Vulnerability Scanning for Small Businesses

What a vulnerability scan is

A vulnerability scan is an automated check of your systems for known weaknesses: missing security updates, out-of-date software with published vulnerabilities, services exposed to the internet that should not be, weak encryption settings and default configurations. It does not try to break in. That is the job of a penetration test, which is deeper and more expensive.

For most small businesses, regular scanning catches the problems attackers actually use: an unpatched VPN appliance, a remote desktop port open to the world, a WordPress plugin with a known flaw, a forgotten server still running.

External and internal scans

External

We scan your public IP addresses and websites from the internet, the way an attacker would see them, using established tools such as Nmap and Greenbone OpenVAS. Typical findings:

• Remote Desktop (port 3389), SMB or old admin panels open to the internet.
• Router or firewall management pages reachable from outside. See firewall support.
• VPN appliances running firmware with known vulnerabilities.
• Expired or weak TLS configurations on websites and mail servers.

Internal and authenticated

Inside your network, or through device management, we check each PC, Mac and server for missing operating system and application updates and unsupported software. If you have Microsoft 365 Business Premium, Microsoft Defender for Business includes vulnerability management that reports missing patches and vulnerable software across enrolled devices continuously, and we use that as a primary source.

Websites

For websites, we check the CMS core, plugins and themes against published vulnerability databases, look for exposed admin pages, directory listing, outdated PHP versions and missing security headers. On WordPress, outdated plugins are by far the most common finding. Our support plans include ongoing security monitoring and updates, so a website on a plan is checked continuously rather than once.

Making sense of the results

Raw scan reports can run to dozens of pages with hundreds of findings, which is why many end up ignored. We turn them into a short fix list:

• Fix now: critical or high severity issues on internet-facing systems, especially ones with known exploits.
• Fix this month: missing patches on internal devices, outdated software.
• Note and accept: low-risk informational findings, with a reason recorded.

Severity scores (CVSS) are a guide, not the whole picture. A medium issue on your public VPN can matter more than a high one on an isolated printer. We then do the fixes, rescan, and keep the before-and-after reports as evidence for clients, insurers or Cyber Essentials Plus.

Common findings in small businesses

• Remote Desktop exposed directly to the internet, usually set up years ago for home working.
• A network storage device (NAS) with its admin page or file sharing reachable from outside.
• Router firmware several years out of date.
• Windows and app updates stuck on one or two machines that were switched off during patch cycles.
• WordPress plugins with known vulnerabilities, often on sites nobody actively manages. See plugin update support.
• Old servers still running unsupported versions of Windows Server.

Most of these are quick to fix once found, often by closing a port, applying an update or retiring a device that nobody uses any more. The real risk is not knowing they are there.

Permission and cost

We only scan systems you own or have written authority to test, and we check whether your hosting or cloud provider needs notice. Unauthorised scanning of other people's systems can breach the Computer Misuse Act 1990.

A one-off external scan with a written summary and fix list is ad-hoc work at £45 an hour + VAT. Internal scans and fixes depend on the number of devices, and we estimate the time first. For ongoing monitoring, the Complete plan at £99 a month + VAT includes 3 hours a month that can cover monthly scans and patching.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related