Continuous vulnerability management on Enginsight
German-developed, GDPR-native vulnerability management as a service. Scan regularly, focus on the risks that matter most and keep remediation moving — all in one managed programme.
Vulnerability management as a service (VMaaS) is a managed service for finding, prioritising and resolving vulnerabilities across your environment. Enginsight provides the technology; Passeca turns the findings into priorities, follows remediation and verifies the result.
A point-in-time assessment tells you where you stand today. VMaaS keeps that picture current, tracks how your exposure changes and keeps remediation aligned with agreed SLAs.
Find
Scan your assets for vulnerabilities.
Prioritise
Turn findings into actionable priorities.
Remediate
Assign and follow remediation.
Verify
Confirm the issue is resolved.
Report
Provide clear evidence for audit and governance.
Provides the scanning technology.
Manages the process from findings to priorities, follows remediation and verifies the result.
Keep pace with changing risk
A one-off scan is a snapshot. Continuous vulnerability management keeps that picture up to date as your environment changes.
New risks can appear at any time:
- new CVEs are published;
- systems and infrastructure change;
- updates and deployments can introduce new misconfigurations.
Instead of waiting for the next quarterly check, continuous monitoring helps you find new issues as they appear, track how exposure changes and keep a clear record of remediation for audits.
Enginsight provides the scanning technology, while Passeca manages what happens next. We review the findings, reduce false positives and prioritise the issues that matter most, so your team gets a clear remediation backlog instead of another long scanner report.
Vulnerability assessment, penetration testing or vulnerability management?
Vulnerability assessment, penetration testing and vulnerability management are closely related, but they do different jobs. The main differences are how often they run, how deep they go and what you get from them.
| Vulnerability assessment | Penetration testing | Vulnerability management | |
|---|---|---|---|
| Main question | What is exposed? | What could an attacker do? | Are we reducing risk? |
| Main output | Snapshot report | Detailed penetration-test report | Ongoing risk and remediation view |
| How often | One-off | Periodic | Ongoing |
| How it works | Automated scanning + validation | Hands-on testing | Regular scanning + tracking |
| What it finds | Known vulnerabilities | Exploitable weaknesses and attack paths | Vulnerabilities and changes over time |
| Tests exploitation | Limited | Yes | Usually no |
| Tracks remediation | Limited | Usually through retesting | Yes, continuously |
| Shows trends over time | No | No | Yes |
Most regulated organisations use all three. Vulnerability management provides ongoing visibility, penetration testing shows real-world impact, and point-in-time assessments give you a clear baseline.
What you get with Passeca's VMaaS
Scanning is only the starting point. The service is designed around what happens after the finding appears.
Continuous, scheduled scanning
Authenticated scans run regularly, so new exposures can be picked up as your environment changes.
GDPR-native, German-hosted
Enginsight is built and hosted in Germany, with EU data residency by default — a strong fit for organisations working under GDPR, NIS2 and public-sector requirements.
Risk-based prioritisation
We look beyond CVSS alone. Exploitability, exposure and business context help show which vulnerabilities need attention first.
IT, OT and cloud coverage
Bring network services, hosts, web applications, containers and cloud environments into one vulnerability-management programme.
Remediation tracking & SLAs
Every priority finding gets an owner, a deadline and an agreed SLA. You can see what has been fixed, what is overdue and where risk remains.
Reporting for compliance
Evidence packs help map your vulnerability-management activity to PCI DSS, ISO 27001, SOC 2, DORA and NIS2 requirements.
Why GDPR matters for vulnerability data
Your vulnerability data reveals where your systems are most exposed. How and where you keep it matters for both security and compliance.
A vulnerability platform can reveal a lot about your environment: which systems you use, where patches are missing and where weaknesses exist. That information needs protection too.
Enginsight, the vulnerability-scanning platform behind the service, is built and hosted in Germany, with data kept in the EU by default. That gives organisations working under GDPR, NIS2 and public-sector requirements a clearer answer to where sensitive security data is stored. If your organisation needs to keep sensitive data in the EU, hosting vulnerability intelligence there removes an extra layer of data-residency complexity.
Which compliance requirements does VMaaS satisfy?
| Framework | Relevant requirement | How VMaaS supports it | |
|---|---|---|---|
| PCI DSS | Req. 11 | Continuous scanning + management | Supports a clear process to find, track and remediate vulnerabilities. |
| ISO 27001:2022 | A.8.8 | Technical-vulnerability management | Gives you a structured way to find, track and verify vulnerability fixes. |
| SOC 2 | CC4.1 | Monitoring of system performance & security | Lets you monitor security weaknesses and act on them over time. |
| DORA | Art. 17 | ICT-risk identification & management | Turns findings into clear priorities, owners and follow-up actions. |
| NIS2 | Art. 21 | Risk-based security measures, evidenced | Enables an ongoing process to identify, prioritise and address vulnerabilities. |
Vulnerability management, answered
What is vulnerability management as a service (VMaaS)?
What is the difference between vulnerability management and vulnerability assessment?
Why Enginsight for vulnerability management?
Does vulnerability management replace penetration testing?
How often does VMaaS scan?
Which compliance frameworks does VMaaS satisfy?
Do you operate the platform or do we self-serve?
Can you explain vulnerability management in simple terms?
What does the vulnerability management lifecycle look like?
Is managed vulnerability management suitable for a small IT team?
Who actually fixes the vulnerabilities?
Turn a one-off snapshot into an ongoing programme
Start with a free exposure check to scope your VMaaS programme with Passeca and Enginsight — or add penetration testing for deeper validation.
Related