// 02 SECURITY
Vulnerability Assessment & Security Audit
A full review of your systems with a prioritised fix list.
A broad review of your servers, websites, cloud accounts, email and endpoints to find misconfigurations and outdated software.
What's included
- External attack-surface scan
- CMS / plugin review
- Cloud configuration review
- Email security (SPF, DKIM, DMARC)
- Password and MFA policy review
- Backup check
Our methodology
- 1Attack-surface mapping: identify every internet-facing asset — domains, subdomains, IPs, cloud services — including ones you may have forgotten about.
- 2Automated and manual review: CMS/plugin versions, cloud configuration, email authentication (SPF/DKIM/DMARC), password and MFA policy, and backup status.
- 3Risk ranking: every finding is scored by real-world impact and likelihood, not just scanner severity.
- 4Roadmap: findings are grouped into quick wins and longer-term fixes, sequenced over 90 days.
What you get
- Risk-ranked findings
- Quick-win list
- 90-day improvement roadmap
What to expect
- A single, prioritised list of what's exposed and what to fix first.
- A realistic 90-day improvement roadmap your team can actually execute.
- A documented baseline you can measure future improvement against.
Limitations
Honest scope, not a sales pitch — here's what this service doesn't cover.
- An assessment identifies known and configuration-based weaknesses; it is not a full penetration test and does not attempt to exploit findings.
- Coverage is limited to the assets and access you provide during scoping.
- New systems or services added after the assessment are not included until a follow-up review.
FAQ
How is this different from a penetration test?
A vulnerability assessment finds and prioritises weaknesses through scanning and manual review; it doesn't actively exploit them the way a penetration test does. Many businesses start here, then move to a full pentest for exposed customer-facing systems.
Do you need production access?
Mostly no — we work from what's publicly visible plus read-only access you grant (e.g. DNS, cloud console). We'll confirm exactly what's needed during scoping.
How often should we run this?
Most businesses benefit from an annual review, or after any major infrastructure change such as a new server or cloud migration.
// PROCESS
How this engagement works
- // 01
Free consultation
30 minutes to understand your setup and concerns.
- // 02
Scoped proposal
Fixed scope, fixed price, clear timeline. NDA signed before any access.
- // 03
Testing & review
We test safely, with written authorisation, inside agreed boundaries.
- // 04
Report & fix
Plain-language report, prioritised by risk, and a free re-test after you fix.
Authorisation & safety
Every engagement starts with written authorisation and, where appropriate, a signed NDA — we never test a system without the owner’s explicit permission. Testing is scoped and scheduled with you in advance, avoids destructive techniques by default, and stays inside the boundaries agreed before any work begins.
// FROM THE BLOG
Further reading
A Business Owner's Guide to Patch Management and the CISA KEV Catalog
Most businesses cannot patch everything, all the time. Here is how to use CISA's Known Exploited Vulnerabilities catalog to decide what actually needs fixing first.
Why Vulnerability Exploitation Is Now the #1 Breach Entry Point in 2026
For the first time in 19 years, vulnerability exploitation has overtaken stolen credentials as the leading way attackers get in. Here is what changed, and why scanning alone is not enough anymore.
Ready to talk through your scope?
Book a free consultation. No obligation, no pressure.