Continuous VA Scanning

To protect against evolving digital threats, businesses must have a proactive approach to tackling them and always endeavour to harden their security posture.

Unfortunately, many businesses do not treat cyber security as an ongoing process, point in time solutions are deployed and penetration testing is only completed once a year for audit purposes. This means that you are only getting a point in time snapshot of how secure the environment is, yet zero-day attacks
and the evolution of more sophisticated attack vectors means there is a continuous need to not only scan the environment on a monthly basis but also to re-evaluate the security strategy and adapt to the ever changing threat landscape.

Businesses that do tend to conduct more rigorous techniques to protect their environment with continuous vulnerability scanning usually do this for infrastructure but not web applications. Web Application Firewall’s are deployed and configured to protect against OWASP’s top 10 (SQL injection, Cross Site Scripting etc), a pen-est may be completed on the web application itself, but it tends to be forgotten about because at that point the risk is seen to have been mitigated.

The rise of Bot Mitigation, Credential Stuffing and Form Jacking mean constant attention is needed.

We can scan:

• External Websites; e.g. www.bbc.co.uk
• External Infrastructure, e.g., Web servers/ IP addresses
• Internal Web apps at an additional cost; e.g. UAT/Development environments
• Internal Infrastructure e.g., internal IP addresses, machines (deploying a vm or agents depending on requirement) etc
• Test for all the critical vulnerabilities in the OWASP Top 10 including SQL Injection and XSS (Cross Site Scripting)