Browser patchingUpdate confirmed in follow-up scanManaged
Critical server patchMaintenance window to approveDecision needed
Configuration checksOld protocol disabledManaged
Unsupported softwareReplacement plan agreedManaged
Illustration · not live data
01Who it's for
Is this service right for you?
Most organisations already patch. What they lack is proof: laptops miss updates away from the office, old servers fall off the list, and a VPN appliance goes unpatched because nobody owns it.
Built for
Organisations with 5 or more staff with laptops, servers and cloud services to keep patched
IT teams and managed service providers who apply the fixes and want them confirmed
Government, health and education teams working to a named framework
You probably need it if…
You patch regularly but can't prove what is still exposed
Your scanner reports are long and nobody knows where to start
You need to meet ASD's patching timeframes
An auditor, insurer or customer wants evidence of vulnerability management
02What's included
What you get
Find & scan
Asset discovery
We identify the devices, servers, cloud workloads and internet-facing systems you actually have, including the ones nobody remembered. You can't protect what you don't know about, so this list comes first.
Continuous scanning
Authenticated internal scans, agent-based scans for laptops away from the office and external scans of everything the internet can see. Results update as new vulnerabilities are published, not once a year.
Configuration checks
Checks against recognised hardening benchmarks pick up weak settings that are not software flaws, such as old protocols, default accounts or missing security options. Each one comes with the setting to change and why it matters.
Prioritise & fix
Risk-based prioritisation
We rank each weakness by how severe it is, whether attackers are actively exploiting it and how important the affected system is to your business. You get a short list of what to fix first, not a raw scanner export.
Fix guidance and tracking
Each priority finding comes with a clear fix, such as a patch, configuration change or workaround. We track progress with your IT team or provider and check fixes in a follow-up scan.
Report & review
Trend and compliance reporting
Regular reports show open risk over time, how quickly fixes are applied and progress against the patching timeframes ASD sets. Leadership, insurers and auditors get clear evidence of progress.
Cyber Security
A short list ranked by what an attacker could use
A raw scan can produce a long list of issues. We filter for what is exposed, exploitable and sitting on systems that matter to you, so your team works through an ordered list instead of chasing every score.
03In detail
Vulnerability management, in depth
What does risk-based ranking look like in practice?
A traditional scanner sorts by severity score, and on a typical network that list runs to hundreds or thousands of items. Ranking by real risk changes the order. A medium-severity flaw on your internet-facing VPN, with active exploitation, ranks above a critical flaw on an isolated test machine.
That judgement is where experience counts. The team interpreting your results also carries out penetration testing, so we know which findings attackers actually use and how they chain together. Your IT provider gets a decision they can act on, not a data dump.
For example, a scan might find an internet-facing VPN appliance running firmware with a publicly exploited flaw. That finding goes to the top of the list, ahead of hundreds of lower-risk ones, and is patched and rescanned as a priority.
How does it support ASD Essentials?
ASD has released the ASD Essentials series, which will replace the Essential Eight. The transition timeline hasn’t been set, and organisations are still assessed against the current maturity model in the meantime. That model sets scanning frequencies and patching timeframes, with tighter timeframes for internet-facing systems and actively exploited vulnerabilities. The FAQ below sets out what Maturity Level One expects.
Finding and fixing vulnerabilities stays central under either framework, so the work carries over. Our ASD Essentials readiness and uplift service baselines all eight strategies, and vulnerability management can also run inside managed security alongside your other tools.
04The process
How it works
1Step 01
Find
We map your assets and agree what will be scanned, how and when.
2Step 02
Scan
We deploy scanners and agents and run the first full assessment of your environment.
3Step 03
Prioritise
We rank findings by real-world risk and agree the first set of fixes with you.
4Step 04
Fix
Your IT team or provider applies the fixes, with our guidance where needed.
5Step 05
Confirm and report
Follow-up scans confirm each fix, and regular reports show how your exposure is changing.
05Frameworks
How this maps to the frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
Vulnerability Management: framework mapping
Control
ASD maturity model (current)
ISO/IEC 27001
NIST CSF
Asset discovery
–Not applicable
A.5.9
Identify (ID.AM-01)
Continuous vulnerability scanning
Patch applicationsPatch operating systems
A.8.8
Identify (ID.RA-01)
Risk-based prioritisation
–Not applicable
A.8.8
Identify (ID.RA-05)
Fix guidance and tracking
Patch applicationsPatch operating systems
A.8.8
Protect (PR.PS-02)
Configuration checks
–Not applicable
A.8.9
Protect (PR.PS-01)
06Pricing
Pricing and how to start
Pricing
Quoted for your environment
What changes the price
Final price depends on the number of devices, servers and internet-facing addresses scanned, whether cloud and web application scanning are included, and whether we only report or also manage fixes with your IT provider.
Asset discovery and continuous internal, agent and external scanning
Risk-based vulnerability management ranks weaknesses by real-world risk rather than by severity score alone, adding threat activity and how much the affected system matters. The result is a much shorter list of urgent fixes, so your team spends its time on what is most likely to be used against you.
Do we still need a penetration test if we scan continuously?
Usually, yes. Continuous scanning finds known weaknesses across all your systems, but it can't show whether they can be exploited in your environment or how several minor issues combine. A penetration test answers that, typically at set points and after a major change. Scanning keeps day-to-day exposure low, and testing confirms that your defences hold against a person actively trying to get in.
How often should we scan for vulnerabilities?
At least daily for internet-facing services and at least weekly for common applications such as browsers and Office, which is what ASD's current maturity model expects at Maturity Level One. Continuous scanning is better still, because new vulnerabilities are published every day. Our service scans on a schedule and also checks for newly published issues between scans, so a serious new flaw is less likely to sit unnoticed until the next cycle.
How does vulnerability management help with ASD's patching controls?
Two of the strategies ASD prioritises are patch applications and patch operating systems, and both require you to find missing patches and fix them within set timeframes. Vulnerability management gives you the scanning, the evidence and the tracking those strategies need. It also highlights unsupported software, which ASD's current maturity model expects you to remove or replace, starting at Maturity Level One for internet-facing services, browsers, Office and operating systems.
What does the 30-day vulnerability management trial include?
The trial gives you 30 days of scanning on your own environment, so you can see your real exposure before committing. The trial is available to organisations with 65 or more endpoints or users; for smaller environments we scope a one-off assessment or a right-sized service instead. At the end, we walk you through the findings and show which fixes would reduce your risk the most.
Will vulnerability scanning disrupt our systems?
Scanning is designed to be safe for production systems, and agent-based scanning puts almost no load on the network. We agree scan windows with you, start gently on sensitive or older systems, and exclude anything you want left alone. If a scan ever affects a system, we stop the scan and adjust the settings before running it again.
