Vulnerability scanning and patch management
Most successful attacks on small businesses use weaknesses that already had a fix available. We find the gaps across your computers, servers and network equipment, apply updates on a predictable schedule and show you what is left and why.
Vulnerability scanning & patch management for small and medium businesses
Patching sounds routine until you look at a typical office. Windows updates are deferred because a reboot interrupted someone once. The PDF reader is three versions behind. The firewall runs firmware from the year it was installed, and the old server has not been restarted since the last power cut. None of this is anyone's fault; it is simply work that has no owner. Attackers rely on exactly that, scanning the internet for devices with published weaknesses and using tools that exploit them automatically.
Vulnerability scanning gives the problem a shape. A scanner checks your computers, servers and network equipment against databases of known flaws and reports what it finds, rated by severity. Some findings are a missing update. Others are settings: an old protocol left switched on, a remote access port open to the internet, a default password on a printer. The output of a raw scan is long and noisy, so the useful part is deciding what actually matters for your business and fixing it in a sensible order.
We run that loop for you. Operating system and common application updates are tested and deployed in rings, so a small group gets them first and any problems are caught before they reach everyone. Servers and firewalls are updated in agreed maintenance windows. Scans run on a schedule, critical findings are dealt with quickly, and anything we choose not to fix straight away, such as software a vendor no longer supports, is recorded with the reason and a plan.
What's included
Device inventory
A current list of every computer, server, firewall, switch and access point we look after, because you cannot patch equipment nobody knows exists.
Workstation patching
Windows and macOS updates rolled out in stages, with reboots scheduled around your working day and stragglers chased until they comply.
Third-party app updates
Browsers, PDF readers, Java, Zoom and other common apps kept current, since these are often a more likely way in than Windows itself.
Server and firmware updates
Windows Server, NAS units, firewalls, switches and Wi-Fi gear updated in planned maintenance windows, with a rollback plan for each change.
Scheduled vulnerability scans
Internal and external scans on a regular cycle that look for missing updates, weak settings and services exposed to the internet.
Prioritised fixes
Findings sorted by real risk to your business, not just the scanner's score, so effort goes to the issues an attacker would actually use.
Exceptions register
Anything that cannot be updated, such as old software tied to a machine, recorded with the reason, the extra protection applied and a date to revisit it.
Plain-English reports
A short summary of patch status and open issues you can hand to a manager, a board or an insurer without translating it.
Who is vulnerability scanning and patch management for?
This service suits offices where:
- Updates are left to each staff member to install when they get around to it
- The firewall, NAS or switches have never had a firmware update
- An insurer or client has asked how quickly you apply security patches
- You still run software that only works on an old version of Windows
- Nobody has checked what your network shows to the internet
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkVulnerability scanning & patch management questions
How often do you scan?
Most offices are scanned monthly, with the internet-facing scan run more often because that is where opportunistic attacks start. After a serious new weakness is announced we also run targeted checks for it straight away.
Will updates interrupt our staff?
We schedule installs and restarts outside core hours where possible and give people a window to finish what they are doing. Updates go to a small test group first, so a faulty patch is caught before it reaches the whole office.
Is patching included in your plans?
Yes. Operating system and common application patching is part of every support plan. Scheduled vulnerability scanning and reporting depend on how many devices and sites you have, so we quote them in writing first.
What if a patch breaks something?
Staged rollout limits the damage, and we can pause or roll back an update while the vendor fixes it. Business-critical software is checked against its vendor's supported versions before a major update goes ahead.
What about old equipment that no longer gets updates?
We tell you which devices are past their vendor's support, explain the risk in plain terms and suggest options, from isolating the device on its own network to a replacement quoted in writing first.
Is a vulnerability scan the same as a penetration test?
No. A scan is an automated check for known weaknesses and should run regularly. A penetration test is a skilled person actively trying to break in, usually done once a year or after big changes. Most small offices start with scanning.
Can you scan our network before we sign up?
Yes. A one-off scan and review is billed at our hourly rate and gives you a written list of findings, ranked, with what we would fix first.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security