vuln 001What is a Vulnerability Assessment?

An Internal Vulnerability Assessment is a technical security assessment focused on your internal IT infrastructure.  There are typical two components to an internal vulnerability assessment.

  • Internal architecture and IT management practices review
  • Internal network vulnerability scanning

An Internal Vulnerability Assessment almost always includes a vulnerability scan.  Sometimes the architecture and management practices review is not included, typically for budget reasons or if you know you just need an internal vulnerability scan.


Why would I want this?

An internal vulnerability assessment is a very common type of security assessment due to the heavy emphasis on IT in information security.  Internal IT is certainly a significant part of your security program, but keep in mind that it is only one part.  There are multiple reasons to perform this type of assessment:

  • Regulatory compliance requiring an internal vulnerability assessment
  • A valued customer is requiring one
  • You’ve seen high profile breaches on the news and wonder how secure your IT environment really is
  • You’ve done a penetration test, and are wondering what to do next (assuming you’re not pursuing full assessment)

What makes Gratia, Inc. different?

There are many significant value propositions that our clients realize. Examples include:

  • Gratia, Inc.’s Methodology – Gratia, Inc. has developed a proprietary approach to assessing information security risks.  It’s more than a checklist of questions and recorded answers.  Our approach gives you a full picture of your risks – prioritized and rated – with recommended solutions, so you know which security investments will have the greatest impact.
  • Full Transparency – Gratia, Inc. strongly believes in empowering our customers.  The more knowledge transfer that occurs during our engagement, the more value our customers recognize.  Gratia, Inc. fully discloses the methods, tools, and configurations used to perform analysis work for our customers in the hope that they can easily adopt our processes for their future benefit.
  • Product Agnostic – Gratia, Inc. does not represent any third-party products or services; on purpose.  Our projects and recommendations stand on their own, with no ulterior motive to sell you things you don’t really need.

What are the deliverables I should expect?

We consistently get great feedback on our reporting style. Gratia, Inc. has spent years developing reports that communicate assessment results in clear, easy to digest ways, that are appropriate for both technical and non-technical audiences.  Typical deliverables out of an information security assessment include:

  • Executive Summary Report
  • Full Report
  • Action Plan and/or Road Map

What does a Vulnerability Assessment cost?

At Gratia, Inc., every project is custom designed for our clients.  We take into account your organization’s size, complexity, industry, compliance requirements, and most importantly, your actual needs.  Because of our tailored approach, all you need to do is spend a few minutes on the phone with our team to make sure we are delivering exactly what you need and want.