Skip to main content
Cyber Secret Society

Services

Vulnerability Assessment

A clear, validated picture of the known weaknesses in your environment — prioritised so you can fix the most important issues first.

Request a Security AssessmentWhat we test

What a vulnerability assessment delivers

A vulnerability assessment systematically identifies known vulnerabilities and misconfigurations across the systems you choose — such as internet-facing hosts, web servers, and applications — and tells you which ones matter. It answers the question: what known weaknesses are present right now, and how serious are they?

Raw scanner output is noisy. It mixes real issues with false positives and rates them without context. Our assessment validates the results, removes what doesn't apply, and ranks what remains by the risk it poses in your environment, so the output is a usable work list rather than a long export.

What the assessment covers

The target environment and asset list are agreed in writing. Depending on that scope, the assessment can include:

  • Asset and exposure review

    Confirming the in-scope hosts, services, and applications, and identifying exposed services that may not have been expected to be reachable.

  • Vulnerability identification

    Automated and manual checks for known vulnerabilities in operating systems, services, web servers, frameworks, and third-party components.

  • Configuration weaknesses

    Insecure defaults, weak TLS configuration, missing security headers, unnecessary services, and exposed administrative interfaces.

  • Validation and false-positive removal

    Checking findings to confirm they genuinely apply, so your team doesn't spend time on issues that don't exist.

  • Severity and prioritisation

    Rating each confirmed issue by its likely impact and exploitability in your context, not just a generic score.

Not every area applies to every engagement. The areas tested are listed in the scope we agree with you before work starts.

Vulnerability assessment or penetration test?

The two are often confused. A vulnerability assessment is broad: it aims to find as many known weaknesses as possible across a set of assets, and confirm they are real. A penetration test is deep: it takes a specific application or system and tries to exploit weaknesses — including unknown, logic-specific ones — to show what an attacker could actually achieve.

A vulnerability assessment is a good starting point when you need coverage and a prioritised baseline. A penetration test is the right choice when you need to know whether a particular application can be compromised and how. Many organisations use both: an assessment to find and fix the known issues, followed by a penetration test of their most important application.

Breadth

Vulnerability assessment: many assets, known issues. Penetration test: one application or system, in depth.

Method

Vulnerability assessment: identification and validation. Penetration test: manual exploitation and chaining of weaknesses within agreed limits.

What you receive

A report built to drive remediation:

  • A summary of exposure across the assessed assets, highlighting the highest-risk issues.
  • A prioritised list of confirmed vulnerabilities with severity, affected assets, and evidence.
  • Remediation recommendations for each issue — patches, configuration changes, or compensating controls.
  • Notes on findings that were investigated and ruled out as false positives, where useful.
  • A follow-up review of remediated issues, where it is part of the agreed engagement.

Before the assessment starts

  • A written list of in-scope IP addresses, hostnames, and applications — and confirmation that you own or are authorised to test each one.
  • Notice to any hosting or cloud provider where their policy requires it.
  • Agreed testing windows and a contact for any issue that needs urgent attention.

Please don't send credentials, keys, or vulnerability details through the website form. We agree a secure channel once an engagement is confirmed.

Engagement process

From first conversation to verified fixes

A simple, predictable process. Actual timing and deliverables depend on the scope we agree.

Swipe to see all 6 steps

  1. Step 01

    Initial discussion

    You tell us what you want assessed and why. We ask the questions needed to understand the application, API, or codebase.

  2. Step 02

    Scope & authorization

    We agree targets, test types, environments, timing, and exclusions — and obtain written authorization before any testing.

  3. Step 03

    Assessment or review

    Testing or code review is carried out within the agreed scope, with a named point of contact on both sides.

  4. Step 04

    Findings & reporting

    You receive a written report with risk-rated findings, supporting evidence, and reproduction steps.

  5. Step 05

    Remediation guidance

    We walk through the findings with your team and clarify how to fix each issue in your environment.

  6. Step 06

    Retesting, if agreed

    Where included in the engagement, we verify that fixes are effective and update the report.

FAQ

Vulnerability Assessment: common questions

Can't find your answer? Ask us directly, or browse every question in the full FAQ.

Ask a questionFull FAQ

No. Automated scanning is part of it, but the value comes from validating results, removing false positives, and prioritising what remains in your context. You receive confirmed findings and recommendations rather than raw scanner output.

Related services and resources

Want a clear view of your exposure?

Tell us about your application, API, or software security requirements. We can discuss the appropriate scope and next steps.

Discuss Your Security RequirementsAll services

What happens next

  1. 01We review your enquiry and reply by email
  2. 02An initial discussion about your application and goals
  3. 03A written scope — nothing is tested until it's agreed