Skip to content

Not a pentest

Vulnerability assessment for your external IP addresses

An automated scan, checked by a person.

A vulnerability assessment checks up to 32 of your external IP addresses for known vulnerabilities. Recognised tools run an automated scan, then a tester checks the relevant results by hand and removes false positives. You get a short report with priorities and fixes, and a free re-scan of fixed findings, for a fixed €390. It is not a pentest.

€390 fixed price · up to 32 external IP addresses

See my fixed price
See my fixed price

Prefer to talk first? Book a call

Scan · 3 hits 32 IP addresses ? Old SSH version ? VPN: known flaw ? Old web server Manual check each hit by hand False positive Old SSH version Confirmed VPN: known flaw False positive Old web server
The scan flags three hits; the manual check confirms one and removes two false positives.
  • Up to 32 IP addressesexternal, agreed in writing
  • Not a pentestscan plus manual check
  • Short reportwith priorities and fixes
  • Free re-scanof fixed findings

Not a pentest. And we say so upfront.

A vulnerability assessment finds known vulnerabilities: outdated software, missing updates, weak settings. A pentest goes further: a tester attacks by hand, chains weaknesses and checks whether they really get to your data. Both have their place.

Pentest or vulnerability scan? The comparison

Who it’s for

  • Companies that want a quick, affordable view of known weaknesses on their internet-facing systems
  • Teams that want a regular check between two pentests
  • Anyone answering a customer questionnaire that asks about regular vulnerability scans

What is checked

What is checked

  • Up to 32 external IP addresses that you name and confirm in writing
  • The services reachable on them, checked for known vulnerabilities such as outdated software and missing updates
  • Weak settings, for example outdated encryption protocols
  • Services that are reachable from the internet but probably should not be

What it does not cover

  • No manual attack attempts and no chaining of weaknesses
  • No logins, user roles or business logic of web applications
  • No internal network, Active Directory or cloud configuration

How the vulnerability assessment works. Scan first, then a person checks.

Up to 32 external IP addresses, at a fixed price. Not a pentest.

IP addresses in the fixed price
32
euros, fixed price
390

  1. Phase 1

    Addresses & start date

    Your IP addresses agreed in writing. A call, if you like.

    You pick the date

  2. Phase 2

    Automated scan

    Recognised tools check for known vulnerabilities.

    Agreed time window

  3. Phase 3

    Manual check

    Relevant results checked by hand, false positives removed.

    After the scan

  4. Phase 4

    Short report

    Priorities, fixes and a ticket import file.

    After the check

  5. Phase 5

    Free re-scan

    Fixed findings scanned again at no charge.

    After your fixes

How it works

Scope in writing

You name up to 32 external IP addresses, for example your website, mail server, VPN gateway or firewall. We confirm them in writing before anything starts and scan nothing else.

Automated scan, then a manual check

Recognised scanning tools check the services on these addresses for known vulnerabilities. A tester then goes through the relevant results by hand: is the finding real, does it matter for this system, and what is the fix? False positives are removed, so your team only works on what is real.

Short report and free re-scan

The short report lists every confirmed finding with its priority and a clear fix, plus a ticket import file, one finding per ticket. Once you have fixed the findings, we scan them again at no charge.

When you need a pentest instead

A scan finds known vulnerabilities. It does not show whether an attacker can combine them, get past a login or reach your data. If you need that answer, for an audit, a customer or your own peace of mind, an external network pentest starts at €1,900.

One fixed price. Up to 32 IP addresses.

Vulnerability assessment

Not a pentest

A lighter, scan-based check with manual verification. Not a pentest, and we tell you when you need one.

€390 up to 32 IP addresses

  • Scan of up to 32 agreed IP addresses for known vulnerabilities
  • Manual check of relevant results, false positives removed
  • Short report with priorities and fixes
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
  • Free re-scan of fixed findings

For more than 32 addresses, ask us for a quote.

See my fixed price

Services exclusively for businesses.

What a finding looks like

Every confirmed finding is in the report with its priority, evidence and a clear fix. Anything the manual check finds to be a false positive is removed.

See my fixed price

Prefer to talk first? Book a call

Vulnerability assessment report · Admin & Söhne GmbH · MC-2026-031
Risk: Medium CVSS 3.1 · 5.9 Open · re-scan included

VPN gateway runs a version with a known, published vulnerability

vpn.admin-soehne.example · port 443 (VPN gateway)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

The scan reported that the VPN gateway runs a firmware version named in a published security advisory from the vendor. The flaw lets someone on the internet stop the VPN service, without logging in, under certain conditions. The manual check confirmed the version with the client’s admin and that the vendor’s fix is not installed. The scan also reported an outdated SSH version on this host; the manual check showed the patches were in place, so that result was removed as a false positive.

Steps to reproduce

  1. Compare the firmware version the gateway reports with the vendor’s security advisory.
  2. Confirm the installed version and the missing fix with the client’s admin on the device.
  3. Check the gateway settings: the web portal option named in the advisory is switched on.
vpn.admin-soehne.example · port 443/tcp
Scan: firmware version listed in a published vendor advisory
Manual check: version confirmed on the device
Vendor fix: not installed
Web portal option: on

Business impact

Until the fix is installed, an attacker could take the VPN offline, so remote staff and partners cannot work. Known flaws in VPN gateways are scanned for across the internet within days of an advisory, and cyber insurers ask about patch times for exactly these systems.

Remediation

Install the vendor’s fixed firmware version now, in a planned maintenance window. Switch off the web portal option if nobody needs it. Subscribe to the vendor’s security advisories and set a patch deadline for internet-facing systems, for example 7 days for serious flaws. The free re-scan then confirms the update.

CWE-1104 (Use of Unmaintained Third Party Components) · OWASP Top 10 2021: A06 Vulnerable and Outdated Components · BSI IT-Grundschutz OPS.1.1.3 (patch and change management)

Frequently asked questions

Is a vulnerability assessment a pentest?
No. In a pentest, a tester attacks by hand: chains weaknesses, tests logins, roles and business logic. A vulnerability assessment finds known vulnerabilities with automated tools, followed by a manual check of the relevant results. It is faster and cheaper, and it finds less. If your situation calls for a pentest, we tell you.
What does a vulnerability assessment cost?
A fixed €390 for up to 32 external IP addresses. That includes the manual check, the short report, the ticket import file and a free re-scan of fixed findings. For more than 32 addresses, ask us for a quote.
Which tools do you use?
Recognised, established scanning tools, followed by a manual check of the relevant results. Raw tool output is never the report: every finding in it has been checked by a person, and false positives are removed.
Can the scan disrupt our systems?
The scan runs only against the addresses you confirmed in writing, in a time window agreed with you. Scans put some load on the systems they check. If a system is fragile, tell us beforehand and we agree how to handle it, or leave it out.
Does a vulnerability assessment count as evidence for ISO 27001 or NIS2?
It documents that you look for known technical vulnerabilities and fix them, which supports ISO/IEC 27001 Annex A 8.8. For important systems, many auditors and customers also expect a penetration test. We don't certify anyone.
How often should we run one?
A common rhythm is a scan at regular intervals, for example every quarter, and after larger changes, plus a pentest of important systems at least once a year.

When you need more: manual pentests

Vulnerability assessment: your fixed price

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call