1. Perimeter inventory
We identify the domains, subdomains, IP addresses and public services that belong to the authorized perimeter. Output: an asset inventory, with the items confirmed by the client marked.
Vulnerability assessment · Remediation priorities · From €490
Web vulnerability assessment: what is exposed and what to fix first
A vulnerability assessment identifies and classifies the vulnerabilities of websites and applications, ranks them by risk and proposes a remediation plan. It turns a list of signals into operational decisions your team can follow.
What a vulnerability assessment is
It is a broad and systematic check of the exposed surface. It answers three questions: what is reachable from the internet, which components have known vulnerabilities, and which of these must be fixed first.
Unlike a penetration test, a vulnerability assessment does not try to exploit weaknesses in depth. Its value lies in coverage, repeatability and the ability to show how the situation changes over time.
The five phases of our assessment
Automation for coverage, human control for quality. Each phase produces a document that stays in the file.
2. Controlled scanning
We run automated scans on services, configurations and components, with parameters agreed in advance so that the service is not degraded. Output: raw signals per asset.
3. Correlation and verification
We match component versions against published vulnerabilities (CVE) and verify uncertain cases by hand, to remove false positives. Output: vulnerabilities confirmed or excluded, each with a reason.
4. Prioritization
Each vulnerability is ranked by severity, the presence of public exploits and the real exposure of the system. Output: a risk ranking with the reason for every position.
5. Plan and re-verification
The remediation plan assigns priorities and owners. After the fixes we re-verify, free of charge within 30 days. Output: the correction plan and a comparison with the previous cycle.
What we assess, in practice
Four families of checks, chosen according to what is actually exposed.
Exposed surfaces
Domains, subdomains, listening services, unexpected open ports and test or development environments reachable from the internet.
Versions and known vulnerabilities
Web servers, frameworks, CMS, libraries and plugins, matched against published vulnerabilities. The most frequent risk here is an outdated component.
Configuration
TLS protocols and ciphers, security headers, cookies, directory listings and error messages that reveal internal information.
Data exposure
Sensitive files left accessible, forgotten backups, public configuration files and information an attacker can collect without authenticating.
What the client receives
The report is built to be used, not archived. Each document answers a specific question.
Asset inventory
The list of what is exposed, with the items confirmed by the client marked. It is the baseline for every later cycle.
Vulnerability ranking
Each entry with severity, exposure, the reason for its priority and references to the published vulnerabilities. No lists without context.
Remediation plan
Fixes grouped by component, with priorities, a suggested owner and operational guidance for the people who must act.
Management summary
A page that explains the state of the perimeter, the main risks and the decisions required, without requiring technical background.
How often to run it
The security of a perimeter changes every time a component changes. That is why an assessment is more useful when it is repeated.
We recommend a cycle every 4 or 6 months for perimeters that change often, and in any case after a major release, a hosting change, a new integration or the publication of a critical vulnerability in components you use. Each cycle is compared with the previous one: what was closed, what is new, what got worse.
Vulnerability assessment or penetration test: which one you need
The choice depends on the question you need to answer. They are not alternatives: often the first prepares the second.
You need broad coverage
You have many sites or components and want to know what is exposed. Start with the vulnerability assessment.
You need proof of impact
A client, a tender or an auditor asks whether a weakness is really exploitable. You need the penetration test.
You need a continuous cycle
The perimeter changes often. A repeated vulnerability assessment shows the trend; a penetration test is added on the critical applications.
You need evidence for ISO 27001
Control 8.8 asks for documented management of vulnerabilities. Our report is built to document it.
Common mistakes in managing vulnerabilities
The same problems appear in organizations of every size.
- Fixing by severity alone. A critical issue on an unreachable system can be less urgent than a medium one on a public service with an available exploit.
- Receiving thousands of signals without verification. Without manual validation the team loses weeks to false positives.
- Having no owner. A plan without an owner is not executed, even when it is correct.
- Running a single cycle. An isolated assessment ages quickly. The value lies in the comparison between cycles.
What you need to get started
- The list of domains and services to include, indicating those you own or are authorized to test.
- A time window for the scans, agreed in advance if the site has high traffic.
- A contact who confirms the inventory and receives questions during the work.
- The signed authorization and rules of engagement, before the start.
How much it costs
The Single perimeter plan costs €490 one-off, VAT excluded, for one primary domain with its subdomains. More domains or extended perimeters are quoted on request, with scheduled cycles from three cycles onward. The full price list is on the home page.
Frequently asked questions on vulnerability assessment
How often should a vulnerability assessment be repeated?
It depends on how often your systems change. For perimeters that change often we recommend a cycle every 4 or 6 months, with a comparison between one cycle and the previous one.
Is a vulnerability assessment enough for compliance?
It is a piece of evidence, not a certification. It shows continuous control over vulnerabilities, which supports ISO/IEC 27001, NIST, NIS2 and GDPR requirements alongside your other controls.
What is the difference from a scanner?
A scanner produces signals. Our assessment verifies them by hand, removes false positives and ranks them by risk, so the team knows what to fix first and why.
Do you need access to our servers?
No. The single-perimeter assessment is external: it looks at the public perimeter. Checks with internal access or with credentials are a separate service, quoted on request.
How do you handle false positives?
Every uncertain signal is reproduced or verified by hand. The report lists both the confirmed vulnerabilities and the excluded ones, with the reason.
Does the report help answer client security questionnaires?
Yes. It documents the perimeter, the method, the date, the outcomes and the corrective actions: the information security questionnaires usually ask for.
How long does the report take?
We deliver the report within 5 working days of the signed authorization. The free re-verification is included within 30 days.
Can the vulnerability assessment slow the site down?
Scans are configured with parameters agreed in advance so as not to degrade the service, and they can run in a window you choose.
Want to know which vulnerabilities affect your perimeter?
Send us one domain: within 24 hours we tell you in writing whether the €490 verification fits, on which perimeter and what we would look at.
Read your perimeter for free