Continuous
Scheduled and ad hoc scanning, so new exposure is found in days, not at the next audit.
Managed service / Manage & improve
Vulnerability Assessment & Risk Management
An ongoing service that keeps finding, prioritising and closing exposure across your environment, powered by Tenable and run by engineers who own every finding to a verified close.
Managed service · We say which parts are ours and which stay with your team.
Ongoing · Tenable-powered · monthly cadence
Service
Ongoing, monthly cadence after an onboarding baselinePlatform
Tenable, operated by Ip.GlassFrameworks
ISO 27001 · Essential Eight · PCI DSS · CISScope
Infrastructure, endpoints, cloud, applications, OT where safe01 / When would I need this?
Typical triggers.
- aAn audit, insurer or board has asked for evidence that vulnerabilities are managed continuously, not scanned once a year.
- bPatching is happening, but nobody can say whether the critical exposures are the ones being closed.
- cYou want vulnerability management as a running service, with the tooling, triage and chasing done for you.
- dOperational technology, legacy platforms or vendor-managed systems cannot simply be patched and need risk decisions on the record.
Need a one-off penetration test of a specific application? That is a different engagement. Ask us and we will say so.
02 / What Ip.Glass does
Unpatched vulnerabilities are among the most exploited attack vectors in modern cyber attacks, and a once-a-year scan does not keep up with them. We run vulnerability management as a service: Tenable finds the exposure on a schedule, our engineers decide what matters and chase each item to a verified close, and you see the register at any time. More than scan results: a running record of risk going down.
Step 1
Identify
Tenable scanning, authenticated and unauthenticated, across infrastructure, endpoints, cloud and applications on an agreed schedule, plus ad hoc scans for major advisories. Findings are validated so they are real.
Step 2
Prioritise
Each finding is weighed by CVSS, exploit availability, threat intelligence and what the asset does for your business. You get an ordered list, not a count.
Step 3
Coordinate
Fixes are assigned to the right owner, whether your team, a vendor or our patching service, with dates, exceptions and risk acceptances recorded.
Step 4
Verify
Closed items are re-tested and reported as fixed, accepted or overdue. Then the cycle runs again.
Prioritised
CVSS, exploit availability, threat intelligence and asset context decide what is fixed first.
Verified closed
Every finding is tracked to a verified fix, an accepted risk or an exception on the record.
03 / What you receive
Concrete deliverables, agreed before we start.
Onboarding baseline, weeks one to four
- 01Tenable deployed and tuned for your environment; asset inventory reconciled against what you thought you had
- 02Validated findings register with risk-based priority
- 03Remediation plan with owners, effort and sequencing
- 04Executive summary mapped to ISO 27001, the Essential Eight, PCI DSS or CIS Controls
- 05Walkthrough with technical and management stakeholders
04 / How it starts and runs
From a first call to a plan your team can run.
- 01Scoping call.What is in scope, what must never be scanned actively (production OT, vendor-managed systems), windows, access and who owns what. Usually one hour.
- 02Proposal and plan.Fixed scope and price for onboarding, the monthly service fee, named lead engineer, schedule and acceptance criteria.
- 03Onboarding baseline, two to four weeks.Tenable deployed, first scans in agreed windows, validation, prioritisation. You see interim findings; nothing waits for the final report.
- 04Walkthrough and plan.Findings and the remediation plan presented to technical and management audiences, owners agreed.
- 05The service runs.Monthly cadence from here, with the register live to you and a quarterly review. Scale scope up or down as the environment changes.
05 / What stays with you
Clear responsibilities on both sides.
Your organisation
- —Access, credentials and scan windows
- —Risk-acceptance decisions and sign-off
- —Implementing fixes, unless our patching service is contracted
- —Telling us when the environment changes
06 / Evidence
Credentials you can check.
No metrics are shown until a client has approved them. Reference calls on request.
Our own house
ISO/IEC 27001:2022 certified.
We run this service on ourselves.
Platform
Tenable partner.
The platform we operate for clients; engineers certified on it.
Related work
Findings to roadmap.
Local government and manufacturing programmes where the first baseline became a funded remediation roadmap. Selected work ↗
07 / Next step
Start with a
scoping call.
Tell us roughly what is in your environment and what prompted the question. We will say whether this is the right first step, and what it would cost.
Related: Patching & remediation · Security architecture & advisory
More solutions
All solutions- →Enterprise Networking
- →OT and IoT Security
- →Identity, Access & Zero Trust Controls
- →Cloud Security & Architecture
- →Security Architecture & Strategic Advisory
- →Secure Collaboration & Email Protection
- →SIEM & SOAR Integration and Optimisation
- →Enterprise-Wide Patching & Remediation Services
- →Network Operations Centre (NOC) Services