We find the known vulnerabilities on your perimeter before the bots do
A scan of your whole external perimeter plus a specialist's manual review. You get the list of what to close, without false alarms.
When Vulnerability Assessment is what you need
Broad technical coverage of the whole perimeter. It is not a cheaper pentest: they solve different tasks.
The perimeter has grown unnoticed
There are more services, domains and subdomains, and nobody on the team holds the full picture any more.
The infrastructure changes quickly
Frequent releases and new environments. You need a technical reference point you can repeat.
There has been no external assessment for a long time
Security has only been reviewed inside the team; there has been no independent technical assessment from outside.
SaaS with several systems on the internet
The product, the admin panel, staging, service panels — all of it is visible from outside and all of it is attack surface.
The team wants an independent snapshot
IT or DevOps close the issues themselves, but validation from an external party is needed.
It is not yet time for a large pentest
It is worth closing the obvious across the broad perimeter first, and doing the deep manual testing later.
What we scan and check
The exact list is fixed in the scope. Not every item applies to every company.
- External IP addresses and reachable services
- Domains and subdomains belonging to the company
- Ports and services exposed to the outside
- Outdated components and software versions
- Known vulnerabilities (CVEs) in the components discovered
- TLS/SSL settings and certificates
- Typical configuration mistakes in web and server software
- Administrative interfaces reachable from the internet
- Security headers
- Other externally visible configuration risks
Tools give volume. A person sets the priority.
A specialist checks every scanner finding: what is real, what is false and what to close first.
Systems within the boundaries
We record what belongs to the company and what is included in the assessment.
Scanning
The agreed automated checks, within the limits of the authorisation.
Specialist analysis
We cut out the noise and the false positives, and check the context.
Prioritisation
What to close first and what can wait.
Report and walkthrough
A structured result and specific recommendations for the team.
Seven steps from boundaries to fixes
Boundaries
We determine which systems belong to your company and fall inside the assessment.
Authorisation
Active scanning only after written authorisation from the owner of the systems.
Finding the assets
We record the external assets that fall within the agreed boundaries.
Scanning
We run the agreed automated checks within the limits of the authorisation.
Analysis
A specialist reviews the results, cuts out the obvious noise and sets the priority.
Report
A structured result, the impact of every finding and recommendations.
Retest
If a re-check is part of the agreed boundaries, we verify the fixes once more.
Vulnerability Assessment or pentest
Both formats are useful, but they answer different questions. Pick the wrong one and the budget goes to the wrong place.
What an Assessment answers well
- Which known technical issues are visible across the broad external perimeter
- Where outdated, unnecessarily exposed or misconfigured components remain
- What should be closed first
- What technical state the perimeter is in right now — as a baseline
Where a pentest goes deeper
- Manual testing of a specific application and its API
- Authentication, sessions, roles and access rights
- Business logic and abuse scenarios
- Linked attack chains and real actions within the agreed boundaries
Not sure yet what your external surface even includes?
Start with the external review: it shows what is visible from outside and needs no active steps before permission.
External Security Review
We passively collect the publicly available picture of your external surface and determine whether it is worth going deeper.
Veiltrack Security Program
If besides the perimeter you need to test the application, the team and the access, that comes together as one programme with a single set of boundaries.
Frequently asked questions
An assessment gives broad coverage of the perimeter for known issues: outdated components, unsafe configurations, unnecessarily exposed services. A pentest goes deep into a single application — authentication, access rights, business logic and linked attack scenarios that automated tools do not understand.
Yes. Scanning means active requests to your systems, so it begins only after the boundaries are agreed and authorised in writing by the company that owns those systems.
We agree the intensity and the methods before work starts. If needed, we work in a narrow window or at reduced intensity. We perform no destructive actions.
No. A specialist reviews the automated results: filters out the obvious noise, verifies that a finding really applies to your system and sets the priority. You receive an analysed result, not a tool dump.
It depends on the size of the external perimeter and the agreed boundaries. We fix the timeline and the price before work starts.
Book a 30-minute review call
A short 30-minute conversation: we look at your perimeter and tell you what scope of assessment makes sense.