Basic Endpoint Vulnerability Scanning
Know Where Your Devices Are Vulnerable
An agent on each workstation and laptop checks for missing updates and known vulnerabilities, and the findings are reported to you. It shows you where the risks are; fixing them beyond routine patching is part of our managed tier.
What is Basic Endpoint Vulnerability Scanning?
Security flaws are found all the time in operating systems, browsers and everyday business applications. Once a flaw is public, attackers look for devices that haven't been updated. Basic Endpoint Vulnerability Scanning tells you which of your devices are exposed.
Most publicly known flaws are given a CVE number. CVE stands for Common Vulnerabilities and Exposures: a public catalogue in which each known flaw gets a unique reference, so software vendors, security tools and IT teams can all talk about the same issue. Each CVE usually comes with a severity rating, which helps decide what matters most.
An agent on each workstation and laptop compares the installed software and updates against known CVEs and reports what it finds. This level is detection and reporting. Fixing what is found, beyond routine patching, is part of Managed Endpoint Security & CVE Remediation.
Key benefits
- A clear list of missing updates and known vulnerabilities on every device
- Severity ratings that show which findings matter most
- Evidence of whether patching is actually working
- Included in the Advanced IT & Security plan
- A straightforward step up to managed remediation when you need it
How does it work?
Scanning is agent-based: a small piece of software on each device checks it regularly, so laptops don't need to be in the office to be included. Results are collected centrally and turned into reports.
Deploy the agent
We install the scanning agent on each enrolled workstation and laptop alongside your other management tools. Staff don't need to do anything.
Discover
The agent checks the installed operating system, applications and updates against known CVEs, and flags missing patches and vulnerable software.
Report
Findings are summarised in regular reports with severity ratings, so you can see which issues and which devices carry the most risk.
Act on the findings
Routine patching under your support plan resolves many findings. Anything left can be fixed by your own IT team, or by us through the managed tier.
- DiscoverAgent checks each device for missing updates and CVEs (included)
- PrioritiseSeverity ratings in your regular report (included)
- RemediateRoutine patching, then your IT team or our managed tier
- ReassessThe next scan shows what remains
Technical scope
- Agent-based scanning of each enrolled workstation and laptop
- Detection of missing operating system and application updates
- Identification of known vulnerabilities by CVE reference and severity rating
- Exposure information: which devices and software versions each vulnerability affects
- Regular vulnerability reports
- Not included: remediation beyond routine patching, SIEM monitoring or automated response
Typical findings
A missing operating system update
A device has missed a security update, perhaps because it has been switched off or away for weeks. The report shows it so it can be brought up to date.
An out-of-date application
A browser, document reader or other application on several devices has a known CVE. The report lists every affected device.
Unsupported software
Software past its end of support no longer receives security fixes. Scanning shows where it is still installed.
Old versions left behind
An older copy of an application sometimes remains after an upgrade and still carries its vulnerabilities. Scanning picks it up.
Scanning, remediation and penetration testing
These terms are often used interchangeably, but they are different services. Knowing which one you have avoids a false sense of security.
Vulnerability scanning (this service)
Automated detection of known vulnerabilities on your workstations and laptops, reported to you. It tells you what is wrong. It doesn't fix it, and it doesn't try to break in.
Vulnerability remediation
Fixing what scanning finds: patches, updates, removing unsupported software or changing settings. Included in Managed Endpoint Security & CVE Remediation.
Network vulnerability assessment
A scoped scan of firewalls, switches, servers and internet-facing systems rather than individual laptops. See Network Vulnerability Assessments.
Penetration testing
Qualified testers, with written permission, actively try to exploit weaknesses to show what an attacker could achieve. See External Network Penetration Testing.
Problems solved
Not knowing whether patching works
Updates can fail silently or be postponed indefinitely. Scanning shows what is actually installed on each device.
Forgotten and rarely used laptops
Spare and seldom-used devices often miss updates. Agent-based scanning includes them whenever they are online.
Unsupported software still in use
Applications past their end of support carry flaws that will not be fixed by the vendor. Scanning finds where they are installed.
No evidence for clients or Cyber Essentials
Clients and certification schemes expect timely patching. Regular reports give you a record of your position.
What's included
Included as standard
- Agent-based vulnerability detection on each enrolled workstation and laptop
- Identification of missing updates and known CVEs, with severity ratings
- Regular vulnerability reports
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Managed remediation, SIEM monitoring and approved response, through Managed Endpoint Security & CVE Remediation
- Scans of servers, network devices and internet-facing systems, through Network Vulnerability Assessments
What's not included
- Vulnerability remediation beyond routine patching
- SIEM monitoring and automated response
- Servers, network devices and internet-facing systems
- Penetration testing or any attempt to exploit vulnerabilities
Scanning finds known, published vulnerabilities. It can't detect flaws that haven't been disclosed yet, or weaknesses that come from how systems are set up together.
Finding a vulnerability doesn't fix it. The risk remains until the report is acted on, by routine patching, your IT team or our managed tier.
Basic scanning and Managed Endpoint Security are alternative levels. Moving a device to the managed tier replaces basic scanning on that device; the two are never charged together.
Who it's suitable for
- Businesses on our Advanced IT & Security plan, where it is included
- Organisations with an in-house IT person who can act on the findings
- Businesses that want evidence their patching is working
- Companies preparing for Cyber Essentials
Pricing
Priced per workstation or laptop per month, and included in the Advanced IT & Security plan. Basic scanning and Managed Endpoint Security are alternative levels, so a device is never charged for both.
Use the quote builder to add Basic Endpoint Vulnerability Scanning to an indicative quote, or book a free security review and we'll recommend what fits.
Price
£2.50 per device / month
Included in the Advanced IT & Security plan (£35 per device per month).
What affects the price
- Number of workstations and laptops
- Your support plan (Advanced already includes it)
- Operating systems in use
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) entry is a unique public reference for a known security flaw, written as CVE, the year and a number. Software vendors, scanners and IT teams all use the same reference, so a report can say exactly which flaw affects which device.
Does scanning fix the vulnerabilities it finds?
No, this level finds and reports them. Routine patching under your support plan resolves many findings. The rest need your own IT team, or Managed Endpoint Security & CVE Remediation, where our team fixes them.
Is this the same as a penetration test?
No. Scanning automatically compares your devices with a list of known flaws. A penetration test is carried out by qualified specialists who, with written permission, actively try to exploit weaknesses within an agreed scope.
Is it included in my support plan?
It is included in the Advanced IT & Security plan (£35 per device per month). On the Co-Managed and Essential plans it can be added at £2.50 per device per month.
Can we move to managed remediation later?
Yes, device by device if you prefer. When a device moves to the managed tier, its basic scanning is replaced rather than added to. Where basic scanning is part of your plan, the managed tier is charged at full price, and any overlap adjustment needs Pulsar IT approval at scoping.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.