Vulnerability Assessment
Vulnerability Assessment in Zimbabwe
Most breaches use weaknesses that were already known
Outdated software, exposed services and weak configurations are published and scanned for every day. A vulnerability assessment finds the ones that apply to you, so you can fix them on your schedule instead of an attacker's.
Broad coverage
Your agreed websites, servers and internet-facing services checked for known weaknesses and risky settings.
Ranked by business risk
Every finding rated by what it could cost you, not just a technical score, so the urgent items come first.
A fix list you can act on
Plain-English steps for your IT person or developer, with a technical section where it helps.
Checked by a person
Automated results are reviewed by hand to remove false alarms before they reach you.
How we work
01
Scope
We agree which systems are in scope and you sign a written authorisation.
02
Assess
The agreed systems are checked, never beyond the scope, and never destructively.
03
Review
Results are reviewed by hand and ranked by business risk.
04
Report and walk through
You get the report and a call to go through what to fix first.
What you get
- Written authorisation and an agreed list of systems before anything starts
- Assessment of the agreed websites, servers and exposed services
- Manual review of the results to remove false positives
- A written report with findings ranked by business risk
- A call to walk you through the results
- Clear advice on whether a full penetration test is worth it next
Vulnerability assessment
Quoted
Priced after scoping, based on how many systems are in scope. Work starts once the commitment fee in the quote is paid.
Before you approve it
The engagement, in facts.
- Typical timeline
- 3 to 7 days
- Report
- Within 3 working days of testing ending, findings ranked by risk with a fix for each
- Retest
- Free retest of fixed findings within 30 days
- Standards
- OWASP, PTES, NIST SP 800-115 and CVSS
- Confidentiality
- We sign your NDA before scoping, on request
Questions, answered
How is this different from a penetration test?
A vulnerability assessment looks broadly for known weaknesses and ranks them. A penetration test goes deeper and tries to prove what an attacker could actually do with them. Many businesses start with an assessment and test the most important systems afterwards.
Will it disrupt our systems?
It is planned to avoid disruption: only agreed systems are assessed, nothing destructive is run, and timing can be set outside your busy hours.
What do you need from us to start?
The list of systems you want assessed, the person who can authorise testing, and a preferred time window. Never send passwords by email; anything sensitive is shared through an agreed secure method.
Can you assess systems we do not own?
No. Only systems you own or are authorised to have tested, with written permission from the owner.