Prioritised
CVSS, exploit availability, threat intelligence and asset context decide what is fixed first.
Assessment / Assess & prioritise
Vulnerability Assessment & Risk Management
A fixed-scope baseline that finds and prioritises exposure across your environment and leaves you with a remediation plan, with ongoing vulnerability management as an optional next step.
Assessment · We say which parts are ours and which stay with your team.
Baseline first · ongoing management optional
Start
Fixed-scope baseline, two to four weeks, no ongoing commitmentThen
Optional monthly service, run by Ip.Glass on the platform that fits youFrameworks
ISO 27001 · Essential Eight · PCI DSS · CISScope
Infrastructure, endpoints, cloud, applications, OT where safe01 / When would I need this?
Typical triggers.
- aAn audit, insurer or board has asked for evidence that vulnerabilities are identified and managed.
- bPatching is happening, and you want to be sure the critical exposures are the ones being closed.
- cYou want a clear picture of exposure before committing to an ongoing service.
- dOperational technology, legacy platforms or vendor-managed systems cannot simply be patched and need risk decisions on the record.
Need a one-off penetration test of a specific application? That is a different engagement. Ask us and we will say so.
02 / What Ip.Glass does
Unpatched vulnerabilities are among the most exploited attack vectors in modern cyber attacks, and a once-a-year scan does not keep up with them. Start with a fixed-scope baseline: we find the exposure, decide what matters and hand you a remediation plan your team can carry out, with no ongoing commitment. If you want the cycle to keep running, ongoing management picks up from there: scheduled scanning, every finding chased to a verified close, and a register you can show an auditor at any time.
Step 1
Identify
Authenticated and unauthenticated scanning across infrastructure, endpoints, cloud and applications in agreed windows, plus passive discovery where active scanning is unsafe. Findings are validated so they are real.
Step 2
Prioritise
Each finding is weighed by CVSS, exploit availability, threat intelligence and what the asset does for your business. You get an ordered list, not a count.
Step 3
Plan
Fixes are assigned to the right owner, whether your team, a vendor or our patching service, with effort, sequencing and risk acceptances recorded.
Step 4
Continue, if you choose
Ongoing management repeats the cycle monthly, re-tests closed items and keeps the register live for audit.
Actionable
A remediation plan with owners, effort and sequencing, not a list of findings.
Verified closed
If you continue, every finding is tracked to a verified fix, an accepted risk or an exception on the record.
03 / What you receive
Concrete deliverables, agreed before we start.
The baseline, weeks one to four
- 01Asset inventory reconciled against what you thought you had
- 02Validated findings register with risk-based priority
- 03Remediation plan with owners, effort and sequencing
- 04Executive summary mapped to ISO 27001, the Essential Eight, PCI DSS or CIS Controls
- 05Walkthrough with technical and management stakeholders
04 / How it starts and runs
From a first call to a plan your team can run.
- 01Scoping call.What is in scope, what must never be scanned actively (production OT, vendor-managed systems), windows, access and who owns what. Usually one hour.
- 02Proposal.Fixed scope and price for the baseline, a named lead engineer, schedule and acceptance criteria. The ongoing service is priced separately, so you can decide after the baseline.
- 03Baseline, two to four weeks.Scanning in agreed windows, validation, prioritisation. You see interim findings; nothing waits for the final report.
- 04Walkthrough and plan.Findings and the remediation plan presented to technical and management audiences, owners agreed. The baseline is complete here.
- 05Ongoing management, optional.Monthly cadence from here, with the register live to you and a quarterly review. Scale scope up or down as the environment changes.
05 / What stays with you
Clear responsibilities on both sides.
Your organisation
- —Access, credentials and scan windows
- —Risk-acceptance decisions and sign-off
- —Implementing fixes, unless our patching service is contracted
- —Telling us when the environment changes
06 / Evidence
Credentials you can check.
Reference calls with current clients on request.
Our own house
ISO/IEC 27001:2022 certified.
We run this service on ourselves.
Platform
Vendor-neutral, typically Tenable.
We operate the platform that fits your environment; most ongoing engagements run on Tenable, where our engineers are certified.
Related work
Findings to roadmap.
Local government and manufacturing programmes where the first baseline became a funded remediation roadmap. Selected work ↗
07 / Next step
Start with a
scoping call.
Tell us roughly what is in your environment and what prompted the question. We will say whether this is the right first step, and what it would cost.
Related: Patching & remediation · Managed Services · Security architecture & advisory
More solutions
All solutions- →Enterprise Networking
- →OT and IoT Security
- →Identity, Access & Zero Trust Controls
- →Cloud Security & Architecture
- →Security Architecture & Strategic Advisory
- →Secure Collaboration & Email Protection
- →SIEM & SOAR Integration and Optimisation
- →Enterprise-Wide Patching & Remediation Services
- →Network Operations Centre (NOC) Services