Vulnerability Scanning

Your first line of defence — automated tooling combined with expert analysis, on a cadence that meets Essential Eight.

CyberTI® offers essential vulnerability scanning services, a key part of any cybersecurity strategy. We combine automated tools with expert insight for accurate assessment across both conventional IT and cloud environments.

Scanning on its own produces volume. Scanning paired with analysis produces a queue your team can actually work through.

Terms on this page

EPSS
EPSSExploit Prediction Scoring SystemA data-driven model, scored daily by FIRST, estimating the probability that a published CVE will be exploited in the wild within the next 30 days.Full glossary →
KEV
KEVKnown Exploited Vulnerabilities catalogueCISA's published record of vulnerabilities confirmed to be under active exploitation. Presence in KEV is evidence, not prediction.Full glossary →
CVSS
CVSSCommon Vulnerability Scoring SystemA severity score describing how bad a vulnerability would be if exploited. Its own specification treats the base score as a ceiling, not a measure of risk in your environment.Full glossary →

Capabilities

How vulnerability scanning works

Automated scanning at scale

Consistent, repeatable coverage across your whole estate, on a cadence set per asset class rather than one interval applied to everything.

Expert interpretation

An analyst reviews output, removes noise and adds the context a tool cannot.

Cloud and conventional IT

The same discipline applied to cloud workloads and on-premises infrastructure alike.

Prioritised by EPSS and KEV

EPSS estimates the probability a CVE will be exploited in the next 30 days, scored daily. CISA's KEV catalogue records what is confirmed to be under active exploitation. Both sit on top of CVSS severity and exposure context.

Reference

Scanning cadence and patch windows

The intervals ASD's Essential Eight actually expects, by asset class. This is the artefact most useful to a team preparing for an Essential Eight assessment.

Asset class	Expected scan interval	Patch window
Internet-facing services	At least daily	Two weeks — or 48 hours where an exploit exists
Office suites, browsers and extensions, email clients, PDF software, security products	At least fortnightly (ML1)	One month (ML1)
Workstations, non-internet-facing servers, network devices	Fortnightly to monthly	One month (ML1)

Continuous

Your attack surface does not wait for the next scheduled scan

New exposure appears between scans. The interval between looking is the window somebody else is looking in.

FAQ

Frequently asked questions

What is vulnerability scanning?

Vulnerability scanning is the process of identifying potential security weaknesses in computer systems and networks, using software assessment tools that compare your environment against known vulnerability data.

What can scanning detect?

Outdated software, missing patches, misconfigurations, weak or default credentials, and exposed services that should not be reachable.

How often should we scan?

More often than most organisations do, and the interval should differ by asset class.

ASD's Essential Eight expects vulnerability scanning at least daily for internet-facing services, at every maturity level. For office productivity suites, web browsers and their extensions, email clients, PDF software and security products, scanning is expected at least fortnightly at Maturity Level One. Less exposed assets — workstations, non-internet-facing servers and network devices — sit on a fortnightly to monthly cycle.

If you are scanning everything monthly, you are below Maturity Level One on your most exposed systems.

Once you find something, how fast do we have to fix it?

For internet-facing services, ASD's Essential Eight expects patches or mitigations applied within two weeks of release — or within 48 hours where an exploit already exists. Less exposed applications and operating systems run on a one-month timeframe at Maturity Level One.

The 48-hour clock is the one that catches people out. It means your remediation process needs a fast lane, not just a monthly change window, and it means you need to know which of your vulnerabilities are being actively exploited — which is why we prioritise the way we do.

How do you decide what we fix first?

Not by CVSS score alone. A CVSS base score describes how bad a vulnerability would be if exploited — it is a severity ceiling, not a statement of risk in your environment.

We layer three things on top. EPSS, the Exploit Prediction Scoring System, is a data-driven machine-learning model that estimates the probability a published CVE will be exploited in the wild in the next 30 days, scored daily for every CVE. CISA's Known Exploited Vulnerabilities catalogue records what is confirmed to be under active exploitation. And exposure context — whether the affected asset is actually reachable, and what it is worth.

The practical result: a medium-severity flaw on an internet-facing system with a high EPSS score outranks a critical on an isolated internal host. That is the order we give you.

Will scanning disrupt our systems?

Scanning is typically non-intrusive. Where a check carries any risk of impact, we agree it with you in advance and schedule accordingly.

How is scanning different from penetration testing?

Scanning identifies potential weaknesses automatically and at breadth. Penetration testing verifies which of those are genuinely exploitable, by having a tester attempt it.

Also in this service