Vulnerability management

The risk

Attackers scan the whole internet constantly, looking for systems with known weaknesses: an unpatched VPN, a forgotten test server, remote desktop left open.

Most businesses don't have a complete list of what they have facing the internet, and you can't fix what you don't know about.

What it does

Finds your internet-facing systems, including ones you'd forgotten about
Scans them regularly for known vulnerabilities, and keeps watching between scans
Ranks what to fix first by how likely it is to be exploited, not just a severity score
Warns you promptly when a newly discovered critical vulnerability affects you
Regular reviews with experienced analysts who explain the findings and how to fix them

Who it's for

Any business with systems an attacker can reach from the internet: a website, a firewall, a VPN or remote access. It also helps you keep on top of the 14-day patching requirement in Cyber Essentials.

How we supply it

Managed Risk is a fully managed service delivered by Sophos's analysts and arranged through us, either on its own or as an add-on to MDR. Fixing what it finds is up to you or your IT provider, or we can do it for you at our standard day rate.

What's under the hood

Sophos Managed Risk — powered by Tenable and delivered by Tenable-certified Sophos analysts.

Questions

Is this the same as a penetration test?+

No. Vulnerability management is ongoing, automated scanning for known weaknesses. A penetration test is a one-off, hands-on attempt by a person to break in. They complement each other.

Does it fix the vulnerabilities?+

No. It finds them, ranks them and explains how to fix them.

What does it scan?+

Your internet-facing systems: the ones an attacker can reach from outside.

← Back to Find your weak spots

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that matter most for it — no obligation, and no jargon.

Talk to us → or see every security area →