Penetration testing
A deeper, point-in-time test once the obvious issues are under control.
Full details →Find weaknesses in your systems, decide which ones matter, and keep closing them. A continuous service for East Midlands organisations, not a one-off scan.
New weaknesses are published every week. A single scan the week before an audit goes out of date almost immediately. Vulnerability management is the habit of discovering those issues, deciding which ones are actually dangerous in your environment, and tracking them until they are fixed.
Cyber Root runs that cycle with you. We scan the external and, where agreed, internal systems, explain which findings are exploitable, and give your team or your IT provider a short list they can clear. It is useful on its own, and it is one of the most practical ways to prepare for Cyber Essentials Plus or a penetration test.
External scanning of internet-facing systems, plus internal scanning of servers, laptops and key applications when that is in scope.
We separate theoretical findings from the ones an attacker could use against you this month, so effort follows risk.
Each important item includes what to patch, change or retire, written so a general IT team can act without a researcher on the call.
If your team is at capacity, we can help coordinate the changes or confirm a compensating control.
A rhythm you can keep, commonly monthly or quarterly, with a trend so you can see whether the backlog is shrinking.
An extra pass after a new site, firewall change or cloud migration, which is when unknowns appear.
Growing businesses in Leicester, Nottingham, Derby and the wider East Midlands that have outgrown “we patch when we remember”. It suits organisations preparing for certification, answering a customer security questionnaire, or recovering from a penetration test that produced more findings than the team can hold in a spreadsheet. Vulnerability management will not prove that an attacker can chain three bugs together. That is what a penetration test is for. The two services work best in sequence: scanning keeps the easy doors shut, and a test checks whether anything clever is still open.
You know which systems are in scope, including the ones marketing set up last year.
Critical and actively exploited issues have an owner and a date.
The same issue does not reappear unread three months in a row.
Leadership can see a one-page trend, not a raw scanner export.
Most East Midlands clients combine more than one of these. Start with the gap that matters most.
A deeper, point-in-time test once the obvious issues are under control.
Full details →Patching and configuration are at the centre of the scheme.
Full details →Detection for the window between a flaw being published and a patch being applied.
Full details →Vulnerability management is continuous discovery and prioritisation. A penetration test tries to exploit issues to show impact. Most organisations need the habit of scanning, and a test when the risk or a customer justifies it.
Monthly external scanning is a solid default. Quarterly can be enough for a very small, stable estate. Scan again after significant change. We will help you pick a cadence you will actually keep.
Yes. The report tells your team what to change. We can also support or coordinate the fixes if you need extra hands, and then rescan to confirm the result.
External scans are low impact. Internal authenticated scans are scheduled, and we agree a window so they do not collide with backups or month-end.
No. It makes the technical controls easier to evidence, especially patching. Certification is a separate assessment, which we can also deliver as an IASME-licensed body.