Room4.06Floor 4 Security and backup
Vulnerability assessment and scanning for business networks
We scan every computer, server, firewall and internet-facing service you own, rank what we find by real-world risk rather than raw scores, help fix it, then scan again to prove the gaps are closed.
- Every device and service scanned
- Internet-facing systems checked
- Findings ranked by real risk
- A rescan after the fixes
What a vulnerability assessment is, and what it is not
A vulnerability assessment is a systematic search for known weaknesses across everything you own: missing security updates, software that is no longer supported, risky settings and services exposed to the internet that should not be. It answers one practical question. Where are the open doors, and which ones should be closed first?
It is often confused with a penetration test, and the difference matters when an insurer or a client asks which one you have had.
| Vulnerability assessment | Penetration test | |
|---|---|---|
| The question it answers | Which known weaknesses exist, and how serious are they? | Could a skilled attacker actually get in, and how far? |
| How it is done | Scanning every device and service, then expert review of the results | A specialist tries to break in by hand, chaining weaknesses together |
| Coverage | Broad: every device in scope | Deep: a few chosen targets |
| How often | Monthly to quarterly | Once a year, or after major changes |
| Who should have one | Every business, as routine hygiene | Businesses with contractual, regulatory or high-value targets |
We carry out vulnerability assessments. We do not sell penetration tests. When you need one, we recommend an independent firm, prepare your environment so their time is not wasted on findings a scan would have caught, and fix what they report afterwards.
What we scan
An assessment that only looks at the servers misses where most attacks start. We cover four areas, agreed with you in writing before anything runs.
Everything facing the internet
Your public IP addresses, firewall, VPN, remote access portals, web servers and anything else answering from outside. We look for exposed management pages, remote desktop open to the world, outdated firmware, weak encryption settings and expired certificates. This is what attackers scan for every day.
Every computer and server inside
Laptops, desktops and servers are checked for missing Windows and application updates, unsupported operating systems, old protocols such as SMBv1, local administrator rights and software like outdated browsers, Java or PDF readers that attackers target heavily.
Network and edge equipment
Firewalls, switches, access points, NAS units and printers are checked against their makers’ end-of-support lists. A firewall that no longer gets updates is the single most dangerous device an office can own, as owners of retired SonicWall and WatchGuard firewalls discovered over the last year.
Your Microsoft 365 tenant
Accounts without MFA, legacy sign-in still allowed, too many global administrators, risky external sharing, mail forwarding to outside addresses and the gaps behind a low Microsoft Secure Score. For cloud-first offices with no server, this is where the real risk sits.
Ranked by real risk, not raw scores
A first scan of a typical 40-person office turns up hundreds of findings. Sorting them by severity score alone sends you chasing the wrong things. A critical-rated flaw on an isolated printer may matter far less than a high-rated one on the VPN that attackers are already exploiting.
So we rank each finding on three things together. The severity score, known as CVSS. Whether the flaw appears on the Known Exploited Vulnerabilities catalog kept by the US Cybersecurity and Infrastructure Security Agency, which lists flaws with evidence of real attacks. And how exposed the device is: reachable from the internet, used by everyone, or tucked away on a separate network.
| Priority | What puts a finding here | Target time to fix |
|---|---|---|
| Fix now | Known to be exploited, or reachable from the internet with a working exploit | Within days |
| Fix soon | Critical or high severity on internal systems, especially servers and identity | Within two weeks |
| Scheduled | Medium severity, or high severity on devices with limited exposure | Next maintenance window |
| Track or accept | Low severity, informational, or no fix available yet | Recorded, with a reason, and reviewed next scan |
Thorough, but careful with fragile equipment
We run authenticated scans wherever we can. An authenticated scan logs in to each device with a read-only account and inspects it from the inside, the way an administrator would.
It finds many times more than a scan that only knocks on the door from the network, and it produces far fewer false alarms.
Scanning is safe for normal office equipment, but some devices are not built to be probed. Older printers, building controls, clinic equipment and machinery on a factory floor can freeze when scanned too hard. We list those devices with you first and either scan them gently, scan them out of hours, or leave them out and assess them by firmware version instead. Scans of servers are scheduled so they never compete with month-end or a backup window.
The report you receive
Scanners produce raw output that runs to hundreds of pages. Nobody running a business should have to read it. Our report is written for the person who has to make decisions, with the technical detail attached for whoever does the work.
For the owner or manager
- A one-page summary of where you stand and what has changed since last time
- The handful of fixes that remove most of the risk
- Any device that has reached end of support, with a replacement cost
- Risks you are choosing to accept, recorded with the reason
For whoever fixes it
- Every finding by priority, with the affected devices
- A plain explanation of the weakness and the specific fix
- Who owns each fix: us, your software vendor or your team
- Rescan results proving each item is closed
The same report answers the vulnerability questions on most cyber insurance applications and supports the controls behind the CyberSecure Canada certification. It also feeds straight into a wider IT assessment if you want the full picture of your setup, or into our ongoing cybersecurity service.
How often to scan
A single scan is a snapshot. New flaws are published every week, so the value comes from repeating it. For most offices we suggest an external scan monthly, an internal scan every quarter, and a rescan after any significant change such as a new firewall or a server migration.
If you have Microsoft 365 Business Premium, Microsoft Defender for Business includes vulnerability management for your Windows devices, which gives continuous visibility between full assessments. We switch it on and use it as the day-to-day view, with the full assessment as the periodic, independent check that covers everything Defender cannot see.
Assessment work we quote
The scope and the price are agreed in writing before any scanning starts. Fixes we carry out afterwards are quoted separately, so you can choose what to do yourself.
- External scan of internet-facing systemsFixed quote
- Full internal and external vulnerability assessmentFixed quote
- Microsoft 365 security configuration reviewFixed quote
- Remediation of priority findingsFixed quote
- Rescan and closure reportFixed quote
- Quarterly scanning programFixed quote
Questions people ask
Is a vulnerability assessment the same as a penetration test?
No. A vulnerability assessment finds known weaknesses across every device you own and ranks them. A penetration test has a specialist try to break in by hand, going deeper into fewer targets. We carry out vulnerability assessments. When you need a penetration test, we recommend an independent firm and fix what they find.
Will scanning slow down or break anything?
Normal office computers, servers and network equipment handle scanning without trouble, and we schedule server scans away from busy periods. Some fragile devices, such as older printers, building controls or factory equipment, can freeze if scanned hard. We agree a list of those with you first and scan them gently, out of hours, or not at all.
How often should we scan?
For most offices, an external scan every month, an internal scan every quarter, and a rescan after any major change such as a new firewall or a server move. New vulnerabilities are published every week, so a single scan quickly goes out of date.
Our cyber insurer asked about vulnerability scanning. Will this help?
Yes. Most cyber insurance applications ask whether you scan for vulnerabilities, how often, and how quickly you patch critical findings. Our report gives you documented answers, and the rescan shows that the critical items were actually closed.
What do you need from us?
A list of your offices and internet connections, permission in writing to scan, a read-only account for authenticated scanning, and a contact who knows about any fragile equipment. For the Microsoft 365 review, temporary read access to the tenant. We handle the rest.
Do you fix what you find?
We can. Fixes are quoted separately after the report, so you can choose what we do and what your own team or software vendors handle. Many priority findings are quick to close, such as missing updates or a risky setting, while others, such as an end-of-life firewall, need a planned replacement.
Why do you use a US government list in Canada?
The Known Exploited Vulnerabilities catalog, maintained by the US Cybersecurity and Infrastructure Security Agency, is the most widely used public list of flaws with evidence of real attacks. Attackers do not respect borders, so a flaw being exploited in the US is being exploited here too. The Canadian Centre for Cyber Security publishes alerts that we watch alongside it.
We only use Microsoft 365 and have no server. Is a scan still worth it?
Yes, though it looks different. For cloud-first offices, the main risks are in the Microsoft 365 configuration, the laptops and the firewall or router at the office. Those are exactly what we check, and the tenant review is often where the most important findings are.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.