In short
Vulnerability management as a service is a managed cycle of scanning your devices and systems for known weaknesses, prioritising them by real-world risk, patching or mitigating them and verifying the fix. Forever Systems runs it on tools such as SentinelOne, ThreatDown, Blackpoint and TrendAI, often using the agents you already have, with continuous penetration testing as an option.
Get a quote for vulnerability management as a service
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What vulnerability management as a service is
New vulnerabilities are published every day, in operating systems, browsers, office software, firmware and the line-of-business applications nobody remembers to update. Each one is a potential way in. Vulnerability management is the ongoing process of finding them, deciding which matter most, fixing them and checking the fix worked.
Most organisations have the pieces: an endpoint agent that can scan, a patching tool, perhaps a yearly penetration test. What is usually missing is the routine that joins them up and the time to work through the results. Vulnerability management as a service provides that routine. Forever Systems runs the scans, turns hundreds of findings into a short ranked list, patches what we are asked to patch, follows up the exceptions and reports progress to you.
If you are looking for the software itself, our licensing site compares vulnerability management software; this page is about running it as a service.
What is vulnerability scanning?
Vulnerability scanning is the automated part: checking systems against databases of known vulnerabilities. There are three main kinds, and a good service uses more than one:
| Type | How it works | What it finds |
|---|---|---|
| Agent-based (authenticated) | An agent on each device inventories the operating system and installed applications | Missing patches and vulnerable software on managed Windows, macOS and Linux devices, including laptops away from the office |
| Network scanning | A scanner probes devices across the internal network | Vulnerable services on servers, network equipment and devices that cannot run an agent |
| External scanning | Tests your internet-facing addresses from outside | Exposed services and weaknesses an attacker on the internet would see |
Managed Windows vulnerability scanning is usually the starting point, because Windows desktops and servers make up most estates and the agent-based tools below cover them well. Scanning alone is not the goal, though: a scan that produces a report nobody acts on changes nothing.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Scan, prioritise, patch, verify
Our service follows a simple cycle, agreed with you at quote:
- Scan. We enable scanning on your endpoint agents or deploy a scanner, starting with a pilot group, and set how often scans run.
- Prioritise. We rank findings by real-world risk rather than raw severity, using exploit likelihood, whether attackers are already using the flaw, and how important the affected system is to you.
- Patch or mitigate. We deploy patches through your patching or device management tool in agreed rings, test group first and servers in maintenance windows. Where no patch exists, we recommend a mitigation.
- Verify. We re-scan to confirm the fix worked, and chase anything that failed.
- Report. We share what was found, what was fixed and what is waiting on a decision from you, such as software that needs an upgrade or replacement.
Severity scores such as CVSS describe how bad a vulnerability could be. Signals such as the Exploit Prediction Scoring System (EPSS) and the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list show how likely it is to be used against you. Combining them is what lets a small team fix the handful of issues that matter first.
Tools we use
We run the service on the tools that fit your estate, often ones you already license. The table describes each option; it is not a ranking.
| Tool | How it scans | How it prioritises | Patching |
|---|---|---|---|
| SentinelOne Singularity Vulnerability Management | The existing SentinelOne agent assesses operating systems and applications | EPSS, the CISA Known Exploited Vulnerabilities list and business criticality, combined into a SentinelOne Risk Score | Through your patch or device management tool |
| ThreatDown Vulnerability and Patch Management | The ThreatDown agent scans modern and legacy applications | CVSS scores and CISA recommendations | Built in, with critical updates prioritised |
| Blackpoint CompassOne Core | Vulnerability management within Blackpoint's platform | By how much each weakness matters in your environment; includes dark web monitoring | Through your patching tools |
| TrendAI Vision One Cyber Risk Exposure Management (formerly Attack Surface Risk Management) | Agents, connected tools and a Network Vulnerability Scanner | Risk scoring using vulnerabilities, misconfigurations, threat activity and asset criticality | Through your patching tools |
| Check Point Endpoint posture management | The Check Point Endpoint Security agent (Elite edition) | CVSS scores | Built in |
| Bitdefender GravityZone Patch Management | The Bitdefender agent finds missing operating system and third-party patches | Ranks missing patches | Built in, manual or automatic |
WatchGuard Endpoint Security also offers a Patch Management module for Windows, macOS, Linux and many third-party applications, and ThreatDown and Bitdefender can patch from the same console that scans. Agent-based tools only see devices that have the agent, so we also look for unmanaged devices during onboarding. For patching itself, our endpoint security site explains patch management in more depth, and managed endpoint security covers the agents these tools run on.
Is vulnerability management as a service the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Continuous penetration testing
Vulnerability scanning tells you which weaknesses exist. Penetration testing shows whether an attacker could chain them together to reach something that matters, such as domain admin rights or sensitive data. Traditionally that is a yearly test, and networks change every week in between.
Autonomous penetration testing closes that gap. Forever Systems runs Horizon3.ai NodeZero Core as a managed service on a 12-month subscription: we schedule internal, external and cloud tests, review the attack paths NodeZero proves, tell you which fixes matter most and verify them once made. It complements, rather than replaces, scanning and any formal testing your customers or regulators require.
Who it suits
Vulnerability management as a service suits organisations that:
- Know patching slips when the IT team is busy with everything else
- Have more findings than time, and need a short list of what to fix first
- Are preparing for Cyber Essentials or Cyber Essentials Plus, or need evidence for an insurer or customer
- Run older line-of-business software that cannot simply be updated and needs a mitigation plan
- Already pay for a capable agent, such as SentinelOne or ThreatDown, without using its vulnerability features
Smaller organisations often get the most from it, because there is rarely anyone with time to read scan reports; see managed security for small business. Vulnerability management also reduces the work for whoever responds to incidents: fewer known weaknesses means fewer ways for an attacker to move from one compromised device to the next, which helps any managed SOC or MDR service you use. It is one of our managed security services.
Vulnerability management, Cyber Essentials and compliance
The security update management control in Cyber Essentials requires high and critical security updates to be installed within 14 days of release on every in-scope device, for applications as well as operating systems. Third-party applications are where many organisations fall short, and a managed service with regular reports gives you both the fixes and the evidence. Cyber Essentials Plus adds independent testing; see what the Cyber Essentials Plus vulnerability scan involves.
ISO/IEC 27001:2022 includes control 8.8, Management of technical vulnerabilities, and the NCSC Cyber Assessment Framework expects vulnerabilities to be managed too. Our compliance guides, including ISO 27001 logging and monitoring, show how managed services produce the evidence these frameworks ask for.
Pricing depends on the tool, the number of endpoints or assets and how much of the patching you want us to do, so ask us for a quote. Contact us to start with a first scan and a ranked fix list.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is vulnerability management as a service?
It is a managed, repeating cycle of scanning your systems for known vulnerabilities, prioritising them by real-world risk, patching or mitigating them and verifying the fix, with regular reports. Forever Systems runs it on tools such as SentinelOne, ThreatDown, Blackpoint and TrendAI.
What is vulnerability scanning?
Vulnerability scanning is the automated checking of devices and systems against databases of known vulnerabilities. It can use an agent on each device, a scanner on the internal network, or tests of your internet-facing systems from outside. Scanning is the first step of vulnerability management, not the whole of it.
What is managed vulnerability scanning?
Managed vulnerability scanning means a provider sets up and runs the scans, interprets the results and turns them into a prioritised fix list, instead of leaving you with a raw report. With Forever Systems it can include patching and re-scanning to verify fixes, as agreed at quote.
How is vulnerability scanning different from penetration testing?
Scanning finds known weaknesses. Penetration testing tries to exploit them, often chaining several together, to show what an attacker could actually reach. We offer continuous autonomous penetration testing with Horizon3.ai NodeZero Core run as a managed service, alongside scanning.
Does Cyber Essentials require vulnerability management?
Cyber Essentials requires high and critical security updates to be applied within 14 days of release on in-scope devices, and Cyber Essentials Plus includes a vulnerability scan. A managed vulnerability service helps you meet the requirement and keep evidence that you have.
Still have a question about vulnerability management as a service?
Ask us and a member of our team will reply by email.