Skip to content

Dealing with an incident right now? Email [email protected] and mark it as urgent

Request a free consultationEspañol
Menu

Dealing with an incident right now? Email us and mark it as urgent.

[email protected]

3940 NW 79th Ave #744, Miami, FL 33166
Bogotá: Cl. 23 # 73-64, Torre 4, Of. 509 · Visits by appointment only

Review what your company exposes to the internet

Vulnerability assessment and scanning for companies

Automated scanning looks for known weaknesses in your servers and websites. The assessment adds a specialist's review, which tells you what to fix first.

Automated scanning starting at USD 100The assessment with specialist review comes in a written proposal, based on the scope.

Request a free 30-minute consultationRequest a scanning quote

Free 30-minute consultation. Our engineering team handles your request.

Illustrative example — Fictitious data

Scan report

Database visible from the internet

High severity

What to do: close that access from the internet.

Pralogy is a cybersecurity firm that runs vulnerability scans and assessments for companies. Automated scanning looks for known weaknesses in what your company exposes to the internet. The assessment adds a specialist's review, which ranks the findings by severity. Each finding comes with its severity and how to fix it. Automated scanning starting at USD 100.

Is your company in one of these situations?

  • “We do not know which of our servers, websites and services can be seen from the internet.”

  • “A client or an auditor is asking us for a vulnerability assessment.”

  • “We changed servers or providers and want to know what was left open.”

  • “We are about to have a penetration test and want the basics fixed first.”

  • “We want to review what we expose to the internet more than once a year.”

Not sure whether you need a scan, an assessment or a penetration test? In the free 30-minute consultation, we help you choose.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

Two ways to start and what you receive

  • Automated scanning

    Our tools review what your company exposes to the internet, and we deliver the findings with their severity and how to fix them. Automated scanning starting at USD 100.

  • Vulnerability assessment

    It adds a specialist's review to the scan: what you have exposed, which findings apply to your environment and what to fix first. It comes in a proposal based on the scope.

  • Executive and technical report

    One for management, your client or your auditor, and another for the people who make the fixes. Each finding comes with its severity and how to fix it.

  • Comparison with the previous scan

    If scanning is periodic, we show you what was closed and what is new.

  • Retest, if agreed

    We check again after the fixes and tell you what was closed. The retest is agreed in the quote or the proposal.

How we do it

  1. Written scope

    Which addresses, websites and servers are reviewed, from where and how often.

  2. Your authorization before we start

    We only scan what you authorize in writing, during the agreed hours.

  3. Scanning for known weaknesses

    The tools look for known weaknesses without exploiting them to get in.

  4. Specialist review

    In the assessment, a specialist reviews the results, ranks them by severity and tells you what to fix first.

  5. Report and next step

    Each finding comes with its severity and how to fix it. To demonstrate a risk, we propose a pentest.

Documented case

Vulnerability assessment

Databases and admin panels no longer visible from the internet

Organization with its own servers exposed to the internet

None left open

At the retest, no finding was still open. The databases and admin panels were no longer visible from the internet.

Anonymized case. These results are from this case.

Situation
A vulnerability assessment found databases, a security console, password-based remote access and application ports open to the internet.
What we did
We delivered each finding with its severity and how to fix it. After the fixes, we tested again from the internet. Some were closed with compensating controls that reduce the risk.
What remained open
Verifying from the internal network what cannot be checked from the internet.

See other real, anonymized cases

Not sure where to start?

Tell us what you have exposed to the internet and who is asking for the review. We will tell you whether a scan, an assessment or a penetration test is the right fit.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

Scanning, vulnerability assessment, penetration testing or red team

All four are useful, for different purposes. This is how they differ.

Type of testWhat it findsWhat it missesWhen to use it
Automated scanningWhat it findsKnown weaknesses: outdated software, open services and weak configurations.What it missesLogic flaws, attacks that chain several weaknesses and what the tool does not recognize. It may report findings that do not apply.When to use itTo quickly see what you have exposed and repeat it often.
Vulnerability assessmentWhat it findsThe same, reviewed by a specialist who tells you what to fix first.What it missesProof that a weakness can be exploited, since it does not try to get in.When to use itWhen a client or an auditor asks for it, or before a penetration test.
Penetration testing or ethical hackingWhat it findsSpecialists test the way an attacker would and demonstrate which weaknesses open the door, including logic flaws.What it missesAnything outside the agreed scope. It is a snapshot of one point in time.When to use itWhen a client or an audit asks you to demonstrate the risk.
Red team (adversary emulation)What it findsWhether your defenses detect a controlled attack and whether your team responds.What it missesA complete list of weaknesses, since it pursues a specific objective.When to use itWhen you have already fixed the basics and want to measure your detection.

None of these tests finds everything. Adversary emulation is part of the scope of our penetration testing.

See penetration testing for what scanning misses

Already know you want to start with a scan?

Tell us how many IP addresses (those of your internet-facing servers) or websites you want to scan. Automated scanning starting at USD 100.

Request a scanning quote

We reply during business hours.

The same, on an ongoing basis

Periodic scanning of what your company exposes to the internet can be part of the yearly plan. In the managed security program we documented, we scanned the external attack surface every week.

See a year in the managed security program

Frequently asked questions

How much does vulnerability scanning or assessment cost?

Automated scanning starts at USD 100; the amount depends on how much needs to be scanned, and we send it to you in a quote. The assessment with specialist review depends on the scope and comes in a written proposal. If you are not sure which one you need, start with the free 30-minute consultation.

What is a vulnerability assessment?

It is a review of your systems to find known weaknesses, such as outdated software, open services or weak configurations, and rank them by severity. It uses scanning tools and a specialist's review, without exploiting the weaknesses to get in.

What is the difference between automated scanning and a vulnerability assessment?

Scanning is done by tools, and you receive what they found, each finding with its severity and how to fix it. In the assessment, a specialist also reviews the results and tells you which findings apply to your environment and what to fix first.

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment finds and ranks known weaknesses, without trying to get in. A penetration test probes them the way an attacker would and demonstrates which ones open the door. See the comparison and how we do penetration testing.

Does a vulnerability scan find every vulnerability?

It finds known weaknesses. For logic flaws and attacks that chain several weaknesses, we use a penetration test, which tests your systems the way an attacker would.

Can a vulnerability scan affect our systems?

Scanning sends requests to your systems and can generate load. That is why we agree in writing on what is reviewed, at what time and what must not be touched. If a system is sensitive, its precautions are written into the scope.

How often should we run a vulnerability scan?

It depends on how much your systems change. It can be a one-time or periodic scan, at a frequency we agree on. In the managed security program we documented, we scanned the external attack surface every week.

Do you fix what the scan finds, and is a retest included?

Your team makes the fixes, with our guidance: each finding comes with its severity and how to fix it, and if you need support, we agree on it in the proposal. The retest is agreed in the quote or the proposal. If you need it as part of the test, see what every ethical hacking engagement includes.

When do I receive the vulnerability assessment report?

It depends on the scope and on whether you hire the scan or the assessment. The timeline is agreed in the quote or the proposal, before we start.

Does a vulnerability assessment help with ISO 27001?

It provides evidence that you review your technical vulnerabilities, and the executive report can be presented to your auditor or your client. If you are asked to demonstrate the risk, the right service is a penetration test.

What do you need from us for a vulnerability scan?

The list of IP addresses, domains or websites you want reviewed and your written authorization. To scan what you expose to the internet, you do not need to install anything.

Let's talk about what your company exposes

Tell us what you want to review and who is asking for it. Our engineering team handles your request.

Automated scanning starting at USD 100. If you already know you want it, request a scanning quote.

Request your free 30-minute consultation

Fields marked with * are required.

Your work email, preferably. A personal email also works.

Optional, if you prefer a phone call.

If you are not sure, choose the last option.

Add details (optional)

Do not include passwords or confidential information.

You can access, correct or delete your data by writing to [email protected].

Free 30-minute consultation. We reply during business hours.

We work with companies and organizations, and we also train our clients' staff.

Prefer email? [email protected]