Question 1

What is a vulnerability assessment?

Accepted Answer

A vulnerability assessment is a systematic review of your IT environment to identify, classify, and prioritise security weaknesses — before attackers can exploit them. Unlike a penetration test (which actively exploits vulnerabilities), a vulnerability assessment identifies and ranks them. The output is a prioritised risk register with CVSS (Common Vulnerability Scoring System) scores and recommended remediation actions. Coreitech's vulnerability assessments cover external network, internal network, endpoints, Microsoft 365, web applications, and email security.

Question 2

What is the difference between a vulnerability assessment and penetration testing?

Accepted Answer

A vulnerability assessment identifies and ranks security weaknesses — it's a scan and review process. A penetration test actively attempts to exploit those vulnerabilities to demonstrate real-world impact. Vulnerability assessments are broader in scope; penetration tests are deeper on a specific target. For most UK SMEs, a vulnerability assessment is the right starting point — it provides a comprehensive risk picture at a lower cost than penetration testing. Pen tests are typically used for specific compliance requirements (PCI DSS, Cyber Essentials Plus) or to test a specific system.

Question 3

How much does a vulnerability assessment cost in the UK?

Accepted Answer

Coreitech's vulnerability assessment starts from £1,500+VAT for a small business (up to 50 endpoints, external scan, Microsoft 365 review). Pricing scales with environment size and scope. The assessment includes scanning, manual review, findings report with CVSS scores, and a prioritised remediation roadmap. We provide a fixed-price quote after a brief scoping call — no hourly billing.

Question 4

How long does a vulnerability assessment take?

Accepted Answer

A typical vulnerability assessment takes 3–5 business days from kick-off to delivery of the final report. Larger environments or wider scope (including web applications) may take 5–10 days. Our process: scoping call (1 hour) → scanning & data collection (1-2 days) → analysis & risk rating (1-2 days) → report writing & review (1 day) → findings presentation call.

Question 5

Do you provide remediation after the assessment?

Accepted Answer

Yes. Coreitech provides optional remediation services after every vulnerability assessment. Our engineers can implement the recommended fixes — patching, firewall hardening, Microsoft 365 security configuration, MFA deployment, etc. — or provide detailed technical guidance for your in-house team. We also offer a re-scan after remediation to verify fixes. Most clients then move to our continuous vulnerability management service for ongoing scanning and patch prioritisation.

Question 6

Is a vulnerability assessment the same as a security risk assessment?

Accepted Answer

They overlap but are different in scope. A vulnerability assessment focuses on technical security weaknesses — software vulnerabilities, misconfigurations, open ports, patch gaps. A security risk assessment (or cyber security risk assessment) is broader: it considers technical vulnerabilities plus people, process, physical security, supplier risk, compliance gaps, and business impact. Coreitech provides both. Most clients start with a vulnerability assessment for technical findings and add a risk assessment for board-level risk reporting and compliance purposes.

VULNERABILITY
ASSESSMENT
UK · From £1,500

What our vulnerability assessment covers

External Network Scan

Internal Network Assessment

Endpoint & Workstation Review

Microsoft 365 & Cloud Configuration

Web Application Scanning

Email Security Configuration

Which do you need?