Assessment
From $1,500 per scan, fixed scope, free retest. See all pricing →
Reply in one business day
Thanks, we've received your message.
We'll be in touch shortly.
When you need it
The situations that bring teams to this engagement, and where it fits alongside the rest of your program.
Published prices
One validated scan of one defined scope, priced by device count and agreed in writing before it runs. Internal or external, authenticated or unauthenticated, the rate is the same.
Price per validated scan
What is included
Quarterly and monthly programs are priced as a fixed annual figure. The vulnerability scanning cost page explains what moves the price.
What we look for
A vulnerability scan is only useful once someone validates the output. We run and tune the scans, confirm the findings, and strip the false positives so you fix real, prioritized risk, not noise.
Known vulnerabilities in software and systems that scanners surface fast.
We test for
Insecure settings across hosts and services that widen exposure.
We test for
Default or easy-to-guess access sitting on reachable services.
We test for
The analyst work that turns raw scanner output into real, ranked risk.
We test for
Coverage
Four views of the same estate, each finding a different class of weakness. Most programs need all four.
The internet-facing perimeter: exposed services, outdated appliances, TLS weaknesses, and forgotten hosts. The view an opportunistic attacker gets first.
Servers, workstations, and network devices behind the firewall: missing patches, weak configurations, and legacy protocols that an attacker with a foothold exploits to spread.
What is visible without credentials. Quick, safe, and the baseline for both internal and external coverage.
Scanning with credentials on the host or application, which finds the missing patches, local misconfigurations, and outdated software that unauthenticated scans never see. The difference is usually several times more findings.
Cadence
A single validated scan, internal or external, with a prioritized report. The right fit for a baseline, an audit deadline, or a pre-ASV check. From $1,500.
The cadence PCI DSS and most auditors expect. Each cycle is benchmarked against the last, with trend reporting that shows remediation velocity improving.
For environments that change constantly or carry high exposure. Findings flow into your ticketing system as they are validated, and the monthly report becomes a standing agenda item rather than a project.
With remediation tracked to closure and a rescan proving each fix, quarterly and monthly scanning runs as a vulnerability management program. Recurring programs are priced as a fixed annual figure and can be combined with manual penetration testing windows in a penetration testing as a service program.
Where it fits
The terms get used interchangeably. They are not the same thing, and paying for the wrong one is the most common mistake we see. This page is the scan. The analyst-led vulnerability assessment service is the middle column, and our guide to penetration testing vs vulnerability scanning explains when you need which.
Vulnerability scan
Vulnerability assessment
Penetration test
PCI DSS
PCI DSS separates two things that sound alike. Requirement 11.3.1 asks for internal vulnerability scans at least every three months, which we run and validate. Requirement 11.3.2 asks for external scans at least every three months by a PCI SSC Approved Scanning Vendor, and we deliver those ASV scans too. We run a pre-scan first so the official ASV scan passes, fix-verify the findings, and coordinate the timing with your QSA, then run the Requirement 11.4 penetration testing that sits alongside the scans.
Methodology
Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.
These are the phases your vulnerability scanning runs through.
Ranges, hosts, and authenticated versus unauthenticated coverage agreed.
Tuned scans run internally and externally on the agreed cadence.
Analysts confirm findings and remove false positives before anything reaches you.
Findings ranked by exploitability and exposure, not by raw scanner score.
Prioritized list, ticketing integration, and trend reporting over time.
How it works
From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.
Scope & kickoff
Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.
Testing goes live
Findings post to your live platform dashboard the moment our testers confirm them.
Track remediation
Follow every finding from open to fixed, with severity, evidence, and status in one place.
Report & retest
Executive and technical reports land, then request a free retest in one click.
Compliance
Findings are mapped to the requirement or control they evidence, so the same report serves your auditor, your customers, and your engineers.
Proof
Every engagement is confidential, so the work below is anonymized to sector and engagement type.
Free
Retest on every penetration test
185+
Years combined experience
14
Senior in-house specialists
24h
Onboarding after signing
Fintech · Payments
Post-Incident Web App Assessment
Excessive data exposure: API responses leaked transaction metadata, including precise geolocation, enabling real-world tracking of users.
Outcome. Surfaced the exposure and hardening gaps, prioritized by how readily an attacker could chain them, and delivered fixes plus a retest to confirm closure.
8
Findings
3
Medium
Post-incident
Engagement
Fintech · Payments
Web Application Penetration Test
Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.
Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.
1
Critical (RCE)
Mid-test
Critical remediated
2
High
Resources
Vulnerability Remediation: How to Prioritize, Fix and Prove It
A practical vulnerability remediation guide: how to prioritize with KEV, EPSS and exposure, set fix SLAs, run the workflow, and prove the fix with a retest.
Network Vulnerability Assessment Checklist: 30 Checks Before, During, and After the Scan
A network vulnerability assessment checklist: scoping, discovery, authenticated scanning, validation, prioritization, reporting, and the steps teams skip.
Vulnerability Assessment Report Template (With Example)
A free vulnerability assessment report template with each section explained, a filled-in example finding, and how a validated report beats raw scanner output.
Want to see a report first?
Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.
FAQ
What teams most often ask before scoping
vulnerability scanning services.
A vulnerability scan identifies known weaknesses across many systems quickly and is ideal for ongoing coverage. A penetration test goes deeper, manually exploiting and chaining issues to show real impact. Many organizations use scanning continuously and penetration testing periodically.
Yes. Automated output is only useful once validated, so our analysts confirm findings and strip out false positives, leaving your team a prioritized list of real, actionable risk.
Yes. A monthly or quarterly cycle is the usual arrangement, run as a vulnerability management program: we run the recurring scans, validate the results, and trend them over time, integrating with your ticketing workflow so remediation stays on track and each fix is rescanned.
Yes. PCI DSS requires internal and external vulnerability scanning at least quarterly and after significant change, and SOC 2 auditors expect evidence of an ongoing vulnerability-management process. Our recurring, validated scans produce exactly that evidence between your penetration tests, and we deliver the quarterly PCI ASV external scans as well.
A validated scan is $1,500 for up to 250 devices and $2,500 for 251 to 1,000 devices, with larger estates quoted and recurring plans available for ongoing coverage. Starting prices for every service are on our pricing page.
Yes. PCI DSS Requirement 11.3.2 calls for external vulnerability scans at least every three months by a PCI SSC Approved Scanning Vendor, and we deliver those quarterly ASV scans as part of your PCI program. Alongside them we run the internal scans Requirement 11.3.1 asks for, a pre-scan so the official ASV scan passes the first time, and the penetration testing under Requirement 11.4, with the timing coordinated with your QSA.
Commercial and open-source scanners chosen for the target: network and authenticated host scanning, web application scanning, and cloud configuration assessment, tuned per engagement so the results are meaningful for your environment. The scanner is not the product. The analyst validation, false-positive removal, and risk ranking are, and those are the same whichever engine produced the raw output.
Buy the license if you have someone with the time to tune scans, chase false positives, and rank what is left every cycle. Buy the service if you do not, or if an auditor wants evidence that a person reviewed the results. We compare the common tools side by side on our Nessus, Qualys, and Intruder pages.
Yes, as a monthly program, which is the practical form of continuous scanning for most teams: every cycle is validated by an analyst, new findings go to your ticketing system as they are confirmed, and the trend report shows what closed and what is new. Quarterly is the minimum PCI DSS sets for internal scans. Both are priced as a fixed annual figure.
Talk to our team about scoping vulnerability scanning services.
Prefer the full scoping questionnaire?Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.
