# Vulnerability Scanning for Small Businesses

Source: https://dijitulsupport.co.uk/vulnerability-scanning/
Updated: 2026-10-18

> dijitul support runs vulnerability scans for UK small businesses: external scans of your public IP addresses and website, and authenticated internal scans of your PCs, Macs and servers. We explain the results in plain English, rank them by real risk and fix them. Scans and fixes are £45 an hour + VAT, with ongoing checks available on a monthly plan.

## Common symptoms

- A client questionnaire asks for evidence of vulnerability scanning
- You do not know which ports are open on your office router
- Your WordPress site runs plugins nobody has updated in a year
- You are preparing for Cyber Essentials Plus
- An old NAS or server is reachable from the internet

## Key facts

- External scans of public IPs, firewalls, VPNs and websites; internal authenticated scans of devices and servers
- Results ranked by severity (CVSS) and by how exposed the system is, not just by score
- Microsoft Defender Vulnerability Management in Business Premium gives continuous device findings
- Website checks include CMS, plugin and theme versions against known vulnerabilities
- Useful preparation for Cyber Essentials Plus, which includes internal and external scans
- We only scan systems you own or are authorised to test
- £45 an hour + VAT; website security monitoring is part of every support plan from £25 a month + VAT

## What a vulnerability scan is

A vulnerability scan is an automated check of your systems for known weaknesses: missing security updates, out-of-date software with published vulnerabilities, services exposed to the internet that should not be, weak encryption settings and default configurations. It does not try to break in. That is the job of a [penetration test](https://dijitulsupport.co.uk/penetration-testing/), which is deeper and more expensive.

For most small businesses, regular scanning catches the problems attackers actually use: an unpatched VPN appliance, a remote desktop port open to the world, a WordPress plugin with a known flaw, a forgotten server still running.

## External and internal scans

### External

We scan your public IP addresses and websites from the internet, the way an attacker would see them, using established tools such as Nmap and Greenbone OpenVAS. Typical findings:

- Remote Desktop (port 3389), SMB or old admin panels open to the internet.
- Router or firewall management pages reachable from outside. See [firewall support](https://dijitulsupport.co.uk/firewall-support/).
- VPN appliances running firmware with known vulnerabilities.
- Expired or weak TLS configurations on websites and mail servers.

### Internal and authenticated

Inside your network, or through device management, we check each PC, Mac and server for missing operating system and application updates and unsupported software. If you have Microsoft 365 Business Premium, Microsoft Defender for Business includes vulnerability management that reports missing patches and vulnerable software across enrolled devices continuously, and we use that as a primary source.

## Websites

For websites, we check the CMS core, plugins and themes against published vulnerability databases, look for exposed admin pages, directory listing, outdated PHP versions and missing security headers. On WordPress, outdated plugins are by far the most common finding. Our support plans include ongoing [security monitoring](https://dijitulsupport.co.uk/website-security/) and updates, so a website on a plan is checked continuously rather than once.

## Making sense of the results

Raw scan reports can run to dozens of pages with hundreds of findings, which is why many end up ignored. We turn them into a short fix list:

- **Fix now:** critical or high severity issues on internet-facing systems, especially ones with known exploits.
- **Fix this month:** missing patches on internal devices, outdated software.
- **Note and accept:** low-risk informational findings, with a reason recorded.

Severity scores (CVSS) are a guide, not the whole picture. A medium issue on your public VPN can matter more than a high one on an isolated printer. We then do the fixes, rescan, and keep the before-and-after reports as evidence for clients, insurers or [Cyber Essentials Plus](https://dijitulsupport.co.uk/cyber-essentials-plus/).

## Common findings in small businesses

- Remote Desktop exposed directly to the internet, usually set up years ago for home working.
- A network storage device (NAS) with its admin page or file sharing reachable from outside.
- Router firmware several years out of date.
- Windows and app updates stuck on one or two machines that were switched off during patch cycles.
- WordPress plugins with known vulnerabilities, often on sites nobody actively manages. See [plugin update support](https://dijitulsupport.co.uk/plugin-update-support/).
- Old servers still running unsupported versions of Windows Server.

Most of these are quick to fix once found, often by closing a port, applying an update or retiring a device that nobody uses any more. The real risk is not knowing they are there.

## Permission and cost

We only scan systems you own or have written authority to test, and we check whether your hosting or cloud provider needs notice. Unauthorised scanning of other people's systems can breach the Computer Misuse Act 1990.

A one-off external scan with a written summary and fix list is ad-hoc work at £45 an hour + VAT. Internal scans and fixes depend on the number of devices, and we estimate the time first. For ongoing monitoring, the [Complete plan](https://dijitulsupport.co.uk/pricing/) at £99 a month + VAT includes 3 hours a month that can cover monthly scans and patching.

## FAQs

### What does a vulnerability scan check?

A vulnerability scan checks systems for known weaknesses: missing updates, software with published vulnerabilities, exposed services such as Remote Desktop, weak encryption and default settings. dijitul runs external scans of your public IPs and websites and authenticated internal scans of devices and servers.

### How much does a vulnerability scan cost?

dijitul charges £45 an hour + VAT. A one-off external scan of a small business with a written summary usually takes a few hours. Internal device scans depend on how many devices you have, and dijitul estimates the time before starting. Ongoing scanning can be covered by the Complete plan.

### Is vulnerability scanning the same as penetration testing?

No. Scanning is automated and lists known weaknesses. Penetration testing is a skilled person actively trying to exploit them. dijitul runs vulnerability scans itself and arranges accredited testers when a full penetration test is required.

### How often should we scan?

Monthly is a sensible baseline for small businesses, and after any change to your firewall, website or remote access. With Microsoft Defender for Business, device vulnerabilities are reported continuously. dijitul can schedule regular external scans and review the results with you.

### Will a scan slow down or break our systems?

Scans are designed to be safe, but older devices such as printers or ageing network storage can occasionally misbehave when probed. dijitul agrees a scan window with you, excludes fragile devices where needed and stays available during the scan.

## Pricing and contact

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Plans: Essential £25/month + VAT (Website software updates (core, plugins, themes) applied and checked, Daily backups, Uptime monitoring, Security monitoring); Business £50/month + VAT (Everything in Essential, 1 hour of fixes or changes every month, Priority support); Complete £99/month + VAT (Everything in Business, 3 hours of fixes or changes every month, IT and Microsoft 365 helpdesk for your team). Ad-hoc support is £45 an hour + VAT. The first 30 minutes are the minimum charge, then we bill in 15-minute blocks. Contact: 01623 650333, support@dijitul.uk, https://dijitulsupport.co.uk/contact/