Executive Summary
Placed at the beginning of the report and no longer than one page, this is the high-level summary intended for Management.
Verified Scans
Visibility into real risks and clear priorities
Vulnerability Assessment (VA)
The Vulnerability Assessment service provided by ISGroup is designed to analyze and evaluate system security in order to identify known vulnerabilities.
The activity can be carried out externally or internally. In an external Vulnerability Assessment, scanning is performed from a remote host that can access the system only through the Internet.
In the second case, scanning is performed from inside the private network (Intranet), providing greater visibility into the system under review.
These two configurations simulate different attack scenarios: the first simulates an attack by an external attacker, such as an unfair business competitor; the second simulates an internal threat or compromised account, such as a disgruntled employee or a ransomware attack.
After the scanning phase, all identified vulnerabilities are reviewed to eliminate false positives. For each confirmed vulnerability, we provide a detailed description and, most importantly, precise information on how to remediate it.
Given the high number of new vulnerabilities discovered every day, it is essential to perform Vulnerability Assessment with the right frequency to ensure that system configurations remain correct and the appropriate security patches are applied.
ISGroup provides Vulnerability Assessment solutions suited to organizations of any size and requirement, while maintaining a high quality standard.
Description
A Vulnerability Assessment begins with the identification of systems and resources made available for testing, such as services and web applications. Then, using automated tools and manual testing, known security issues are identified in a non-invasive way. Vulnerability Assessments make it possible to quickly understand the security level of a network.
Identification is performed through active techniques, such as version numbers sent by services in their responses, passive techniques, or inference-based techniques, relying on characteristics that software has and cannot hide. Results are manually verified to eliminate false positives and produce a compact and detailed report for both Management and the operational staff responsible for remediation.
The Report
You will receive a clear, detailed document divided into three areas.
Vulnerability Details
The technical section describing the identified vulnerabilities and their impact in detail, intended for the Security Manager.
Remediation Plan
A technical section with precise instructions on how to fix the identified issues, intended for the System Administrator.
When you need a
Vulnerability Assessment
External Vulnerability Assessment
Analyses public IP addresses, firewalls, VPNs, gateways, exposed services and configurations visible from the Internet.
Internal Vulnerability Assessment
Checks servers, workstations, devices and services reachable from the corporate network to identify weaknesses exploitable after initial access.
Credentialed Assessment
Uses authenticated scanning to check patches, installed software, configurations and vulnerabilities that an unauthenticated assessment cannot see.
Cloud Infrastructure Assessment
Assesses virtual machines, networks and services in AWS, Azure, Google Cloud, private clouds or hybrid environments to identify misconfigurations and unintended exposure.
Post-change assessment
Performs a targeted check after migrations, new offices, network changes, major updates or the introduction of new systems.
Periodic or pre-audit assessment
Provides a verified, repeatable snapshot to plan remediation, prepare audits, answer customer questionnaires and measure progress over time.
Show your commitment
At the end of the Vulnerability Assessment, you receive a signed document in Italian and English stating the activity, period and scope. Unlike the report, it contains no vulnerabilities or technical details, so you can give it to anyone who requests it without exposing sensitive information. It is included in the service.
Certificate of execution
IT / EN
- Client
- Activity
- Period
- Scope
ISGroup
Vulnerability Assessment
and compliance
NIS2
Assesses the effectiveness of cybersecurity measures, identifies known vulnerabilities and produces technical results as required by NIS2 Article 21(2)(f).
DORA
Identifies vulnerabilities across networks, servers and cloud environments and documents the checks for the programme under DORA Articles 24-25.
GDPR
Detects vulnerabilities and risky configurations in systems processing personal data and produces technical results supporting GDPR Article 32(1)(d).
PCI DSS
Performs internal and external scans and identifies vulnerabilities in systems protecting payment data, as required by PCI DSS Requirement 11.3.
ISO/IEC 27001
Identifies technical vulnerabilities, assesses their severity and priority, and supports the treatment required by ISO/IEC 27001:2022 control A.8.8.
CIS Control 7
Identifies and tracks vulnerabilities across enterprise assets, prioritises remediation and reduces the attackers' window of opportunity under CIS Control 7.
Frequently asked questions about
Vulnerability Assessment
How long does a Vulnerability Assessment take?
The duration is determined by the number and type of assets, such as servers, network services, applications and devices, and whether the assessment is internal or external. Before starting, we define the assessment scope together so that activities, timing and costs can be estimated accurately.
Can a Vulnerability Assessment cause service disruptions?
ISGroup uses non-invasive techniques to minimize the impact on systems. Multi-tool scans performed with open-source and commercial solutions are manually verified by specialists to remove false positives and provide results the IT team can act on.
Are credentials or specific prerequisites required?
An external assessment examines Internet-facing systems, while an internal assessment is performed from the private network and provides greater visibility. In some scenarios, credentials or agreed access methods increase the depth of the analysis. The essential prerequisite is a precise scope covering systems, IP addresses, applications and operating procedures.
What is the difference between a Vulnerability Assessment and a Penetration Test?
A Vulnerability Assessment systematically identifies known vulnerabilities, misconfigurations and outdated systems. A Network Penetration Test and a Web Application Penetration Test simulate real attack techniques to determine how far a vulnerability can actually be exploited. In short, the first asks "what vulnerabilities are present?", while the penetration tests ask "what could an attacker do by exploiting them?". For a broader overview, read our in-depth guide to Vulnerability Assessment.
How often should a Vulnerability Assessment be performed?
We recommend a Vulnerability Assessment at least once a year and after significant changes to systems, applications or configurations. Critical or exposed infrastructure should be assessed more frequently or monitored through an ongoing Vulnerability Management service.
How much does a Vulnerability Assessment cost?
The quote considers the number of IP addresses, systems and services, internal and external infrastructure, asset types, assessment depth and any recurring scans. Once the scope is defined, we can quickly specify activities, timing and assessment cost, avoiding insufficient or unnecessary work.
How are the assessment results handled?
The report describes potential infrastructure weaknesses and is treated as confidential documentation. ISGroup operates under an ISO/IEC 27001-certified Information Security Management System that also covers Vulnerability Assessment activities.
What does the final report contain?
The report includes an Executive Summary for management, Vulnerability Details covering confirmed issues and their impact, and a Remediation Plan with corrective or mitigation actions. Results are manually verified to remove false positives and help the IT team understand what to fix and in which order.
How can I tell whether my company needs a Vulnerability Assessment?
It is useful for finding known vulnerabilities, outdated software, risky configurations or exposed services, especially after infrastructure changes, new systems, migrations or a long period without testing. If the right scope is not yet clear, ISGroup can define it with you based on your infrastructure and objective.
We've worked with
ISGroup SRL helped us clearly identify the most critical vulnerabilities and their priorities. Professionalism, clarity and constant support made the security improvement journey simple and effective.
ISGroup SRL allowed us to demonstrate to customers the level of security and quality of our software. Technical skills and attention to needs gave us the certainty of having the right partner for the security of our application.
The Flora platform proved to be solid and well protected thanks to ISGroup analyses. A competent and flexible team, capable of adapting to our pace and guaranteeing reliable support throughout the project.
Shape your security priorities into a tailored proposal