What Vulnerability Management Is
Written by MSP Outpost.
In Short
Vulnerability management scans a client's devices, networks and internet facing systems for known weaknesses, such as missing patches, weak configurations and exposed services, and ranks them by how much they matter. It is not patch management, which applies the fixes, and it is not a penetration test, where a person tries to break in. It tells you what is exposed and in what order to fix it.
What It Does
- Internal scanning. Devices and networks inside the client's environment checked by an agent or a scanner on site.
- External scanning. Public addresses, websites and services checked from the outside, the way an attacker would see them.
- Prioritisation. Findings ranked by severity and by whether they are actively exploited, so you fix the right thing first.
- Remediation tracking. Findings followed until they are fixed, often raised as tickets in the PSA.
- Client reports. Summaries for the client and technical detail for the team, useful for reviews and audits.
When You Need One
Many MSPs start with the scanning built into their RMM or patching tool and an occasional external scan. A dedicated platform is optional unless a client asks for regular reports.
Worth adopting as clients start asking security and insurance questions you need evidence to answer. Regular internal and external scans, with findings as tickets, turn it into a service you can sell.
Continuous scanning across every client, with reports that stand up in a client's audit, becomes an expected part of the service. Look for a console that handles hundreds of sites and ranks findings well enough that the team is not buried.
What to Look For
Must Have
- Internal and External Scanning
- Multi-Tenant Console
- Risk-Based Prioritisation
- PSA Ticketing
- Scheduled Scans
- Client-Ready Reports
Worth Having
- Agent-Based Scanning
- Compliance Report Templates
- Patch Tool Integration
- Web Application Scanning
- An Open API
How It Is Priced
Most products charge by the asset scanned, either as usage based pricing or a per asset or per site subscription, and the larger platforms quote only, often on annual contracts. Watch for how an asset is counted, whether external and web scanning are priced separately, and whether reports and integrations sit in a higher tier.
Switching
Switching the scanner itself is fairly easy, but the finding history and any exceptions you have accepted rarely move with it, and clients may rely on reports in the old format. Before you sign, settle what you can export, how long scan history is kept, and how agents are removed.
Questions to Ask a Vendor
- How do you count an asset, and what happens when a device appears under two addresses?
- Are internal, external and web application scanning priced separately?
- How do you rank findings beyond a severity score?
- Can I mark a finding as an accepted risk, and does that carry to the next scan?
- What goes into the PSA ticket, and can I stop it raising one per finding?
- Can I export scan history and reports if I leave, and in what format?
