Vulnerability Management

OpenVAS (open source, no licensing cost) for most clients. Nessus or Qualys if you have existing licenses. Cloud-native scanners (AWS Inspector, GCP Security Command Center) for cloud-only environments.

Vulnerability scans are non-intrusive by default. We schedule internal scans during maintenance windows. External scans are throttled to avoid triggering WAF or rate limits. Production impact is negligible.

Industry standard: Critical (CVSS 9.0+) within 24 hours, High (7.0-8.9) within 7 days, Medium (4.0-6.9) within 30 days, Low (0.1-3.9) within 90 days. We customize based on your risk appetite.

Yes. PCI DSS Requirement 11.3 requires quarterly external ASV scans and internal scans. Our program exceeds this with weekly external and monthly internal scanning.

Vulnerability scanning is automated, broad, and frequent. Penetration testing is manual, deep, and targeted. Scanning finds known vulnerabilities; pen testing finds complex attack paths. You need both.