Vulnerability Assessment Services

• Method: Vulnerability Assessment Automated scanning + manual triage, does not exploit vulnerabilities. Penetration Testing Active exploitation, attempts to breach system using found vulnerabilities.
• Scope: Vulnerability Assessment Broad scan all systems, all CVEs, comprehensive coverage. Penetration Testing Narrow specific system, specific scope, deep manual testing.
• Exploitation: Vulnerability Assessment No exploitation identifies and rates vulnerabilities without triggering them. Penetration Testing Active exploitation proves vulnerabilities are genuinely exploitable.
• Output: Vulnerability Assessment Vulnerability list with CVSS scores breadth of coverage. Penetration Testing Exploitation proof-of-concept depth of confirmed impact.
• Frequency: Vulnerability Assessment Continuous or monthly catch new CVEs as they are disclosed. Penetration Testing Annual or major-change-triggered point-in-time authorised attack.
• Cost: Vulnerability Assessment Lower automated tools + analyst triage. Penetration Testing Higher manual skilled tester time.
• Best for: Vulnerability Assessment Ongoing vuln management programme, CVE tracking. Penetration Testing Compliance (SOC 2, PCI DSS), enterprise sales, new product launch.
• ClickMasters approach: Vulnerability Assessment Automated scanning + risk-based prioritisation + remediation roadmap. Penetration Testing Scope-defined authorised testing + CVSS report + re-test.

Vulnerability prioritisation uses a risk-based framework rather than raw CVSS score. Prioritisation factors: Exploitability in the wild (is this CVE being actively exploited? CISA KEV Known Exploited Vulnerabilities catalogue lists CVEs with confirmed exploitation; these are highest priority regardless of CVSS score), Public exploit availability (is working exploit available in Metasploit or Exploit-DB? reduces attacker skill required), Asset criticality (Critical CVE on development server less urgent than High CVE on production auth service), Reachability (is vulnerable code path actually invoked by the application?), Remediation effort (trivial patch that takes 10 minutes done immediately; breaking major version upgrade requiring 2 weeks planned and scheduled). ClickMasters delivers prioritised remediation plan P1 (fix within 24 hours), P2 (fix within 7 days), P3 (fix within 30 days), P4 (fix within 90 days) based on this framework.