Vulnerability assessment with prioritised follow-up
Find out which weaknesses need to be addressed first. Regular scanning and rechecking help you prioritise and follow up the work.
A view of exposure within the agreed scope
Complior offers regular scanning to identify vulnerabilities and misconfigurations. The analysis can cover external services and internal infrastructure within an agreed scope.
Define which addresses, systems and interfaces may be tested, how scanning will be carried out and who is responsible for the environment. Scanning is not the same as a penetration test and does not replace all other security assessments.
Prioritise by risk and business needs
The results show identified weaknesses and their severity. Complior describes risk-based prioritisation and recommendations to support remediation. Also assess the system's importance, exposure and existing safeguards.
Decide who will address a vulnerability and when it must be resolved. Operational responsibility and authority need to be clear; a report does not, in itself, mean that all identified issues have already been resolved.
Check after remediation
A new scan can check whether the identified vulnerability is still present. Document the results and any outstanding findings. Regular follow-up is needed because software, configuration and the threat landscape change.
When scanning is part of PCI DSS
PCI DSS sets specific requirements for vulnerability scanning in relevant environments. For external ASV scans, the provider, scope and reporting need to meet the requirements. Clarify which scans and supporting documentation are included in your service.
A passing scan report alone does not show that all PCI DSS requirements are met. It must be used alongside other controls and the assessment applicable to your business.
Sources and further reading
Sources reviewed .