How is a vulnerability assessment different from a penetration test?

A vulnerability assessment covers more ground and goes less deep on business logic. Tooling finds known issues. We check the results that would change a decision, and we do not present unconfirmed scanner output as a finding. A penetration test is the better choice when you need to know what an attacker can chain together inside one system. This assessment is the better choice when you need a clean list and a way to show progress.

Is a vulnerability assessment enough for PCI DSS or ISO 27001?

It can be the technical input a program asks for. It is not the audit, and it does not certify you. PCI DSS requirement 11.4, ISO 27001 control A.8.8, and a SOC 2 control are different documents. If you want findings mapped to one of them, name it. The mapping describes gaps. An accredited auditor, if you need one, is a separate engagement with a separate firm or a separate scope we will not blur.

Do you just run a scanner?

We use scanners to see known issues across the asset list. The work you are paying for is the validation and the priority order. A critical score on a host that is not reachable is not written as if the host were on the internet. CVSS is a reference when a number helps you compare items. It does not replace that judgment.

What do you need from us?

An asset list you trust, credentials where authenticated checks are in scope, and the control statements you care about if you want a mapping. We will say when the list is too incomplete for the conclusion you want. An assessment of "everything we own," with no list, is not a thing we can finish honestly.

Can you retest after the remediation program?

Yes, when the retest is in the scope. We check the items you say are fixed and we update the record. A dashboard that has gone green is not the same thing as a check we repeated. The retest can be smaller than the original assessment. It still needs a window and a list.

Vulnerability Assessment & Compliance Gaps

What is a vulnerability assessment?

A vulnerability assessment is a validated survey of known weaknesses across an asset list you trust, plus a priority order your remediation program can schedule. Where you name a control framework, the same findings are mapped to it as gaps. The mapping is not a certificate, and the assessment is not a penetration test. Unconfirmed output from a scanner is not a finding, even when the scanner was loud about it.

What we test

The asset list is the scope. Externally reachable hosts, internal ranges, and authenticated checks against systems you give us credentials for are all possible, and they are different amounts of work. We look for known weaknesses in services, missing patches that are actually exploitable from the position we hold, and default or exposed management interfaces. We do not invent business-logic bugs and call them scanner results. That kind of issue belongs in a web application penetration test or an API penetration test.

If you want the results read against a framework, name it. ISO 27001, SOC 2, PCI DSS, NIS2 expectations, or an internal control set are all workable inputs. For organizations in Qatar, buyers sometimes ask about the National Information Assurance policy or a sector rule from the Qatar Central Bank. For organizations in France and the EU, the question is often NIS2, DORA, or a GDPR security measure. We map gaps to the statements you give us. We do not claim those bodies have approved the work. The Doha and Marseille pages say the same thing in the local context.

Authenticated checks need credentials and a window. An unauthenticated scan of a range answers a narrower question, and the report will say which one you bought.

Approach and standards

Tooling covers the list. Judgment decides what is real. NIST SP 800-115 is a fair description of the shape: plan, discover from the position you authorized, validate, report. CVSS is used when a number helps a program compare items. A high score on an unreachable host will not be written as if the host were on the internet. The severity labels we use everywhere else, described in the methodology, still apply.

We will not pretend a subscription to a scanner was this assessment. The deliverable is the validated list and, if you asked for it, the gap map. A penetration test remains the right tool when the question is what those issues can be chained into. A network penetration test is the right tool when you want that chaining on the perimeter or inside the ranges.

How long it takes and what affects the price

The work is often five to fifteen days, driven by the number of assets, whether checks are authenticated, how many locations or accounts are involved, and whether a framework mapping is part of the report. A tidy list of fifty hosts is a different engagement from an unbounded “please scan the company.” The contract names the list and the window.

Price follows that list, the credentials and safety constraints, and whether a retest is included after a remediation cycle. Mapping to a framework adds time because someone has to read the control statements against the evidence, not because a column was added to a spreadsheet. We will tell you if the list is too incomplete for the conclusion a customer or an auditor is likely to ask for.

What you receive

You receive the asset and framework scope, the validated findings, a gap-oriented summary if you asked for the mapping, and a retest if it was included. Each finding says where it was, how it was confirmed, and what to change. Scanner noise that we could not confirm is not dressed up as risk. The summary says what to schedule first. It does not say that you passed an audit. The surrounding documents match the set on the methodology page.

When to choose this

Choose this when you need coverage, a clean list, and a way to show progress against a named set of controls. Choose a penetration test when you need depth on one application, API, or network path. Choose a cloud security assessment when the assets are accounts and identity rather than hosts and packages. Choose a red team assessment only after you already know the baseline. If a customer has asked for “a pentest and a certificate,” tell us the sentence they used. We will translate it into a scope we can actually perform, on the contact page.