Define the environment and permission to scan
Record which assets and networks are included, who owns them and who can authorise the work. Include exclusions, third-party dependencies and any systems that need special handling. Confirm permission and boundaries before scanning begins.
- What assets, networks or locations are in scope?
- Who is responsible for authorising the scans?
- Which systems or third-party environments are excluded?
Agree the practical scanning arrangements
Discuss access requirements, suitable scanning windows and how operational constraints will be handled. Establish how the customer will notify you of changes to the environment. A repeatable scope makes subsequent results easier to interpret.
- What access and technical preparation are required?
- What scanning frequency and windows suit the environment?
- Who should be contacted if a scan needs to be paused or rescheduled?
Make the reporting useful to its audience
Agree who will read the results and what decisions they need to make. A technical team may need detail to investigate individual findings, while a business stakeholder may need a clear summary of priorities. Decide how findings will be reviewed and how changes between scans will be explained.
- Who receives the reports and in what format?
- How will findings be prioritised and discussed?
- How will follow-up questions and progress reviews be handled?
Confirm who owns the next steps
Finding a vulnerability does not by itself resolve it. Identify the team responsible for assessing and applying changes, and agree any additional support required. Keep remediation ownership, guidance and follow-up scanning clear in the service scope.
- Who will decide on and carry out remediation?
- What guidance or hands-on support is included?
- When will follow-up scans or reviews take place?
Bring the brief to us.
White Label Cyber provides managed vulnerability scanning under your brand, combining scanning with risk prioritisation and practical remediation guidance. Share a high-level outline first; passwords, access credentials and sensitive customer details are not needed for an initial enquiry.
Explore Managed vulnerability scanning ↗