners |
| Web | OWASP ZAP, Burp Suite |
| Dependencies | dependency scanners, version checks |
| Cloud | cloud configuration review tools |
Common mistakes to avoid
What we see go wrong most often, and how a good project avoids it.
Shipping raw scanner output
Unverified scans bury real issues in false positives and lose the team's trust.
Assessing only the obvious systems
Forgotten servers and old subdomains are often the weakest points.
Ranking by severity alone
A high-severity issue on an isolated system can matter less than a medium one on a public app.
Assessing once a year only
New weaknesses appear constantly; regular assessment catches them sooner.
Frequently asked questions
How is this different from a penetration test?
An assessment broadly finds and ranks known weaknesses; a penetration test deeply tests chosen targets and tries to combine weaknesses. Many teams use both: assessments for breadth, tests for depth.
Will scanning disrupt our systems?
We tune scans to be gentle on production and can schedule them for quiet periods. Intensive checks are run against staging or agreed in advance.
Can you assess our cloud as well?
Yes, where it is in scope. We review configuration in AWS, Azure or Google Cloud alongside network and web scanning, or in depth as a cloud security assessment.
Do you remove false positives?
Yes. Every finding in the report is verified by hand, so you spend time on real issues, not scanner noise.
Can you run assessments regularly?
Yes. Many clients schedule recurring assessments so new weaknesses are caught and tracked over time.
Do you help us fix the findings?
Yes. The report includes a prioritised plan, and our team can carry out or review the fixes.
Does this support compliance?
Regular assessment supports the ongoing review many frameworks expect, though formal certification comes from accredited bodies.
Do you sign an NDA?
Yes. The report is confidential and shared only with the people you name.
What do we need to provide to start?
A list of the systems and addresses in scope, the access needed to scan them and a named contact. For internal scans we agree how we reach the internal network safely.
How long are the findings valid?
An assessment is a snapshot of a moment in time. New weaknesses and system changes appear constantly, which is why many teams schedule assessments regularly rather than treating one as permanent.
Related services
Penetration Testing
Authorised, scoped security tests with a fix-it report.
Cloud Security Assessment
Review AWS, Azure and Google Cloud for misconfigurations.
Secure Code Review
Review your codebase for security flaws before release.
Website Security
Hardening, malware clean-up and security reviews.
DevOps & CI/CD
Automated pipelines, containers and infrastructure as code.
Cloud Deployment
Vercel, AWS, Azure and Google Cloud set up properly.
Vulnerability Assessment by industry
Get a clear picture of your risk.
Tell us what you need. You get an honest assessment, a clear plan and a written quote. The first consultation is always free.
- What happens next
- 1You tell us what you need
- 2We aim to reply within 24 hours with questions
- 3You get a written quote for your project