Point-in-time vulnerability assessment
A snapshot scan of your estate to find known vulnerabilities — validated, prioritised and delivered with remediation guidance. The starting point for understanding exposure.
A vulnerability assessment is a point-in-time scan of your estate — servers, endpoints, network, cloud and applications — to find known vulnerabilities. Passeca runs authenticated scanning, validates and deduplicates findings, prioritises by CVSS and exploitability, and delivers a remediation-ordered report. It is the fastest way to see what is exposed right now.
What is a vulnerability assessment?
A breadth-first, automated-and-validated snapshot of known weaknesses across an estate. It is the entry-level offensive-security activity.
A vulnerability assessment enumerates the known vulnerabilities present in your infrastructure and applications — missing patches, misconfigurations, weak ciphers and default credentials — using authenticated scanning. Raw scanner output is noisy, so each assessment includes validation and de-duplication: we remove false positives, group related findings, and rank the result by CVSS combined with real exploitability.
The output is a remediation-ordered report: a prioritised backlog your IT and operations teams can work down. It does not include exploitation — that is what penetration testing adds. If you need to know not just what is vulnerable but whether an attacker can actually use it, pair the assessment with a pentest.
Vulnerability assessment vs vulnerability management vs penetration testing
Three related but distinct activities. Most organisations need all three at different cadences.
| Vulnerability assessment | Vulnerability management | Penetration testing | |
|---|---|---|---|
| Cadence | Point-in-time (snapshot) | Continuous / scheduled | Point-in-time (deep) |
| Approach | Automated + validated scanning | Automated scanning + tracking | Manual exploitation |
| Depth | Known vulnerabilities only | Known vulnerabilities + trends | Exploited & chained into attack paths |
| Output | Prioritised remediation list | Living remediation programme + SLAs | Demonstrated business-impact report |
| Answers | What is exposed now? | Are we fixing things over time? | Can an attacker actually use this? |
| Best for | Baseline / one-off check | Continuous hygiene programme | Compliance & assurance |
Need continuous scanning instead of a one-off snapshot? See vulnerability management as a service on Enginsight. Need exploitation and demonstrated impact? See the penetration testing hub.
What does a Passeca assessment include?
How long does an assessment take, and what does it cost?
Driven by estate size and whether scanning is authenticated. Smaller and faster than a pentest of the same estate.
| Estate size | Typical duration | Price band |
|---|---|---|
| Small (<100 assets) | 2–3 days | Price on request |
| Medium (100–500 assets) | ~1 week | Price on request |
| Large (500+ assets) | 1–2 weeks | Price on request |
When is an assessment the right choice?
- You have no current visibility. An assessment is the fastest baseline of what is exposed.
- A compliance deadline needs scanning. PCI DSS quarterly scanning, ISO 27001 and SOC 2 monitoring evidence.
- You need a remediation backlog. A prioritised list your IT team can work down.
- Before a pentest. Fix the easy noise first so the pentest concentrates on what matters.
Vulnerability assessment, answered
How it differs from pentest and continuous VM, cadence and compliance.
What is a vulnerability assessment?
How is a vulnerability assessment different from penetration testing?
How is a vulnerability assessment different from vulnerability management?
How often should a vulnerability assessment be run?
Does a vulnerability assessment satisfy PCI DSS?
Does a vulnerability assessment include exploitation?
See what's exposed right now
Book a free consultation to scope a vulnerability assessment of your estate — or move straight to continuous vulnerability management if your environment changes frequently.
Related