Network

Vulnerability assessment

A broad, validated sweep of your external, internal and cloud estate for known weaknesses — missing patches, risky configuration, exposed services — with every result checked by a person and ranked by what it would actually mean for you.

Book a scoping call All services

areas covered

stages, scoping to retest

In-house

testers, never subcontracted

portal.cyberlysecure.com/acme-health/coverage

Acme Health — Test coverage4 practices · 16 services · one team

In-house

Web app

API

SaaS

Mobile

Client-side

External

Internal

Segment test

Wireless

Vuln. assessment

Cloud config

Hardware & IoT

AI & LLM

Social eng.

Physical

Red team

ApplicationsNetworkCloud & devicesPeople & premises

6 in scope · one team · one report

In-house testers 0 subcontracted

Every surface one team

What this is

What the test covers.

A scanner report with thousands of lines is not an assessment. It buries the handful of issues that matter under informational noise and false positives, and it leaves your team to work out which is which. That is where most vulnerability programs stall.

A vulnerability assessment covers breadth where a penetration test goes deep. We find every known weakness we can reach, confirm the ones that are real, drop the ones that are not, and rank what remains by exposure, exploitability and what the affected system does for your business — so the first fix your team makes is the one that matters most.

It is also the evidence many frameworks ask for in their own words. PCI DSS, HIPAA risk analysis, SOC 2, ISO 27001, CMMC and cyber insurers all expect you to find and fix known vulnerabilities on a regular cycle, and to show that you did.

NIST SP 800-115 NIST SP 800-40 CVSS CISA Known Exploited Vulnerabilities

What we test

Internet-facing hosts, services and the forgotten assets attack-surface discovery brings back
Internal networks, servers and workstations, from inside your perimeter
Cloud workloads, managed services and their exposure to the internet
Missing security updates and end-of-life operating systems and software
Weak or default configuration on servers, network devices and appliances
Exposed management interfaces, legacy protocols and unencrypted services
Authenticated checks, where you provide credentials, for a far more accurate picture
False-positive removal: every reported issue confirmed by a person

How it runs

From scoping call to retest, here’s what happens.

Typically one to two weeks for a mid-sized estate, confirmed at scoping.

Scope and authorize

We agree the ranges, networks and cloud accounts in scope, whether checks run authenticated, and when scanning can run.

Discover and sweep

We find what is actually there, then check every reachable asset for known weaknesses and risky configuration.

Validate by hand

People confirm the findings that matter and remove the false positives, so your team never chases a ghost.

Rank by real risk

Each confirmed issue is ranked by exposure, exploitability and the importance of the system it sits on, not by scanner score alone.

Report and rescan

You get a prioritized report and a remediation list per owner, then a rescan to confirm what your team has fixed.

What it surfaces

The kind of thing this test tends to find.

Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.

Internet-facing systems missing updates for vulnerabilities with public, working exploits

End-of-life operating systems still running business-critical applications

Management interfaces and remote desktop reachable from places they never should be

Default credentials on printers, cameras, switches and appliances

Legacy, unencrypted protocols still carrying credentials across the network

Frameworks this test supports

Testing that counts toward your framework.

These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.

ISO 27001

Annex A control 8.8 asks you to identify technical vulnerabilities, evaluate your exposure and act on it; regular, recorded scanning is the most direct evidence.

ISO 27001 readiness

PCI DSS

Requirement 11.3.1 calls for internal vulnerability scans on the schedule the standard sets. External scans under 11.3.2 must come from an Approved Scanning Vendor, which CyberlySecure is not.

PCI DSS readiness

SOC 1

SOC 1 doesn’t require security testing, but access-related control objectives are stronger when you can show vulnerabilities on in-scope systems are found and fixed.

SOC 1 readiness

CSA STAR

Threat and vulnerability management controls expect regular detection and remediation of vulnerabilities, with records an auditor can sample.

CSA STAR readiness

CMMC

Requirement RA.L2-3.11.2 calls for periodic vulnerability scanning and scanning when new vulnerabilities are identified, and RA.L2-3.11.3 for remediating them according to risk; assessors ask for the scan results and the remediation trail.

CMMC readiness

NIST SP 800-171

Requirement 3.11.2 calls for scanning for vulnerabilities periodically and when new ones are identified, and 3.11.3 for remediating them according to risk.

NIST SP 800-171 readiness

GovRAMP & TX-RAMP

Control RA-5 requires vulnerability scanning, and continuous monitoring depends on scan results that cover the whole inventory and feed the POA&M.

GovRAMP & TX-RAMP readiness

HIPAA

Regular scanning feeds the risk analysis and the evaluation standard, and is one of the measures the proposed Security Rule update names explicitly.

HIPAA readiness

NIST CSF

The Identify function expects vulnerabilities in assets to be identified, validated and recorded; regular scanning is the baseline evidence.

NIST CSF readiness

Privacy: GDPR, CCPA & state laws

Regular scanning is basic evidence of the security of processing the laws require, and it feeds the CCPA cybersecurity audit.

Privacy: GDPR, CCPA & state laws readiness

DORA

Vulnerability assessments and scans are the first item in DORA’s Article 25 list of resilience tests, and customers expect recurring evidence of them.

DORA readiness

Cyber Essentials

Cyber Essentials Plus includes vulnerability scanning of your internet-facing systems and sampled devices, so a scan of your own first shows missing updates and weak configurations before the certification body does.

Cyber Essentials readiness

IRAP

The ISM expects ongoing vulnerability scanning and patching, and the Essential Eight patching strategies depend on knowing what is unpatched.

IRAP readiness

Risk assessment

Feeds the risk assessment real vulnerability data across your estate instead of assumed weaknesses, supporting the vulnerability identification that NIST SP 800-30 and the NIST SP 800-171 risk assessment family call for.

Risk assessment readiness

Security program

Provides the baseline data for your vulnerability management standard and the metrics that show whether it is working.

Security program readiness

M&A due diligence

A vulnerability assessment across the target’s external or internal estate gives a broad read on patching and technical debt, before or after closing.

M&A due diligence readiness

Getting started

What you get, and what we need from you.

What you get

Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
Executive summary — Your risk explained in plain language for leadership and the board.
Attestation letter — Signed confirmation of testing to hand your auditors.
Readout call — A walkthrough with the people who tested your systems.
Retest — Confirmation your fixes worked, documented for whoever needs to see it.

What we need from you

The IP ranges, networks and cloud accounts in scope, with written confirmation you own them
Credentials for authenticated checks, where you want the more accurate picture
A way in for internal coverage: a small virtual appliance or VPN access we agree with you
Agreed scanning windows and a contact we can reach if anything looks unstable

Missing something on this list? Bring it to the call — we scope around what you have.

Others in Network