Vulnerability management that ends in fixes, not in a longer list
A recurring review of your systems, run by people: we scan, we sort out what is real, we rank it by how it could actually be used against you, and we follow it until it is closed.
Overview
What a vulnerability review is for
A scanner produces findings. Most organisations have more findings than time, and the report that lands every month is read once and filed. The work is in deciding which few matter this month and making sure they get fixed.
Black Fox runs vulnerability reviews on a fixed rhythm you choose, for example monthly. Each cycle we scan the agreed scope, confirm and triage the results, rank them by exploitability and by how exposed the affected system is, and agree the fixes with the teams who own them.
This is not a penetration test. A review finds known weaknesses across a wide estate, repeatedly; a penetration test goes deep and shows what an attacker could chain together. Many clients use both, and the review tells you where the next test should look.
Who it is for
Organisations with more systems than people to watch them, teams that already own a scanner but not the time to read its output, and anyone whose framework expects regular vulnerability management, as ISO/IEC 27001, SOC 2, PCI DSS and NIS2 programmes commonly do.
The work, from scoping to evidence.
What we do
Scope and asset inventory
We agree what is in scope, such as external hosts, internal networks, cloud accounts and web applications, and keep the inventory current as it changes.
Recurring scanning
Authenticated and unauthenticated scans on the agreed rhythm, scheduled around your maintenance windows and change freezes.
Triage
We remove false positives and duplicates, check the findings that look serious by hand, and add the context a scanner cannot know.
Prioritisation
Findings ranked by whether they are known to be exploited, how reachable the system is and what it holds, not by the scanner's score alone.
Fix tracking
We work with your system owners on each fix, agree target dates with them and verify the fix on the next scan.
Trend reporting
A view across cycles of what is open, what is closing, what keeps coming back and where the same root cause shows up.
How the engagement runs
Kickoff
We agree the scope, the rhythm, the owners and the rules of engagement, and sign an NDA first if you need one.
Baseline
A first full scan and triage that shows where you stand today, with the backlog sorted into an order you can work through.
Recurring cycles
Each cycle we scan, triage, rank and hand the new and changed findings to the right owners.
Review meeting
A short session with your teams per cycle to agree priorities, accept or reject risks and unblock stalled fixes.
Verification
We rescan what was fixed and close it only when the evidence says it is gone.
Periodic review
At agreed intervals we look back at the trends with you and adjust scope, rhythm and priorities.
What you receive
- Agreed scope and asset inventory
- Baseline report with a prioritised backlog
- Per-cycle report of new, open and closed findings
- Fix tracker with owners, target dates and verification status
- Risk acceptance records for findings you decide not to fix
- Trend report for management and auditors
Questions
How is this different from a penetration test?
A vulnerability review is broad and recurring: it looks for known weaknesses across your whole scope, every cycle. A penetration test is deep and occasional: a tester tries to break in and shows what can be chained together. They answer different questions and work well together.
Do you fix the vulnerabilities?
Your teams own the systems, so they make the changes. We tell them what to change and why, help them with the fix when they need it, and verify the result. Hardening work can be scoped separately if you want us to do more of it.
Which scanners do you use?
It depends on your environment. We can work with the tools you already run or bring our own, and we triage the output either way. The scanner matters less than what happens to its findings.
Do you promise fix times?
No. Fix times depend on your teams and your change process. We agree target dates with each owner, track them and report honestly when they slip.
Related services
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
- Managed securityContinuous complianceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.
Start with a baseline
Tell us what you run and how it is managed. The first cycle shows you where you stand and what to fix first.