It is the process, not the scan, that closes the gap.
Producing a scan report is easy. The hard part is separating what is truly exploitable from thousands of findings and applying the patch without breaking production. Our service focuses on these two steps.
Six steps from inventory to retest
Asset inventory.
Defining the scan scope completely; an asset that is not in the inventory cannot be scanned.
Scanning.
Authenticated and unauthenticated scans, on a set schedule.
Prioritisation.
CVSS alone is not enough; exploit availability, internet exposure and business criticality are evaluated together.
Patch plan.
Target time, maintenance window and test step by criticality class.
Temporary mitigation.
If a patch cannot be applied: virtual patching, access restriction or configuration change.
Retest.
Verification of every finding claimed to be closed.
Penetration test scopes
External test
On internet-facing assets, from an attacker's perspective.
Internal test
Lateral movement possibilities of an attacker who has gained network access.
Web application
Based on the OWASP Top 10, including business logic tests.
API testing
Authorisation bypass, data leakage and rate limiting checks.
Social engineering
On request, with the scope subject to written approval.
Report and retest
Executive summary, evidence-backed technical findings and retest after remediation.
Target times by criticality
| Criticality | Target time |
|---|---|
| Critical | 7 days (72 hours for internet-facing assets) |
| High | 30 days |
| Medium | 90 days |
| Low | During planned maintenance |
The monthly report includes the number of open vulnerabilities by criticality, the average time to close and the justification for findings that exceed the target time. If the number is rising, we report that too.
Alongside this solution
Cybersecurity
SOC, penetration testing, Law No. 5651 compliance and Kuantum Pi for SMEs.
DevOps
Repeatable delivery with Kubernetes, CI/CD, Infrastructure as Code and GitOps, in your data centre or in the cloud.
Middleware
Installation, hardening and version upgrades for WebLogic, IIS, Tomcat and Nginx.
A no-commitment start in three steps.
Discovery call
We spend 45 minutes understanding your environment and priorities. Free of charge.
Free initial assessment
After the meeting, a one-page note with initial findings and recommendations; the findings are yours to keep. A full health check and risk report are part of our accelerator packages.
Package or service
Start with an accelerator package or go straight to managed services.