A specialist service from CyPro
Your vulnerability management, handled end to end
Managed vulnerability scanning for UK businesses, built around the scanner you already own. You keep the tool and the licence. We run the scans, or take in the exports you already have, weigh every finding against the real risk to your business, and hand back a short, prioritised list of what to fix first.
- Service levels, published
- Every finding human-triaged
- PCI, CE Plus and ISO 27001 evidence
- UK consultants throughout
Trusted by
What we run for you
Vulnerability management, delivered as a service
Six ways in to the same managed service, each with its scope defined and its price printed before you enquire.
Managed Vulnerability Process
Your scanner, run on schedule by us or by you; every export ingested and every finding read by a consultant, with a report that tells you the five things to fix first. Monthly service levels published on the pricing page.
Remediation Prioritisation
The benefit that pays for the service: from thousands of raw findings across your scanners to the short list actually worth fixing this month, ranked by real exposure and business value.
VAPT, Unbundled
Vulnerability assessment and penetration testing bundled at a published price: a one-off assessment from us paired with testing delivered by CyPro's CREST team.
Internal First, External Included
Internal scanning is the heart of the service, because that is where the volume and the hard prioritisation live. External coverage joins the same view whenever you want it.
PCI ASV Scans
The quarterly external scans PCI DSS demands, run through an Approved Scanning Vendor partner and managed end to end: scoping, failures, rescans and attestation evidence.
Proprietary Risk Analysis
The difference between a scanner and a service: our risk analysis weighs each finding against your actual exposure and what the affected system is worth to the business, and a consultant stays with it until it closes.
What does a vulnerability scanning service include?
A managed vulnerability scanning service wraps the scanner you already license with the process that makes it useful: scheduled scans of your external and internal systems run by us or by you, findings verified and prioritised by actual exposure, and results reported as a ranked fix list with remediation guidance, on a cadence that satisfies PCI DSS, Cyber Essentials Plus and ISO 27001 A.8.8 evidence requirements. Some organisations need a first assessment cycle to establish the baseline; from there the service keeps it happening, month after month, with a person accountable for what it finds.
Why this service
Continuous, automated scanning with a person in the loop
Prices on the page, not behind a quote
Quote-only consultancies charge upwards of a thousand pounds a day, and you are already paying the scanner licence. Our management fee is the only number missing, so it is printed on the pricing page.
Your tool, our process
Whether you run Nessus, Tenable, Qualys or another scanner, the licence stays yours. We run the scans or take your exports, and nothing reaches your inbox until the noise is gone and the rest is ranked by real exposure.
Continuous coverage, not annual snapshots
Scans run to schedule on your tooling between reports, so a critical vulnerability published on a Tuesday is in front of a consultant that week, not at the next annual review.
Evidence your auditor can use
PCI DSS quarterly scans, Cyber Essentials Plus readiness, ISO 27001 A.8.8 records and insurer questionnaires all draw from the same dated, triaged reporting trail.
Findings arrive as a fix list
Reports are written for the people doing the patching: what to fix, in what order, with the guidance to do it. Your team keeps ownership of the systems; we keep the list honest.
CyPro's bench behind the service
The consultants triaging your findings sit beside CyPro's CREST penetration testers and incident responders, so when a finding needs more than a patch, the escalation path is in the same building.
Your experts hold
Client outcomes
Results clients put their names to
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project 
Before you ask us
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is a broad, repeatable sweep that finds known weaknesses across your estate; a penetration test is a targeted manual exercise where a tester attempts to exploit them. You need scanning continuously and testing periodically, and they answer different questions.
Our VAPT page explains how the two disciplines pair up, and CyPro's CREST-accredited team delivers the testing side.
How often should we run a vulnerability scan?
Monthly is the sensible floor for most organisations, weekly where change is frequent, and continuous where exposure is high. Compliance sets minimums, not good practice: PCI DSS requires quarterly external ASV scans and quarterly internal scans, Cyber Essentials Plus involves scans of in-scope systems at assessment, and ISO 27001 auditors expect a defined, evidenced cadence under control A.8.8.
New critical vulnerabilities do not wait for your next quarter, which is why our managed service runs monthly at minimum, and more frequently at the Managed and Complex levels.
What does vulnerability scanning cost?
Every figure is published on the pricing page: monthly fees for the three service levels, Essential, Managed and Complex, the VAPT bundle and the PCI ASV add-on. You hold the licence for your scanning tool, so our fee covers the management around it: running or ingesting the scans, our proprietary risk analysis and driving the fixes. Most of this market is quote-only, with traditional assessments commonly charged at more than a thousand pounds a day, so we put our numbers in public and let you compare.
What happens after you find vulnerabilities?
A consultant reads the raw results before you ever see them: false positives are removed, then every finding goes through our proprietary risk analysis, which weighs actual exposure and the business value of the affected system rather than raw CVSS score alone. What reaches you is a ranked fix list with clear remediation guidance for your IT team or provider.
We then track each finding through to your next scan, so the report shows what was fixed, what is outstanding and what is new.
See what your attackers see
Find out what a scan of your estate would actually surface
The scoping call is free, lasts 45 minutes and is taken by a consultant, not a salesperson. It covers the scanner you already run, what your estate exposes, and exactly what having the whole process managed would cost per month.