Know your vulnerabilities
before someone else finds them.

A vulnerability assessment is a systematic survey: automated and manual scanning of networks, servers, endpoints, cloud services and applications to find known vulnerabilities, insecure configurations and outdated software, ranked by risk. A penetration test goes further: it actually tries to exploit those weaknesses, in a controlled and agreed way, to demonstrate what an attacker would achieve. It is carried out by specialists, also with tools assisted by artificial intelligence, and we validate every finding. The first tells you where you are exposed, the second how much it hurts. You need both, at different frequencies.

48,185 new CVEs were published in 2025, about 131 a day: a test done once a year captures a situation that changes every week. Our guidance is a continuous or at least monthly vulnerability assessment on exposed assets, a penetration test at least once a year and after every significant change (new application, migration, merger), and a re-test after every remediation. NIS2 explicitly requires vulnerability management as a process, not an event.

A vulnerability assessment has a negligible impact and is tuned not to saturate networks and systems. A penetration test can affect fragile services, which is why every phase is agreed in advance: scope, rules of engagement, time windows, excluded systems, emergency contacts and stop criteria. On critical systems we work in dedicated windows or on replica environments. An AI-assisted penetration test simulates a real attacker and may modify data, submit forms or trigger notifications: that is why we recommend it on test environments and, when working in production, backups, snapshots and a restore test are needed first, which we can carry out ourselves as an activity set out in the contract. The test can be stopped at any time: the stop blocks further actions, it does not undo those already performed. We do not promise “zero impact”: we promise to tell you beforehand where it may occur and to manage it.

Not with the CVSS score alone. A vulnerability rated CVSS 9 on an isolated server can matter less than one rated 6 that is exposed to the Internet and already exploited in real attacks. So we combine three signals: technical severity (CVSS 4.0), the probability of exploitation in the next thirty days (EPSS) and presence in the KEV catalogue of actively exploited vulnerabilities. The result is a short list of things to do now, then the rest in order, instead of four hundred lines all in red.

Two documents. The executive summary in English, written by us for management: overall risk level, the five or ten issues that matter, priorities based on CVSS, EPSS and the KEV catalogue, what happens if nothing is done. The technical report, for those who fix: every vulnerability with evidence, demonstrated impact and a recommendation; in AI-assisted penetration tests it is the platform’s own report. Before delivery we verify every finding and rule out false positives. The report can be shared with auditors, authorities and customers to show the checks carried out. After remediation the re-test is agreed in the quote: no vulnerability is considered closed without verification.

Article 21 of the NIS2 Directive imposes risk management measures that include vulnerability handling and disclosure, security in system acquisition and maintenance, and policies to assess the effectiveness of the measures adopted. It does not name penetration testing as such, but it is the most direct way to demonstrate that effectiveness assessment to the competent authority. From 2026 the Cyber Resilience Act adds vulnerability handling obligations for manufacturers of hardware and software with digital elements too.

The EUVD (European Union Vulnerability Database) is the European vulnerability database run by ENISA, operational since 2025 and provided for by NIS2. It was also born out of a practical problem: in 2025 the US NVD database fully enriched only about 28% of new CVEs, with a backlog that slows down assessment. In our vulnerability management we use both sources, plus EPSS and the KEV catalogue, so priorities do not depend on the timing of a single body.

It depends on the scope. Vulnerability assessments, continuous vulnerability management and tests on infrastructure and identities are carried out by our own team, which then also follows remediation and re-test. For penetration tests we also use an AI-assisted platform from a provider based in the United Kingdom: scope, authorisations, validation of findings and the executive summary remain ours. For more specialised penetration tests, complex applications, industrial environments, red teaming, we involve specialised partners we have worked with for a long time, under our coordination and with a single point of contact: the contract, the rules of engagement and the report remain ours. In both cases we tell you beforehand who will do what.

Yes, as a tool and not as a substitute. An artificial intelligence agent explores the agreed systems the way an attacker would, adapts its moves to what it finds and demonstrates the exploitable vulnerabilities. For exactly this reason it never behaves the same way twice, it may report false positives and it does not find everything: we verify every finding before delivery, and on complex applications manual testing remains. The data collected during the test stays isolated for each client and is not used to train artificial intelligence models.

On anything that controls physical processes or people’s health: industrial plants and OT (Operational Technology) systems, SCADA and PLCs, safety and fire systems, medical devices and hospital systems, vehicles and navigation systems. Here an unexpected action can cause real damage, so we work with manual tests by specialised partners, in agreed windows and with precise stop criteria. The same applies to third-party systems without written authorisation from their owner.

Yes, in four ways. Single test: a vulnerability assessment or a penetration test with report and, after remediation, re-test. Continuous programme: vulnerability management as a service, with recurring scans, prioritisation and remediation support. Consulting only: we write the specification for the test, evaluate other providers’ offers or read a report you already have together with you. Verification: independent re-test of remediations carried out by your team or by third parties. The free starting point, for everyone, is the NIST CSF 2.0 assessment on our platform.