A vulnerability assessment discovers known weaknesses, validates material findings and prioritises remediation according to exposure, exploitability and business impact. It is suitable for organisations that need a reliable technical baseline, recurring assurance or broader coverage than a penetration test can provide within the same period.
The purpose is to replace unprioritised findings with a current view of exploitable exposure and accountable remediation.
Scope is fixed with you before any work starts. Depending on the objective, environment and authorised access, the engagement may cover:
Agree asset ownership, scanning windows, credentials, exclusions and operational safeguards.
Use appropriate authenticated and unauthenticated methods to improve coverage.
Review high-risk results, remove obvious false positives and confirm affected assets.
Consider exploitability, exposure, business criticality, compensating controls and fix availability.
Provide a baseline and, where agreed, support later validation or recurring assessment.
Everything we hand over speaks to both leadership and the people who will act on it. Depending on scope, they may include:
Asset ownership, data quality and prioritisation criteria are agreed before analysis. Findings are validated, grouped by root cause and linked to remediation owners so that the output does not become an unmanageable list of vulnerabilities.
The engagement may draw on CVSS used with contextual risk factors, CISA Known Exploited Vulnerabilities where relevant, CIS and vendor guidance, applicable customer policies. Referencing a framework describes how we structure the work; it is not, in itself, a certification, accreditation or regulatory ruling.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
A vulnerability assessment is not the same as penetration testing. It primarily identifies known weaknesses and visible configuration issues; it does not automatically demonstrate complete attack paths or eliminate the need for manual testing.
Discuss Vulnerability Assessment with CTG. A short scoping session confirms the objective, boundaries, evidence, delivery model and outputs before we issue a proposal.
Scope is fixed with you before any work starts. Typical areas include external and internal network assets, Servers, workstations and common operating systems, Web services, databases and infrastructure applications where supported, and Authenticated and unauthenticated scanning. Exclusions, required access, your responsibilities and acceptance criteria are all set out in the proposal.
Deliverables depend on the agreed objective and may include asset and coverage summary, Validated vulnerability register, Executive risk overview, and Technical findings with affected assets and evidence. Every significant finding is tied to evidence, business impact, priority and a clear owner for the next step.
Exposure management identifies, validates and prioritises weaknesses across a defined estate. Penetration testing is a separate authorised exercise that attempts controlled exploitation to demonstrate realistic attack paths.
Priority should reflect exploitability, asset criticality, exposure, threat activity, control effectiveness, business impact and remediation dependencies - not severity scores alone.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
These services answer related but distinct questions. Scoping identifies whether Vulnerability Assessment, External Attack Surface Management, or a coordinated programme is the smallest useful approach without duplicating work.
A vulnerability assessment is not the same as penetration testing. It primarily identifies known weaknesses and visible configuration issues; it does not automatically demonstrate complete attack paths or eliminate the need for manual testing.
