Internal Vulnerability Scanning

Evolve Security’s vulnerability scanning follows a well-defined process designed to maximize your ability to manage your vulnerabilities.

1. Set the rules of engagement. Define the systems, networks, and IP addresses for testing, both externally and internally. Identify any “off-limits” systems or environments, testing hours, and any other rules which can affect the vulnerability scanning. Define any compliance requirements and other rules that could affect the test process.
2. Perform vulnerability scans. Use next-generation vulnerability testing tools that are appropriate for the test. Use multiple tools if that provides the best results.
3. Report. Perform all appropriate reporting, including briefings as necessary.
4. Perform mitigation guidance. Provide additional guidance to assist with mitigation, including information about patches or other mitigating controls appropriate for the client environment.

The overall process itself is straight forward, but Evolve Security is invested in ensuring you get the most effective results possible for the engagement. We consider all of your security and compliance needs when defining the testing scenarios, and use the most appropriate tool sets for those specific needs. We also populate the Darwin Attack® portal with test results during testing to ensure you are provided timely information about vulnerabilities and actions you can take to mitigate them.

Not only does this provide you faster access to actionable results, but by using the Darwin Attack® portal you also have access to additional collaboration, clarification, and guidance directly from the Evolve Security team members assigned to your engagement.

Most companies performing vulnerability scans have commoditized their solutions. They focus on using their primary vulnerability scanner to automate their offerings to the extent possible. Most of those vendors either do automated reporting, or have a built-in lead time to provide test results through an internal reporting process. This often means that report writers are doing research on test results, and adding content not identified by testers. It also means the vendor requires lead time to draft, review, finalize, and format the report.

Evolve Security’s approach to internal vulnerability scans ensures making sure the testing meets your security, compliance, and business needs. This includes using multiple next-generation vulnerability scanners, considering your scan results in the context of your needs, and updating the test process as appropriate to focus on your results.

Evolve Security is dedicated to making your entire vulnerability scan process efficient and effective, not just the scan.  During scans, our security professionals enter findings, such as identified vulnerabilities and potentially exploitable applications and systems, directly into our Darwin Attack® portal. We update the portal in a near-real-time basis, not at the end of the test. We also have a team of security professionals who maintain and enter related cybersecurity data into Darwin Attack® in a regular, ongoing manner. This includes details like detailed remediation recommendations. Providing you access to the same portal used by our security professionals helps maximize the efficiency and effectiveness of your entire testing, remediation, and management process. This means you have access to findings while the test is in process, so do not need to wait days or weeks for a final report, and can start corrective actions earlier.