Vulnerability management and penetration testing
Find the weaknesses that matter, then fix them
ACS Cyber finds, prioritizes and helps fix the security weaknesses in your environment through vulnerability scanning, configuration reviews and penetration testing performed in-house. Each cycle ends with a retest to confirm that the fixes worked.
- External and internal scanning
- In-house penetration testing
- Configuration reviews
- Risk-based prioritization
- Remediation and retesting
At a glance
Vulnerability management, in brief
What it is: Vulnerability management is the ongoing cycle of finding security weaknesses, ranking them by real-world risk, fixing them and confirming they are gone. Penetration testing adds a tester who tries to exploit those weaknesses under agreed rules and with your written authorization, to show what an attacker could actually reach.
Who it is for: Small and midsize organizations that need current scan and test evidence for insurers, customers or frameworks, or that want to know what an attacker would see before one looks.
What ACS Cyber does: ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. Our team scans, reviews configurations and performs penetration testing in-house, covering external networks, internal networks, web applications and social engineering. We rank the findings, help remediate them and retest.
How to start: Book a free 30-minute consultation or call 1-650-300-7557. We will recommend a sensible scope for scanning or testing based on your environment.
Scan, review or penetration test?
| Activity | What it answers |
|---|---|
| Vulnerability scan | Which known weaknesses exist on our systems right now? |
| Configuration review | Are Microsoft 365, our firewalls and our cloud services set up securely? |
| Penetration test | What could an attacker actually reach by chaining weaknesses together? |
| Retest | Did the fixes work? |
Is this you?
Signs it is time for a vulnerability program
Common triggers are a request for evidence, a report that raised more questions than it answered, or an incident.
An insurer or customer wants proof
Your cyber-insurance application or a client contract asks for recent vulnerability scans or a penetration test, and you do not have either.
Your scan report is long and unhelpful
You have a scanner export full of severity ratings, but no clear view of which items an attacker could actually use, and the same findings keep coming back.
Your environment has changed
A new firewall, cloud migration, Microsoft 365 rollout, acquisition or office has changed what is exposed, and nobody has tested it since.
You are recovering from an incident
You need to know that the way the attacker got in is closed, and what else an attacker could still reach. See how we help after a compromise.
What’s included
A complete vulnerability management service
Choose ongoing coverage, a single assessment or a combination, scoped to your environment.
External vulnerability scanning
Regular scans of internet-facing systems, including firewalls, VPNs, websites and remote access services, to find what an outsider can see and probe.
Internal vulnerability scanning
Authenticated scans of servers, workstations and network devices to find missing patches, weak configurations and unsupported software.
Risk prioritization
Findings ranked by exploitability, exposure and the importance of the affected system, not by severity score alone.
Configuration reviews
Reviews of Microsoft 365, firewall rules and cloud platforms such as Azure and AWS against recognized secure-configuration practices.
Remediation guidance
Clear fix instructions for each priority finding, written for the person doing the work, with business context for the person approving it.
Continuous exposure management
Ongoing tracking of new assets, newly disclosed vulnerabilities and changes to your external footprint between formal assessments.
Penetration testing, performed in-house
Authorized, manual testing by our own security team that goes beyond automated scanning. Scope options are described below.
Validation after remediation
Rescans and retests confirm that each fix worked and nothing new was introduced. Results are recorded for your evidence file.
Executive and technical reporting
A short executive summary of risk and progress, plus detailed findings, evidence and fix steps for your IT team.
Risk-based prioritization
How we decide what to fix first
Severity scores alone are a poor guide. A critical-rated flaw on an isolated test machine can matter less than a moderate one on an internet-facing server that attackers are already exploiting.
We weigh every finding against how attackers operate and how your business runs. The result is a ranked list your team can act on, not an export to sort through.
01
Known exploitation
Is the vulnerability used in real attacks? We check public sources such as CISA’s Known Exploited Vulnerabilities catalog.
02
Likelihood of exploitation
Is working exploit code available, and do prediction models such as EPSS suggest attackers are likely to use it?
03
Exposure
Can the system be reached from the internet, from a partner connection, or only from inside a segmented network?
04
Business importance
Does the system hold sensitive data, support payments or patient care, or keep daily operations running?
05
Compensating controls
Do existing protections such as MFA, segmentation or monitoring reduce the practical risk while a fix is scheduled?
Penetration testing
Penetration testing scope options
ACS Cyber performs penetration testing in-house. Each test is scoped with you, authorized in writing and scheduled to limit disruption to your operations.
| Scope | What we test | What it tells you |
|---|---|---|
| External network | Internet-facing systems such as firewalls, VPN gateways, remote access services and public websites | Whether an outside attacker could gain a foothold in your environment |
| Internal network | Your internal network from the position of a compromised workstation or an insider, including Active Directory and file shares | How far an attacker could move after getting in, and which accounts and data are at risk |
| Web application | Customer portals and web applications, including login, session handling, input handling and access controls | Whether attackers could bypass controls, steal data or misuse application features |
| Social engineering | Phishing campaigns and pretext phone calls, agreed in advance with your leadership | How staff respond to realistic deception, and where training or process changes would help |
Every test ends with a prioritized report, a remediation plan and a retest of the fixes you make.
Find it, fix it, prove it
The same organization can fix what it finds, then retest
Many assessments end with a report and a handoff. Findings sit in a queue because the tester does not manage your systems and your IT team did not write the report.
ACS Cyber is the cybersecurity division of Atlantic Computer Systems, which provides managed IT, including helpdesk, Microsoft 365 administration, cloud, networks, VoIP and IT logistics. When you want help with remediation, Atlantic Computer Systems engineers can apply patches, change configurations and retire unsupported systems, so fixes are carried through in the underlying IT.
Then we retest. A retest repeats the specific checks or test steps behind each finding to confirm the fix works and did not introduce something new. If you have an internal IT team or another provider, we work with them instead, with the same clear instructions and retesting.
Remediation we can carry out
- Operating system and application patching
- Firewall and VPN configuration changes
- Microsoft 365 and identity hardening
- Cloud configuration fixes in Azure and AWS
- Replacement plans for unsupported systems
- Retesting and evidence for your records
How the engagement works
How the program works
Each cycle moves from discovery to verified fixes, then repeats as your environment changes.
01
Scope and authorize
We agree on targets, timing, testing methods and contacts, and you authorize the work in writing.
02
Discover
We identify the systems, cloud services and internet-facing assets in scope, including ones that may have been forgotten.
03
Scan and test
We run external and internal scans, configuration reviews and any penetration testing in scope.
04
Prioritize
We validate findings, remove false positives and rank what remains by real-world risk.
05
Remediate
Your team, our engineers or both work through the priority list with clear instructions.
06
Retest and report
We rescan and retest, record the results and report progress to leadership and your IT team.
Deliverables
What you receive
Reports are written for two audiences: leaders who decide what to fund, and engineers who do the work.
- Executive summary of exposure, priorities and progress
- Technical findings with evidence, affected systems and fix steps
- Prioritized remediation plan with owners
- Penetration test report with attack paths and recommendations, when testing is in scope
- Configuration review findings for Microsoft 365, firewalls and cloud platforms
- Retest results confirming which findings are closed
- Evidence suitable for insurers, auditors and customer questionnaires
- Trend reporting across assessment cycles
One accountable team
Clear roles from discovery to retest
Security testers and analysts
Run scans, configuration reviews and penetration tests, validate findings, set priorities and retest.
IT engineers
Atlantic Computer Systems engineers carry out remediation when you ask us to, or support your internal team.
Your IT team or provider
Owns systems day to day and approves changes, working from the same prioritized list.
Your leadership
Sets risk tolerance, approves testing and decides on remediation investments.
Framework alignment
How this work supports your obligations
Scanning, testing and remediation records are commonly requested evidence in security reviews.
| Framework | Relevant expectation | How this service supports it |
|---|---|---|
| HIPAA Security Rule | Ongoing risk analysis and periodic evaluation of safeguards | Scan results, test findings and remediation records that feed your risk analysis |
| PCI DSS | Regular vulnerability scanning and penetration testing of the cardholder data environment | Internal scanning, penetration testing and remediation evidence for your assessment; required external scans must come from a PCI Approved Scanning Vendor |
| SOC 2 | Controls for identifying and addressing vulnerabilities, tested by your auditor | Documented scanning, remediation and retest records for your evidence library |
| NIST CSF 2.0 | Identifying and assessing vulnerabilities as part of risk assessment | Findings and priorities that inform your risk register and roadmap |
| CIS Controls | Continuous vulnerability management and secure configuration | Scheduled scanning, configuration reviews and tracked remediation |
| Cyber-insurance applications | Questions about scanning, patching and external exposure | Current reports that support accurate answers |
Supporting a requirement is not the same as meeting it. Your auditor, assessor or carrier makes that determination. See risk and compliance readiness.
Want to know what an attacker would see?
Start with a free 30-minute consultation. We will discuss your environment and recommend a sensible scope for scanning or testing.
Related services
Keep weaknesses from becoming incidents
Managed detection and response
24/7 security monitoring and human-led investigation by our in-house SOC, for the threats that get past prevention.
Risk and compliance
Turn scan and test results into readiness evidence for HIPAA, PCI DSS, SOC 2 and CMMC.
Security awareness training
Phishing simulations and training that follow up on what social engineering tests reveal.
FAQ
Vulnerability management questions
Vulnerability management is the ongoing process of finding security weaknesses in your systems, ranking them by real-world risk, fixing them and confirming the fixes worked. It is a repeating cycle rather than a single scan, because new weaknesses appear as software and environments change.
ACS Cyber performs penetration testing in-house for small and midsize organizations, covering external networks, internal networks, web applications and social engineering. We provide nationwide support, headquartered in San Jose, California, with an office hub in Boston.
A vulnerability scan uses automated tools to look for known weaknesses across many systems. A penetration test is performed by a person who tries to exploit weaknesses, often by chaining several together, to show what an attacker could actually reach. Most organizations benefit from both.
Many organizations test at least annually and after significant changes, such as a new firewall, a cloud migration or a new customer portal. Scanning should be ongoing. Your insurer, customers or frameworks may set their own expectations, and we plan around them.
Yes. ACS Cyber’s own security team scopes, performs and reports each penetration test, and the same team performs the retest after you remediate. You can also read about penetration testing at Atlantic Computer Systems, our parent company.
A retest repeats the checks or test steps behind each finding after remediation to confirm the fix works and did not introduce a new issue. It turns a list of findings into evidence that the risk is closed, which is what insurers, auditors and customers want to see.
Testing is planned to minimize disruption. No test is entirely without risk, so we agree on timing, exclusions and contacts in advance and do not use techniques intended to cause outages. If a test uncovers a serious risk, we tell you right away rather than waiting for the report.
Yes. Atlantic Computer Systems engineers can carry out remediation, or we can guide your internal IT team or current provider. Either way, we retest to confirm the fixes worked.
Our reports are written to serve as evidence, with scope, methods, findings and retest results. Whether they meet a specific requirement is your insurer’s, auditor’s or assessor’s decision, and we can tailor the scope to their stated expectations. For a wider review of the controls insurers ask about, Atlantic Computer Systems, our parent company, offers a cybersecurity assessment.
We pause testing and tell you right away. Our incident response team can begin in-house investigation and containment, and you can reach us at any hour on our 24/7 incident line, 1-650-300-7557. See how we help organizations that have been compromised.
Next step
Know your exposure. Fix what matters.
Talk with ACS Cyber about scanning, penetration testing and remediation sized to your environment. For an active incident, call our 24/7 incident line or visit Active Incident Support.