Every month
Vulnerability scans
A systematic review of the agreed scope. New findings are added, fixed items are confirmed closed, and the prioritized list is refreshed for whoever is doing the work.
Managed vulnerability assessment
Find the weaknesses. Fix the right ones first.
Monthly vulnerability scans, findings ranked by real-world risk, plain-English remediation guidance and a quarterly summary leadership can act on.
Known weaknesses, found before someone else finds them.
A vulnerability scan checks the systems you place in scope against a constantly updated catalog of known security weaknesses.
- Missing security updates
- Operating systems and applications that are behind on fixes the vendor has already released.
- Outdated or unsupported software
- Programs that no longer receive security fixes and need a replacement plan.
- Risky configurations
- Settings that make a system easier to misuse, such as default passwords or services left open.
- Exposed services
- Systems that can be reached from places they shouldn’t be, including from the internet where in scope.
- Account and sign-in weaknesses
- Settings that make accounts easier to take over, where those systems are part of the agreed scope.
Monthly for the team. Quarterly for leadership.
Every quarter
Executive report
A leadership-level summary: overall exposure, the trend since last quarter, the most important open items and any risk decisions that need an owner.
Not every finding is urgent. Some are.
Each finding is weighed on four questions, so the top of the list is what matters most for your organization, not simply what scored highest.
- 1
How severe it is
The standard severity rating for the weakness (CVSS).
- 2
How likely it is to be used
Whether the weakness is the kind attackers are likely to try (EPSS).
- 3
Whether it is being exploited now
Whether it appears on the U.S. government’s list of vulnerabilities known to be exploited (CISA KEV).
- 4
How much the system matters
What the system does for your organization and what it can reach.
What “guidance” actually means.
Guidance turns a finding into work someone can do. For each item you get:
- A plain-English explanation of the problem and why it matters
- Specific recommended next steps
- A suggested owner, based on the responsibilities agreed during scoping
- Confirmation in a later scan that the fix took effect
- A documented exception when a risk is knowingly accepted
What a findings report looks like.
Filter by severity and open a finding to see the detail. Everything below is fictional and shown for illustration only.
Sample findings report
Example Family Clinic · fictional data
Showing 7 findings.
A single scan is a snapshot. Security changes every month.
Devices are added, software ages, vendors publish new fixes and attackers adopt new techniques. Recurring assessment shows whether exposure is shrinking, holding steady or quietly growing, and confirms that fixes actually worked.
- 1
Scope the environment
We agree which locations, systems and accounts are included, what access is needed, and who is responsible for each kind of fix.
- 2
Assess and identify weaknesses
Scans run against the agreed scope and produce a list of known weaknesses, from missing updates to risky settings.
- 3
Prioritize and guide
Findings are ranked by real-world risk, explained in plain English and paired with recommended next steps.
- 4
Review progress, then repeat
Recurring assessments confirm what has been fixed, catch what is new and show leadership the trend over time.
Two different tools for two different questions.
A vulnerability scan asks “what known weaknesses do we have?” A penetration test asks “could someone actually get in?” Both are useful. This service is the first one.
| Aspect | Vulnerability scanning | Penetration testing |
|---|---|---|
| Purpose | Find known weaknesses across many systems | Test whether a skilled person can break in |
| Method | Automated scanning against the agreed scope | Hands-on testing by a specialist |
| Frequency | Recurring: monthly in this service | Usually a periodic, one-off engagement |
| Output | Prioritized findings and remediation guidance | A narrative of what was attempted and achieved |
| Included in this service | Yes | No, a separate engagement |
Scope is agreed with you, in writing
Before any scanning starts, we agree which locations, networks, systems and accounts are included, what access the assessment needs, and when scans may run.
We also agree who is responsible for each kind of fix (your team, your IT provider or us), so remediation ownership is never a surprise.
What this service is not
It is not a penetration test, not a complete HIPAA Security Risk Analysis and not a guarantee that every weakness will be found. It provides technical evidence that supports those broader efforts.
Start with a scoped vulnerability assessment.
We’ll talk through your environment, agree what’s in scope and prepare a tailored proposal.
Request a Vulnerability Assessment
Or email support@cybersavants.com or text (773) 387-9564