Vulnerability Assessment for Websites, Applications, and Servers

A vulnerability assessment service checks websites, applications, servers, and cloud environments to find as many security weaknesses as possible without exploiting them. Each finding is manually verified, given a severity based on CVSS, then compiled into a prioritized report with remediation steps. Legia runs it as a one-off or periodically each month.

The basis is the number of assets checked, the type of scope, and how often checks are run. A retest after fixes is included in the package. Legia gives the details once the scope is set together.

The whole process generally takes 2 to 4 weeks: scope definition, scanning and verification, risk assessment, report writing, then retest. The retest schedule follows when fixes are completed on your side.

Vulnerability assessment maps security weaknesses as broadly as possible without exploiting them, and suits periodic checks across many assets. Penetration testing tests manually by actually trying to break in, to prove the real impact of specific weaknesses.

Legia's report contains findings rated by CVSS severity, evidence, remediation steps, and retest results, so it can be attached as evidence that checks were done. Each auditor's requirements differ, so share the requirements you received in the consultation so the fit is confirmed before checks start.

Vulnerability assessment does not exploit weaknesses, so the risk is far smaller than with penetration testing. Scans are still scheduled outside busy hours, and testing only starts after a written permission letter from the system owner stating the scope and limits.

Remediation is separate work from the assessment. Legia's report includes remediation steps for each finding so your team can do the fixes itself. If you want Legia to do them, the fixes are handled through the Website Maintenance or Server Installation & Management service and billed separately. The retest is still included, whoever does the fixing.

Most audit requirements ask for a check once a year. Beyond that, a check is best done whenever there is a major change to the system, such as adding a module, migrating servers, or opening new public access. For systems that change often, Legia offers monthly periodic checks of the same assets.

Legia signs a confidentiality agreement before testing starts. The report is handed over through an encrypted channel only to recipients you name, and Legia does not keep copies beyond the agreed period.