01
Asset owner
Approves targets, exclusions and the scan window.
SOLUTION 09 / Information security and risk management
Managed Vulnerability Assessment
Your team gets clear remediation priorities, an owner for each action and evidence of the retest outcome.
Discuss a pilot at your site ↗
From finding a vulnerability to verifying the fix
- 01 Authorize
- 02 Scan
- 03 Review
- 04 Retest
A remediation plan your team can verify
The asset owner approves the target systems, scan window and operating constraints. The authorized scan engine collects evidence from the agreed systems. An analyst validates the finding and sends the recommended action to the asset owner. After the change, we retest and record the outcome and any remaining risk.
The remediation owner implements the agreed fix. The assessment team then verifies the result within the authorized scope.
Vulnerability assessment roles and tools
A managed assessment for one client and a set of assets authorized for testing.
02
Scan platform
Schedules jobs within the approved scope.
03
Scan engine
Tests authorized assets and collects evidence.
04
Client assets
Only systems approved for testing are included.
05
Evidence store
Restricts access to each client’s evidence.
06
Analyst review
Validates findings and prioritizes them in the context of the affected asset.
07
Client report
Lists actions, owners and retest outcomes.
08
Remediation owner
Implements the agreed change and requests verification.
09
Credential vault
Supplies approved credentials for authenticated checks.
What the project includes
- Assessment service
- Define the asset scope, schedule scans, review findings, report recommended fixes and retest.
- Optional extensions
- Internal scan engines or authenticated checks using separately authorized credentials.
- Client inputs
- An authorized asset owner, address ranges, sensitive systems, a maintenance window and an escalation contact.
Pilot one approved asset group
- Scope control — Check scan targets and exclusions against the signed authorization.
- Report quality — Review sample evidence and name an owner for each agreed action.
- Fix verification — Retest a remediated finding and document any remaining risk.
Bring a non-sensitive asset inventory and involve the person authorized to approve testing.
Discuss a pilot at your site ↗Questions from the operations team
How is the authorized scan scope defined?
The asset owner approves targets, exclusions, timing and operational constraints before scanning. Authenticated checks require separate authorization.
How does the client verify a fix?
The remediation owner applies the fix. The assessment team retests within valid authorization and records whether the issue is resolved, open or needs further review.
What site information is needed to define the scope?
An authorized asset owner, address ranges, sensitive systems, a maintenance window and an escalation contact.