Continuous scanning, not an annual test · Prioritised by exploitability — CVSS + EPSS + CISA KEV Request baseline →
EL Request baseline

VA · Continuous scanning · CVSS + EPSS + KEV

Vulnerability assessment with prioritisation by exploitability.

It makes no sense to give you 4,000 findings. It makes sense to show you the 12 that are actually exploitable, which are being paid for to be exploited, and which can wait with a clear conscience. The difference is in the triage — and that's where your team's time is won.

A vulnerability assessment continuously scans your network, cloud and code and ranks findings by real exploitability (CVSS, EPSS and the CISA KEV catalogue), so your team fixes the few that matter first. KodeX GRC runs it weekly or monthly, with a dashboard, a PDF report and a 24-hour response for critical findings.

Updated · Vasilis Stamos, ISO & NIS2 Lead Auditor

Request baseline scan See how we filter
Frequency
Weekly / monthly
Standards
CVSS · EPSS · KEV
Coverage
Network · Cloud · Code
Deliverable
Dashboard + PDF
01

What it covers

Six scanning categories. We don't scan everything with the same profile — each category has its own intensity, its own tools, and its own prioritisation.

External surface

External surface

Everything visible from the internet — with continuous discovery of new assets, subdomain takeover checks, exposed services.

Internal network

Internal network

Servers, endpoints, network devices, OT where present — with scanning profiles per asset category.

CIS Benchmarks

Cloud configuration

AWS, Azure, GCP, M365 — misconfigurations that don't show up in a CVE scan, with every CIS control reviewed.

Containers · K8s

Containers & Kubernetes

Images, registries, configurations, runtime — from base image all the way to runtime policy.

SCA · SBOM

Software dependencies

Software Composition Analysis on code — libraries, licenses, transitive dependencies, SBOM.

DAST · OWASP

Web applications

OWASP Top 10 scanning, with human confirmation — not just scanner output.

02

Who it's for

VA is worth it when there's a large footprint and a small team — where vulnerability management only becomes feasible if it's made actionable.

We work with IT teams that already have tooling — or that tried it and abandoned it because they couldn't manage the volume. The rule: the problem isn't detection. It's triage and follow-through.

VA operates as an ongoing service — not a one-off project. It scans, prioritises, notifies owners, tracks SLAs, and retests critical items. Your team remediates — it doesn't hunt.

IT teams with lots of CVEs and no idea where to start
Anyone with ISO 27001 who needs A.8.8 as continuous evidence
Software teams with SCA and dependency management requirements
Cloud-first organisations where configuration matters more than CVE
Between pentests — filling the 12-month gap with a continuous view
03

How we work

Three phases. VA isn't a project — it's a service. It starts with a baseline and then runs continuously, with monthly reports and quarterly reviews.

i / iii

Baseline

What you have, what's visible

Asset discovery, first scan, profile configuration per category, SLA definition based on criticality. The client sees the full picture.

1 week
ii / iii

Continuous cycle

And prioritisation

Weekly or monthly scans, EPSS/KEV enrichment, prioritisation by exploitability, owner notification, retest on critical.

Ongoing
iii / iii

Reporting & review

And SLA tracking

Monthly summary for management, live dashboard, SLA status per finding, quarterly profile review and adjustment to change.

Monthly
04

How we filter 4,000 findings down to the 12 that matter

Same scan, two views. On the left, the raw scanner output. On the right, the same list after triage — with EPSS scores, CISA KEV flags, and real context.

RAW SCAN OUTPUT 4,128 findings
CVE-2024-… OpenSSL medium — informational Medium
CVE-2023-… Apache HTTP — banner disclosure Low
CVE-2024-… TLS 1.0 supported — deprecated Medium
CVE-2022-… ICMP timestamp response Low
CVE-2024-… SMB signing not required Medium
CVE-2023-… SSH weak MAC algorithms Low
CVE-2025-… Nginx version disclosure Medium
CVE-2024-… DNS zone transfer allowed Low
CVE-2024-… Weak cipher suites enabled Medium
CVE-2023-… HTTP TRACE method enabled Low
CVE-2024-… Missing security headers Medium
CVE-2023-… SNMP public community string Low
+4,116 more findings, sorted by CVSS.
No context, no owners, no priority.
TRIAGED · ACTIVE 12 findings
CVE-2025-… Fortinet SSL-VPN — RCE, exploitable KEV · 9.8
CVE-2025-… Confluence — auth bypass, active exploitation KEV · 9.1
CVE-2024-… MOVEit Transfer — SQLi, broad campaign EPSS 84%
CVE-2024-… Chrome V8 — sandbox escape, active exploitation KEV · 8.8
CVE-2025-… Ivanti Connect Secure — auth bypass KEV · 9.8
CVE-2024-… Citrix NetScaler — session hijack EPSS 71%
CVE-2024-… GitLab CE — account takeover on self-hosted EPSS 62%
CVE-2024-… Windows CLFS — privilege escalation KEV · 7.8
CVE-2025-… Palo Alto PAN-OS — auth bypass KEV · 8.7
CVE-2024-… PostgreSQL — privilege via extension EPSS 34%
CVE-2024-… Kubernetes kubelet — container escape EPSS 28%
Cloud config S3 bucket without logging — auditability gap CIS
+4,116 findings classified as deferred.
Remediated in regular patch cycles, not emergencies.
05

Response times (SLA)

Each finding has a specific SLA agreed at the start. It isn't a target — it's a contract that's tracked and reported monthly.

Priority Criterion SLA
P0 · Critical Active in-the-wild exploitation (CISA KEV) or CVSS ≥ 9.0 on an exposed asset. 24 hours
P1 · High EPSS ≥ 50% or CVSS 7.0–8.9 or presence in a broader campaign. 7 days
P2 · Medium CVSS 4.0–6.9 with real context, or a setting outside the CIS baseline. 30 days
P3 · Low Informational, best practice, or CVSS < 4.0 without an exploitable scenario. Next cycle
06

What you get

Six deliverables covering the service, not just the report. None of them are documents you'll have to write yourself afterwards.

Exposed asset inventoryExternal and internal, continuously updated as new assets appear.
Prioritised finding listBy exploitability — EPSS, KEV, context — not CVSS alone.
Tracking dashboardLive view — who's fixing what, what's still open, SLA status per finding.
Monthly management summaryPDF — critical items, what closed, what's pending, month-over-month trends.
Remediation verificationRetest on critical and high, documented — not "trust us".
ISO A.8.8 evidenceThe artefact the auditor asks for when technical vulnerability management is in operation.
07

Operating timeline

VA has no "end". It starts with a baseline and runs continuously, with steady cadence of reports and review.

WK 01
Baseline
Asset discovery, first scan, profile configuration, SLA definition.
WK 02+
Continuous cycle
Weekly or monthly scans, enrichment, owner notification, retest.
Monthly
Management report
Summary, SLA status, trends, backlog, closed findings.
Quarterly
Review
Profile review, adjustment for new assets, SLA revision if needed.
08

Frequently asked

The questions we hear before taking on a vulnerability assessment service.

What's the difference between VA and pentest?

VA scans broadly and continuously — it finds what's there. Pentest exploits in depth on a specific target — it proves what's actually exploitable. VA is a service; pentest is a snapshot. You need both. See the Penetration Testing page for how they combine.

How many findings will we get from a VA scan?

Many — that's the point. A typical 500-host environment produces 3,000–6,000 raw findings. The value isn't in the list, it's in the triage — how many are truly exploitable, how many have EPSS ≥ 50%, how many are in CISA KEV. We usually end up with 10–30 active. The rest go into a regular cycle.

Will scanning affect our network?

Not if configured correctly. We tune scanning profiles based on system criticality — full scans during off-hours where needed, lighter profiles in production. An immediate stop procedure is always in place if anything is affected.

Do we need our own VA tooling?

You don't need your own tooling. We use our own licensed tools covering your scope. If you already have one (Tenable, Qualys, Rapid7), we can leverage it and add the triage and SLA tracking that's usually missing.

How much does a vulnerability assessment service cost?

Based on the number of IPs and systems in scope. Typically less than the annual cost of a pentest, because the scanning is automated — what costs money is the triage and SLA tracking, and we do those at scale. After the baseline you get a fixed monthly price.

09

Related services

VA is complementary — it rarely stands alone. It usually combines with the following, because they share findings and evidence.

05 · Pentest

In depth

VA finds where to look. Pentest proves what's exploitable — with attempts, not theory.

 07 · Cloud

CIS Benchmarks

Cloud misconfigurations don't show up in a CVE scan. We check every CIS control across AWS, Azure, GCP, M365.

 01 · ISO 27001

A.8.8 continuously

VA is the evidence an auditor wants to see in operation — not in an annual report.

Written and reviewed by

Vasilis Stamos

ISO & NIS2 Lead Auditor · KodeX GRC · M.Sc. Cybersecurity

He writes and reviews every service page himself, against current law and standards. If something has changed and we have not caught it yet, tell us.

Last updated · LinkedIn

Get started

Tell us your footprint.

In one short call — 10 minutes — we define the scope, scanning profiles, SLAs and timeline together. You get a baseline scan within one week, with a full picture and a fixed monthly price. No commitment.

Book a scoping call See a sample report
No commitment Confidential Read-only access