Vulnerability scanning and assessment for Canadian businesses

What vulnerability scanning finds, and where it stops

A vulnerability scan compares what your systems reveal to the internet against large databases of published flaws, so it is very good at spotting known, catalogued problems quickly and at scale. Typical results fall into five families, listed below.

A scanner reads versions, banners and responses; it does not reason about how your business works. Flaws in custom logic, a stolen password used from a normal location, a staff member tricked by a phone call, or two small weaknesses chained into a large one all sit outside what an automated scan can see. Those gaps are why a scan pairs well with a security audit and, for high-value systems, a penetration test.

• Software with a published flaw: an old CMS, plugin, web server, VPN appliance or firewall firmware
• Missing security updates on servers you can reach from outside
• Admin interfaces left open to the whole internet: hosting panels, database tools, remote desktop
• Weak encryption settings, expired or mismatched certificates
• Default pages, sample files and directory listings that reveal how a system is built

Vulnerability assessment: every scan result is checked by a person

A vulnerability assessment turns raw scanner output into a short list of real problems, and that step needs a person. Scanners report false positives, repeat one issue across dozens of pages, and miss context: a flaw in a module you never switched on is a different matter from the same flaw on your login page.

The NIST Cybersecurity Framework 2.0 states the outcome plainly: vulnerabilities in assets are identified, validated and recorded.¹ We treat the word validated literally. Each result is reproduced or checked by hand before it reaches your report, and anything we cannot confirm is either removed or marked as unconfirmed with the reason.

How findings are ranked: severity, exposure and known exploitation

Each confirmed finding gets a severity from the Common Vulnerability Scoring System (CVSS), the open standard published by FIRST; version 4.0 maps scores from 0 to 10 onto five ratings.² FIRST presents the score as a measure of technical severity that organizations combine with their own factors when they assess risk.²

We add two factors of our own. The first is whether the flaw appears in the Known Exploited Vulnerabilities catalogue, which the US Cybersecurity and Infrastructure Security Agency keeps as a list of flaws confirmed to be exploited in the wild.³ The second is exposure: whether the system answers from the internet and what data sits behind it. Together they decide the band in which each finding lands.

• Today: exploited in the wild, or critical and reachable from the internet
• This month: high severity, or medium on a system that holds personal or financial data
• Later: low severity, internal only, or blocked by another control already in place

Vulnerability management services: from a single scan to a regular cycle

Vulnerability management is the repeating cycle of discovering assets, scanning them, confirming and ranking results, fixing, and scanning again; one scan only describes a single day. New flaws are published every week, so a clean report ages quickly. CIS Control 7, Continuous Vulnerability Management, asks organizations to continuously assess and track vulnerabilities on all enterprise assets to shrink the window an attacker has.⁴

Canadian guidance points the same way. The baseline controls for small and medium organizations call for automatic patching or a full vulnerability and patch management program,⁶ and the Top 10 IT security actions ask that security patches be applied as soon as possible under your patch process.⁷ We run the same daily vulnerability check on our own servers and more than 80 websites, so the cycle below is one we work inside every day.

The scan can be a one-off assessment, or repeated on a schedule written into the scope letter. The diagram shows one turn of the cycle.

External vulnerability scan and attack surface: what we look at

An external vulnerability scan looks at your business from the internet, the way a stranger would, and the attack surface is the full list of things that answer from outside. For most small businesses that list is longer than expected, because services added years ago by a former provider are still running.

Attack surface management means keeping that list current and shrinking it: switching off what nobody uses, putting admin panels behind a VPN or an allow list, and making sure every remaining service is patched. The targets are always named in the scope letter; servers inside the office network can be added when the letter covers them.

• Your domains and the subdomains published in DNS
• Public IP addresses of the office, the hosting account and cloud servers
• Websites and online stores, including the CMS and its plugins
• Mail servers and webmail login pages
• VPN gateways, remote desktop and other remote-access entry points

Vulnerability assessment and penetration testing: how they fit together

A vulnerability assessment lists the known weaknesses across many systems; a penetration test takes a few targets and tries to exploit them, to show what an attacker could achieve. The assessment is broad, repeatable and suited to a regular schedule. The test is deep, done at a point in time, and usually ordered for a specific system or because a contract requires it.

The two are often sold together under the label VAPT. For a small business the sensible order is assessment first, fixes second, and a penetration test once the easy entry points are closed, so the tester spends paid hours on the hard questions. Penetration testing is arranged on request with its own scope.

Dark web monitoring and leaked passwords

Dark web monitoring searches leaked databases and criminal forums for email addresses and passwords tied to your domain, and alerts you when one appears. It tells you that a credential was exposed somewhere; it cannot tell you whether that password still works or where it is reused.

The protective steps are the same whichever source reports the leak: reset the password, turn on two-step sign-in, and check the mailbox for forwarding rules someone else may have added. Those account checks are part of our security audit, and a mailbox tampered with to send fake invoices is covered by email security.