Managed
We run the tooling, tune it and keep it current, so you do not have to stand up a scanner, learn it or babysit the schedule.
- We run the scans
- Infrastructure & web apps
- No tooling to maintain
- A consultant to ask
Vulnerability scanning
Catch new vulnerabilities as they land.
Vulnerability scanning is the automated, repeatable half of security testing. We run it for you across your infrastructure and web applications, triage out the noise, and surface new weaknesses as they appear. It keeps watch between your penetration tests, and it never pretends to replace one.
Triaged
A consultant reviews every scan and strips the false positives, so you get a short list of what actually matters, not a raw dump of hundreds of alerts.
- Human-verified findings
- False positives removed
- Prioritised by impact
- Clear remediation
Continuous
Run it monthly or fortnightly on a subscription, so new CVEs and misconfigurations surface within days of landing, not at the next annual test.
- Monthly or fortnightly
- New CVEs in days
- Between pen tests
- Trend over time
Scanning vs a pen test
Where scanning fits.
A scan gives you breadth: it sweeps every asset, again and again, for known issues. A penetration test gives you depth: it proves what a real attacker could actually do. Most clients do both, and we will always tell you honestly which one you need.
See the full comparisonBreadth, continuous
Vulnerability scanning
Known CVEs, missing patches and misconfigurations across every asset, swept on a schedule.
Depth, point-in-time
Penetration testing
Manual exploitation and chained attacks a scanner cannot find, proving real business impact.
How it works
One simple, repeatable cycle.
The same steps run every time, so you always know what is happening and what you will get.
- 01
Scope your assets
We agree the infrastructure and web applications in scope, and how often you want them scanned.
- 02
Baseline scan
We run a first full scan to establish where you stand today, across your external and internal assets.
- 03
Triage and verify
A consultant reviews the results, verifies the real findings and removes the false positives.
- 04
Custom report
You get a clear report of what matters, prioritised by impact, with remediation guidance for each finding.
- 05
Recurring cadence
On a subscription, we repeat the scan monthly or fortnightly, so new issues surface within days.
- 06
Track and retest
We track findings over time and confirm your fixes, so you can see your exposure trending down.
Deliverables
What you get.
No wading through pages of alerts. You get a short, verified report and a clear picture of your exposure over time.
- A custom report of verified findings, not raw scanner output
- False positives removed and findings prioritised by real impact
- Clear remediation guidance for each issue
- Coverage of both infrastructure and web applications
- The cadence you choose, monthly, fortnightly or one-off
- Trend tracking so you can see your exposure improving
FAQ
Vulnerability scanning, answered.
Straight answers to what clients ask most about managed scanning.
Does vulnerability scanning replace a penetration test?
No, and we will never sell it as one. Scanning is automated breadth: it repeatedly checks your assets for known issues, missing patches and misconfigurations. A penetration test is manual depth: a CREST-certified tester exploits and chains flaws to prove real business impact. Most clients do both, scanning continuously for coverage and pen testing for depth, and we will tell you honestly which one your situation needs.
Is it fully automated, or is there a human involved?
There is always a human. We run the tooling, but a consultant reviews every scan, verifies the findings and strips out the false positives, so what you get is a short, accurate list of what actually matters rather than a raw scanner dump with hundreds of low-value alerts.
How often do you scan?
As often as you need. Most clients run it continuously on a subscription, monthly or fortnightly, so new CVEs and misconfigurations surface within days of appearing. We can also run a one-off baseline scan if you just want a point-in-time picture.
What do you scan?
Your infrastructure and your web applications: external and internal hosts, exposed services, patch levels and configuration, plus the known weaknesses and outdated components in your web apps. We agree the scope and the assets with you before we start.
Do you cut out the false positives?
Yes, that is the whole point of a managed service. Raw scanners are noisy and flag things that are not real or not exploitable. A consultant triages every run, so the report you receive is the signal, not the noise, with clear remediation guidance for each finding.
Can you keep watch between our penetration tests?
Yes, that is exactly what continuous scanning is for. A pen test is a point-in-time snapshot; the day after, a new CVE or a new server can change your exposure. Recurring scanning fills that gap, catching new issues in days rather than waiting for the next annual test.
Ready to keep watch between tests?
Tell us what you want scanned and how often. We will come back within one working day with a suggested approach and a fixed price, with no sales theatre.