Virtual CISO · Scanning and evidence
What an attacker sees, checked every month and tied to the plan
A scan is easy to buy and easy to ignore. The useful question is not whether somebody ran one, but whether anything in your organization changed because of what it found — which is a question about the plan it feeds, not about the scanner.
The view an attacker starts from, without being told anything
Certificates and TLS configuration, SPF, DKIM, DMARC and DNSSEC, whether your domains appear on phishing blacklists, which ports answer, whether HTTP redirects to HTTPS, whether a web application firewall is in front of what it should be. None of it requires access to anything of yours, which is precisely why it is the first thing somebody hostile looks at.
An extended pass goes further: subdomains nobody remembered registering, services exposed on them, and files reachable on the public web that were meant for an internal audience. The finding that matters most in a first scan is usually not a weak cipher. It is a host somebody stood up for a project in 2021 and nobody has patched since.
The directory everything else depends on
Where an internal scan is in scope, the target is Active Directory, because almost every escalation path in a compromised network runs through it: missing patches, operating systems past end of support, SMBv1 still answering, NTLM where it should not be, a password policy that predates the current guidance, local administrator passwords shared across machines, and delegation rights in group policy that nobody intended to grant.
These are not exotic findings. They are the ones that turn a single clicked link into a domain-wide incident, and they are the ones that never appear in an external scan.
The scanners you already pay for, feeding the same list
Most organizations are not short of scan output. They are short of one place where it is reconciled with a plan, and of anybody whose job is to do the reconciling.
- Microsoft Secure Score and Defender Vulnerability Management, for organizations already running Microsoft 365 and Defender
- Dedicated vulnerability management from Tenable, Qualys and Rapid7
- Endpoint telemetry from CrowdStrike, SentinelOne and Tanium
- Cloud posture from Amazon Web Services
- Penetration-test output, including automated testing platforms such as Horizon3
Findings arrive from whichever of these you run and land in one place beside everything else, so the argument about which tool is right stops being the reason nothing gets fixed.
Scheduled, because posture is not a single reading
Each source runs on its own schedule — weekly, monthly or quarterly — and the point of the schedule is the comparison. One scan tells you what is wrong today. A series tells you whether what you are doing is working, which is the only question a management board is really asking when it asks for a security report.
It also catches the thing a one-off cannot: the exposure introduced last month by a change nobody flagged. A certificate that expires, a port opened for a migration and left open, a subdomain pointed at a service that has since been decommissioned.
A finding becomes a task, or it becomes nothing
Findings are matched against the task list rather than delivered as a separate report, and the portal makes that link itself — a finding arrives already attached to the work it belongs to. What is not automatic is the consequence. Where a finding looks resolved, a status change is proposed with a note saying what evidence supports it, and a named Spirity expert approves or rejects it before anything is written back. A scan on its own closes nothing.
The evidence notes are deliberately written without host names, addresses or anything else that would turn a document people email around into a target map. The detail stays in the portal, where access is controlled; the note says what changed and why.
- A finding you have already fixed is evidenced by the scan; the task closes after expert review and approval
- A finding with no task behind it becomes one, prioritized against everything else rather than queue-jumping because it is new
- A finding you have accepted as a risk stops reappearing as a surprise, because the acceptance is recorded where the finding is
Your exposure next to your industry’s
The risk snapshot scores your external exposure and places it twice: once against the whole field, and once against the sector you tell us you are in — a wide bucket rather than a named peer group. It is a blunt instrument and it is not a target to be managed — what it is good for is the conversation where somebody senior asks whether this is normal, and the honest answer is a comparison rather than an adjective.
Where you are better than the field, that is worth knowing before you spend. Where you are worse, the gap is the argument for the budget, and it is a stronger argument than any number we could assert on our own.
Scanning is not monitoring, and we would rather be clear than broad
Everything on this page is periodic. It tells you what was true when it ran. It does not watch, it does not alert at three in the morning, and it will not notice an intrusion in progress — and an organization that believes otherwise has bought the wrong thing and will find out at the worst possible moment.
The work that does cover that is next door and available as separate services: round-the-clock detection and response, a vulnerability alert feed for the products you actually run, and digital risk protection for the exposure that appears outside your own estate. If what you need is the watching rather than the assessment, start there instead of here.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
No, and the difference matters when you are buying. A scan checks known conditions automatically and repeatedly: an expired certificate, a missing patch, a port that should not answer. A penetration test is a person trying to chain those conditions into an actual compromise, using judgement a scanner does not have. Scanning is what you run every month; a penetration test is what you commission when you need to know whether the findings add up to something. If you have test results already, they are one of the sources we read.
For the external work, nothing at all — that is the point of it, since an attacker starts with no access either. The internal checks do need access, and only where you decide an internal scan is in scope: a read-only account against the directory, agreed in writing, scheduled, and limited to what the checks actually read. If that is a step too far at the start, the external work stands on its own and the internal part can wait.
You probably would not, and we would rather say so. Most organizations with this question are not short of findings — they are short of anybody reconciling the findings with a plan, and that is the part we do. Your existing tool stays where it is and becomes a source: its output arrives in the same list as everything else, gets prioritized against everything else, and stops being a report that arrives monthly and is read by nobody.
Where this sits, and what comes next
Business continuity
Which processes you cannot lose, for how long, and what that costs per month.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.