Missing security updates
Unpatched operating systems, VPN gateways, firewalls, or mail servers with publicly known vulnerabilities. For many of them, ready-made exploits are circulating that attackers use in automated attacks.
Security Services
Vulnerability Assessment for Networks and Systems
Verified, not scanner noise.
With a professional vulnerability assessment, we find known security flaws in your servers, clients, and network components before automated attacks exploit them. We verify the findings, remove false positives, and prioritize by real-world risk – so your team knows what to tackle first.
- Fixed price after scoping
- Free retest
- Quote within 24 hours
Definition
What is a vulnerability assessment?
A vulnerability assessment – often also called a network vulnerability assessment – systematically examines your IT infrastructure for known security flaws. At its core is a vulnerability scan: specialized scanners compare operating systems, services, applications, and network devices against continuously updated information on publicly known vulnerabilities (CVEs). This reveals missing updates, insecure configurations, and outdated encryption.
A scan alone, however, is not yet an assessment. Raw scanner data contains false positives, duplicates, and findings that have nothing to do with your actual risk – and a list with hundreds of entries doesn’t help any IT team. That’s why we verify the relevant results manually, put them into your context, and translate them into a prioritized remediation plan.
A vulnerability assessment differs from a penetration test mainly in depth. It shows broadly where known vulnerabilities exist but does not actively exploit them. A penetration test goes further, chains vulnerabilities together, and proves what damage an attacker could actually do. Many organizations combine both as VAPT (vulnerability assessment and penetration testing).
Why this matters: attackers scan the internet automatically for vulnerable systems – often shortly after a vulnerability has become known. So it’s not just specifically selected companies that end up in the crosshairs, but everyone whose systems are reachable from the internet. Frameworks such as the EU NIS2 Directive, ISO/IEC 27001:2022 (Annex A, control 8.8), and DORA (the EU Digital Operational Resilience Act) therefore expect a structured approach to managing technical vulnerabilities. A regular vulnerability assessment provides the foundation for this.
Our approach
How we approach your vulnerability assessment
We combine automated scans with the experience from our penetration tests. Depending on the goal, we test from two perspectives: from the outside, the way attackers see your systems from the internet, and from the inside, the way your network looks to someone who has already gained a foothold – for example, via an infected client.
Authenticated scans are especially meaningful. The scanner logs on to the target systems with a dedicated account and reads patch levels, installed software, and local settings directly. This lets us find vulnerabilities that remain invisible from the outside, such as outdated libraries, vulnerable client software, or missing hardening measures.
Then the actual analysis begins: we manually check critical and high findings, weed out false positives, and rate each vulnerability by CVSS, exploitation likelihood (EPSS), available exploits, and the importance of the system to your business. Our scans are low-impact and run in agreed time windows. We test sensitive systems such as OT components or medical devices only with adapted profiles or exclude them by agreement.
Common vulnerabilities
What a vulnerability assessment typically uncovers
Unsupported systems
Operating systems and applications for which the vendor no longer provides security updates. Every newly discovered flaw stays open here permanently.
Unnecessarily exposed services
Remote Desktop (RDP), databases, file shares, or management interfaces that are reachable from the internet even though they don’t need to be.
Default and weak credentials
Factory passwords on printers, switches, web interfaces, or server remote management interfaces such as IPMI – a convenient entry point for attackers.
Outdated encryption
TLS 1.0 and 1.1, weak cipher suites, expired or self-signed certificates, and insecure SSH configurations.
Insecure protocols
Plaintext protocols such as Telnet and FTP, the outdated SMBv1, or SNMP with default community strings – they allow data to be intercepted, systems to be attacked, or configurations to be read out.
Misconfigurations
Open directory listings, verbose error messages, default pages, or sample applications that give attackers valuable information.
Unknown systems
Forgotten test servers, shadow IT, or devices that don’t appear in any inventory – and are therefore not covered by any patch process.
Options
The right vulnerability assessment for your goal
Perimeter
External vulnerability assessment
We check all systems that are reachable from the internet. Ideal as a quick start and for regular checks of your perimeter.
- Public IP ranges, domains, and subdomains
- Detection of unnecessarily exposed services
- No access to your internal network required
Authenticated
Internal vulnerability assessment
We scan your internal networks, preferably with logon to the systems. This creates a complete picture of patch levels and configuration.
- Servers, clients, and network components
- Patch levels and local configuration read out directly
- Discovery of previously unknown systems
- On site or remotely via VPN or a provided test system
Recurring
Continuous vulnerability assessment
We repeat the assessment at fixed intervals, e.g., monthly or quarterly, and make changes visible at a glance.
- Comparison reports: new, fixed, still open
- Early detection of newly published vulnerabilities
- On request with Greenbone in your own environment
Comparison
Vulnerability assessment or penetration test?
The two approaches complement each other but answer different questions. This overview helps you choose.
Vulnerability assessment
Breadth over depth: we identify known vulnerabilities in many systems at once.
- Finds missing updates, misconfigurations, and insecure services
- Automated scans, verified and prioritized by experts
- Quickly repeatable – ideal for regular checks
- No active exploitation of vulnerabilities
Penetration test
Depth over breadth: we attack in a targeted way and show what is actually possible.
- Manual attacks that exploit and chain vulnerabilities
- Also finds logic flaws and previously unknown vulnerabilities
- Proves the real-world impact of an attack
- Recommended for critical systems and after major changes
VAPT: The combination of regular vulnerability assessments for breadth and targeted penetration tests for depth has proven effective. The assessment often shows where a pentest will pay off most.
Explore Penetration TestingProcess
How your vulnerability assessment works
From the initial conversation to the retest – clearly structured like all our security services, with a dedicated contact at Rootsektor and a named contact on your side.
-
01
Scoping
We clarify IP ranges, sites, system types, and time windows and decide together whether to scan with authentication. You then receive your fixed-price quote within 24 hours (on business days).
-
02
Preparation
You set up a dedicated scan account and inform your IT operations and, if applicable, your IT service provider. We define sensitive systems as exceptions, and you find out in advance which IP addresses we will scan from.
-
03
Scan & verification
We run the scans, verify the results, and remove false positives. We report critical vulnerabilities immediately – during the assessment, by phone or email to the agreed contact.
-
04
Assessment & report
We prioritize each finding by CVSS, EPSS, exploit availability, and business context. You receive a report with an executive summary, a technical section, and concrete measures – with a debrief on request.
-
05
Retest & test certificate
After remediation, we retest the affected systems free of charge and issue a test certificate. With the continuous option, the next cycle then begins.
Reporting
A report your team can work with right away
Our report is not an exported scanner report. In just a few pages, it explains to senior management where your systems stand and gives your IT team all the details for remediation – sorted by urgency rather than by IP address.
- Executive summary with a risk overview
- Verified findings with CVSS ratings and an assessment of exploitability
- Affected systems, evidence, and root causes
- A concrete remediation recommendation for each finding
- Prioritized remediation plan with quick wins
- Test certificate to present to customers, partners, insurers, and auditors
Do you know which vulnerabilities are open in your network?
Find out before an attacker does. After scoping, you receive a fixed-price quote for your vulnerability assessment within 24 hours (on business days).
FAQ
Frequently asked questions about the vulnerability assessment
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What is the difference between a vulnerability assessment and a penetration test?
The vulnerability assessment searches broadly for known vulnerabilities and misconfigurations but doesn’t exploit them. A penetration test goes deep: experts attack manually, chain vulnerabilities together, and show the real-world impact. For solid baseline protection, we recommend regular vulnerability assessments, complemented by penetration tests for critical systems.
What is an authenticated scan – and do we need one?
In an authenticated scan, the scanner logs on to the systems with a dedicated account and checks patch levels and configurations from the inside. This delivers far more complete and accurate results than a scan without logon, which only sees what a service reveals to the outside. That’s why we almost always recommend authenticated scans for internal assessments.
Can a vulnerability scan disrupt our operations?
When performed professionally, the risk is low. We limit the scan load, agree on time windows with you, and exclude sensitive systems such as older specialized hardware or test them with low-impact profiles. For production networks, we offer dedicated OT and ICS tests tailored to the specifics of industrial plants.
How often should we carry out a vulnerability assessment?
New vulnerabilities are published every day – a one-time assessment is therefore only a snapshot. Intervals of one to three months have proven effective, plus additional scans after major changes such as new systems or network restructuring. For environments with high protection requirements, a continuous process is advisable.
How do you deal with false positives?
Scanners regularly report vulnerabilities that don’t actually exist – for example, because a vendor backports security fixes without changing the version number. We verify relevant findings manually, e.g., through targeted checks or by comparing them with the actual patch level. In the report, we clearly mark which findings have been confirmed.
How do you prioritize the vulnerabilities found?
The starting point is the CVSS rating. We also consider the exploitation likelihood according to EPSS, whether public exploits exist or the vulnerability is already being actively exploited, and how critical the affected system is for your organization. A medium-severity flaw on a VPN gateway reachable from the internet can thus be more urgent than a critical one on an isolated test system.
Can we run the vulnerability scans ourselves?
Yes. As a Greenbone partner, we support you in building your own vulnerability management – from setup and scan policies to evaluation. Greenbone can also automatically check systems against selected modules of the BSI’s IT-Grundschutz Compendium. On request, we continue to handle the verification and prioritization of the results. Learn more on our Greenbone page.
Does a vulnerability assessment help with NIS2, ISO 27001, or DORA?
Yes. NIS2 explicitly names vulnerability handling and disclosure as part of risk management, ISO/IEC 27001:2022 provides for the management of technical vulnerabilities in Annex A (8.8), and DORA counts vulnerability assessments and scans among the tests of digital operational resilience. The report and test certificate document your measures in a traceable way, e.g., for auditors.
Related pages
Request a vulnerability assessment
Let us know which networks and systems should be assessed and whether you’re planning a one-time or a recurring assessment. We’ll get in touch for a short scoping session and then send you a fixed-price quote within 24 hours (on business days).