Overview
Cyber Essentials requires high-risk and critical security updates to be applied within 14 days of release. A managed programme gives you the visibility to prove it, prioritising the vulnerabilities attackers are actively exploiting and tracking every fix through to verification.
Thousands of new vulnerabilities are published every year. Without a program, teams drown in scanner output while the issues that matter go unpatched. A managed vulnerability program turns that noise into a prioritised, tracked list of fixes.
We discover your assets, run authenticated scans of infrastructure and applications on a regular schedule, validate findings manually to remove false positives, and prioritise using exploitability, exposure and business context — not CVSS alone.
Periodic penetration tests (VAPT) then go deeper on your highest-risk systems, so you get both breadth and depth in one program.
How our managed services work for UK organisations
- Cover through UK nights, weekends and bank holidays, when in-house teams are offline
- Escalations go to your named UK contacts by phone, email or Microsoft Teams, following agreed severities
- Monthly service reviews scheduled within UK business hours, with evidence packs for ISO 27001, Cyber Essentials and the NHS DSPT
- Data processing agreement covering transfers from the UK, using the IDTA or UK Addendum where personal data is involved
What's included
Our approach
- BaselineAsset inventory and first full scan with validated findings.
- Risk modelAgreed asset criticality, severity thresholds and fix-time SLAs.
- Recurring cyclesWeekly or monthly scanning with validated deltas.
- Manual VAPTPeriodic penetration tests of the highest-risk systems.
- Executive reportingTrends, SLA performance and risk reduction over time.
What you receive
- Validated vulnerability register
- Monthly risk and trend report
- Remediation SLA tracking
- Periodic penetration test reports
- Audit evidence for vulnerability management controls
Standards & frameworks
- ISO/IEC 27001 A.8.8
- PCI DSS 11.3 & 11.4
- CIS Control 7
- NIST CSF 2.0
- FCA operational resilience (SYSC 15A)
- Cyber Essentials
Frequently asked questions
What is VAPT?
Vulnerability Assessment and Penetration Testing combines broad automated scanning with manual exploitation of the most important findings.
How often will you scan?
Typically weekly or monthly depending on your risk and compliance requirements; PCI DSS requires at least quarterly internal and external scans.
Do you fix the vulnerabilities?
We prioritise and guide remediation, and can apply fixes through our patch management service where agreed.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.
Where is our data processed?
Engagement data is handled by our team in India under NDA, with encrypted storage, least-privilege access and secure deletion at the end of the agreed retention period. We can sign a data processing agreement using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses where personal data is involved.