External scan
Public IP addresses and host names as seen from the internet.
Internal scan
Servers, network devices and appliances in the internal network via a scanner in your environment.
Authenticated scan
With a restricted test account, installed packages and local configuration are checked too.
Vulnerability scanning as a service with report and prioritisation
We scan the agreed systems from outside and from the internal network for known vulnerabilities, one-off or recurring. You receive a report with prioritised actions.
- OpenVAS / Greenbone
- Internal and external
- Prioritised report
- Not a pentest
Starting point
Nobody knows exactly what is reachable on the network
A vulnerability scan answers two questions: which systems and services are reachable, and which of them have known vulnerabilities?
Forgotten systems
Test servers, old appliances and unmaintained devices appear on no inventory list but are reachable.
Open services on the internet
Admin interfaces, databases or remote access are publicly reachable more often than expected.
Hundreds of findings with no order
A scanner produces long lists. Without assessment it is unclear what needs fixing first.
Evidence required
Customers, insurers or auditors ask for regular vulnerability checks.
Services
What the vulnerability scan covers
We operate the scanner and evaluate the scans, only for systems authorised in writing. Not included: penetration tests and social engineering, remediation of findings (your team or server management).
Review findings
Filter out obvious false positives and consolidate findings.
Prioritisation
Severity (CVSS), internet exposure and importance of the system determine the order.
Report
Summary, findings by priority, affected systems and recommended actions.
Trend for recurring scans
New, open and fixed findings compared with the previous scan.
Process
From authorisation to report
Four steps per scan. For recurring scans, steps 3 and 4 repeat at the agreed frequency.
- 01
Define scope
IP addresses, host names, internal or external, authenticated or not, time window.
- 02
Written authorisation
An authorised person confirms scope and time window. No scan without authorisation.
- 03
Run scan
Scan in the agreed window with adjusted load to keep the impact on production services as low as possible.
- 04
Report and review
Report with prioritised actions; joint review on request.
Comparison
Vulnerability scan, CVE monitoring or penetration test
Three methods answering different questions. WZ-IT offers scanning and CVE monitoring, not penetration tests.
| Criterion | Vulnerability scan | CVE-Monitoring | Penetration test |
|---|---|---|---|
| Question | What is reachable and vulnerable? | Does a new CVE affect our software? | Can an attacker get in? |
| Method | automated active check | inventory matched against CVE sources | manual exploitation |
| Frequency | one-off or recurring | continuous | per engagement |
| At WZ-IT | this page | separate service | not offered |
Pricing
One-off or recurring scan
The number of systems, internal or external, authenticated or not, and the frequency determine the effort. We state the price in the proposal once the scope is defined.
Vulnerability scanningPrice in the proposal
Frequently Asked Questions
Answers to the most important questions
- A vulnerability scan automatically checks systems for known security vulnerabilities, outdated software and insecure configurations. The scanner compares reachable services and installed versions with a database of known vulnerabilities. The result is a list of findings with severity.
- No. A scan searches automatically for known vulnerabilities. A penetration test tries to exploit vulnerabilities manually and to chain attack paths. This page covers scans only; penetration tests and attack simulations are not part of the service.
- The basis is the OpenVAS scanner from Greenbone. We operate the scanner ourselves. Which feed of test routines is used is set out per deployment scenario in the proposal; the feed licence depends on it. Coverage differs: checks for many enterprise products and network devices, such as Cisco, are only in the commercial Greenbone Enterprise Feed, not in the freely available Community Feed. Vulnerabilities without a test routine are not detected by any scan.
- CVE monitoring continuously matches your servers' software inventory against new CVE notices. The vulnerability scan actively checks systems from outside or from the internal network, including devices without an inventory such as printers, appliances or forgotten servers. The two complement each other.
- Written authorisation from an authorised person, the list of agreed IP addresses or host names, and a time window. We only scan systems that you own or are permitted to have scanned. For internal scans you provide a VM or access to the internal network; for authenticated scans also a restricted test account.
- A single scan shows the state at one point in time. Regular scans, for example monthly or quarterly, show new findings and whether old ones have been fixed. The frequency is agreed in the proposal.
- The price depends on the number of systems, internal or external, authenticated or not, and the frequency, and is set out in the proposal. For a one-off review of individual Linux servers there is the server audit (from €290 excl. VAT one-time).
Knowledge
Further reading
Tools, vulnerability management and related services.
Guides
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Request a vulnerability scan
For an initial assessment, the approximate number of systems, whether to scan internally or externally, and the desired frequency are sufficient. We only need access credentials after commissioning.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.