Vulnerability assessment and scanning
We scan your servers, devices and web addresses for known weaknesses, outdated software and unsafe settings, then an engineer removes the false positives and writes up every finding together with its fix. Based in Hyderabad, assessing systems for companies across India.
- Method
- Scanning plus engineer review
- Severity
- CVSS 3.1 on every finding
- Duration
- 5 to 10 working days
- Starts from
- INR 9,000 + 18% GST
Last reviewed
Breadth: every host and web address in the agreed scope is checked against known weaknesses, outdated software and unsafe settings.
Triage: an engineer reviews the scanner output and removes false positives before anything reaches your report.
A fix for each finding, scored with CVSS 3.1 and written in a report your team can work through.
01 / Who needs it
Who needs a vulnerability assessment
A vulnerability assessment is the broad sweep: it looks at everything in scope for known weaknesses and tells you what to fix first. It suits teams that want coverage and a ranked list.
Most teams ask for an assessment for one of six reasons. The common thread is that they want to know what is exposed or out of date across many systems, and they want a ranked list rather than a long export from a tool.
A large estate
Dozens or hundreds of servers, devices and web addresses, where checking by hand is not realistic and the first need is a map of what is weak.
After a patch cycle
You patched, and you want an independent check that the fixes took and that nothing was left exposed along the way.
A customer questionnaire
A customer asked whether you run vulnerability assessments, and you want a report from someone outside your team to attach to the answer.
Before a penetration test
Clearing known weaknesses first leaves the testers' hours for the questions a scanner cannot answer, such as access control and business logic.
A new environment
A new office network, a cloud move or a freshly launched site: a first assessment shows what the move left exposed.
A small, defined target
A simple website or a handful of public IP addresses, where the starter scope gives you the scan, manual checks and a report at the lowest price we offer.
02 / What we assess
What an assessment covers
The scope is written down before scanning starts. These are the targets we are asked to assess most often.
An assessment covers what you put in the scope, no more and no less. Four kinds of target make up most requests, and one engagement can combine them.
External hosts and addresses
Public IP addresses and the services behind them: open ports, outdated versions, exposed admin interfaces, weak encryption settings and default or unsafe configurations.
Internal servers and devices
Servers, workstations and network devices inside your network, reached through a jump host or VPN account that you provide. Missing patches and risky settings are the usual findings.
Web applications
Pages and endpoints checked for known flaws and unsafe configuration, with and without a sign-in. For flaws that depend on what each user is allowed to do, a penetration test is the right tool.
Encryption and configuration
Certificate problems, outdated protocol versions, missing security headers and services that should not face the internet.
Wireless networks, cloud accounts and source code have their own services, because the checks differ. Say what you want covered when you contact us, and the proposal states exactly which targets are in the assessment.
03 / Method
How an assessment runs
Five steps, in the same order every time. The step that separates an assessment from a tool export is the fourth, where an engineer reviews the results.
Show details for How an assessment runs
Step 1
Scope and asset list
You give us the addresses, ranges and URLs in scope, and we confirm what is off limits. Both sides sign the rules of engagement before any scanning starts.
OutputAgreed scope and rules
Step 2
Windows and source addresses
We agree when scanning will run and give you the fixed IP addresses it will come from, so your team can allow them and recognize them in its logs.
OutputTest windows and source IPs
Step 3
Scanning
Scans run without credentials, which shows what an outsider sees, and with credentials where you supply them, which shows what is missing or unsafe on the system itself.
OutputRaw scanner results
Step 4
Triage by an engineer
An engineer reviews each result against your environment. False positives are dropped, duplicates merged and the weaknesses that matter are confirmed with light checks where that is safe to do.
OutputTriaged findings
Step 5
Report and retest
Each finding gets a CVSS 3.1 score, the affected asset and a fix. You fix what you choose to, and the retest checks the result.
OutputExecutive and engineering reports
04 / Scan or test
Scan, assessment or penetration test
Buyers often use the three words as if they meant the same thing. They do not, and the right choice depends on the question you are trying to answer.
Show details for Scan, assessment or penetration test
The words are used loosely in the market, so the table below says what each one means on this page.
| Aspect | Automated scan | Vulnerability assessment | Penetration test |
|---|---|---|---|
| Who judges the result | No one: the tool's output is the result | An engineer reviews and ranks every finding | An engineer decides what is real and how weaknesses combine |
| False positives | Passed straight through | Removed before the report | Uncommon, because each finding is demonstrated |
| Breadth | As wide as the tool's coverage | Wide: the whole agreed scope | Focused on chosen targets |
| Proof of impact | None | Light confirmation where safe | Exploitation under written rules |
| Typical report | A tool export | A ranked list with a fix for each finding | Findings with the steps to reproduce them, evidence and attack paths |
| Best for | A quick look at a small target | Regular checks across many systems | Launches, audits and flaws in how an application behaves |
An assessment tells you what is weak. A penetration test tells you what an attacker could do with it. Many teams start with the first and add the second where the stakes are higher.
05 / What you get
What you get from an assessment
The report has two readers: the person deciding what to fix first and the administrator or developer who has to fix it.
Show details for What you get from an assessment
- An executive summary written for people who do not read scanner output: how exposed you are, what to fix first and why.
- An engineering report with every finding listed by asset, with the evidence the scanner found and the fix your team should apply.
- CVSS 3.1 scores come with every finding, plus a CVE identifier where one exists, so you can match findings to your own patch tracking.
- The false positives removed, so your team spends its time on weaknesses that are real.
- A remediation order that puts the fixes with the most effect first.
- A retest of the findings you fixed, so the report you keep shows what was closed.
The engineering report is where your administrators and developers will work. The executive summary is the page to share with management, a customer or an auditor.
06 / Price
What an assessment costs
Small scopes start from INR 9,000 + 18% GST. A larger assessment is priced after scoping, because the number of hosts and applications sets the work.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
It is meant for small, well-defined targets.
- A vulnerability scan
- Manual checks
- A written report
A larger assessment
Starts fromPriced after scoping
A standalone vulnerability assessment of a larger scope is priced in a written proposal once we know what is in it.
The proposal names every host range, web address and environment it covers.
- Scoped to your estate
- Fixed source addresses
- Report and retest terms in writing
Four things move the price of a larger assessment: the number of hosts, the number of web applications, whether internal systems are included and whether scans run with credentials. To see how scope becomes price across every service, see the VAPT cost guide for India, where each figure other vendors publish is named with its source.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
07 / How often
How often to assess
An assessment shows the state of your systems on the day it ran. How often to repeat it depends on how quickly your environment changes.
Show details for How often to assess
A vulnerability assessment is a snapshot. New weaknesses are published every week, and every patch, new server or configuration change can open one, so an assessment is only as current as its date.
After major changes
A new release, a network change or a migration is a good moment to look again at what the change touched.
Around your patch rhythm
Teams that patch on a regular cycle often assess once per cycle, or once a year at least, to check that the process is working.
Before a penetration test
Close the known gaps first, so the tester's time goes on the things that need a human.
Each assessment is scoped on its own, and a repeat can be requested at any time. Tell us how often you would like one when you contact us, and the proposal states it.
08 / Compliance evidence
Assessment as compliance evidence
Frameworks ask in different ways for a regular look at technical weaknesses. A report from an assessment is one record of that look.
Show details for Assessment as compliance evidence
ISO 27001
ISO/IEC 27001 lists the management of technical vulnerabilities as control 8.8 in its Annex A. An assessment whose findings are tracked to closure leaves a record for that control. BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27 and ISO 9001:2015 certificate 26MEQVL30.
PCI DSS
PCI DSS asks for regular vulnerability scans of the systems in scope, and its external scans must be run by an Approved Scanning Vendor. BERRY9 is not an ASV, so check with your assessor which scans a firm like ours can supply.
SOC 2
SOC 2 does not name a scan, but its criteria expect you to find and manage vulnerabilities. An assessment is one way to show that you do, and your auditor decides what evidence is enough.
DPDP Act
The DPDP Act asks data fiduciaries to take reasonable security safeguards. A regular assessment of the systems that hold personal data is one record of that effort.
A report supports your case but does not replace an audit. BERRY9 does not certify organizations, and your auditor or assessor decides whether a report meets a framework.
09 / What we need from you
What we need before scanning starts
An assessment needs little paperwork, but five things make it safer and faster.
Show details for What we need before scanning starts
- The addresses, ranges and URLs in scope, and anything that must be left alone.
- A person we can reach during scanning, and the windows in which scanning may run.
- Your firewall or security team told to allow our fixed source addresses, or to expect alerts from them.
- Credentials for authenticated scans where you want them, and a jump host or VPN account for internal systems.
- Signed rules of engagement, agreed with us during scoping.
Our only office is in Hyderabad. Public addresses are scanned over the internet from there and internal systems through the access you provide, and we can come on site by arrangement. If you are based in the city, see also the VAPT services in Hyderabad page.
10 / Turnaround
How long an assessment takes
Show details for How long an assessment takes
Most assessments run 5 to 10 working days from the day testing starts. Where yours lands depends on the number of hosts, whether internal systems are included and how much triage the results need. A very large estate needs more time, so the proposal gives the dates.
Scanning itself is the short part. Most of the time goes on checking results against your environment, which is also what makes the report worth reading.
11 / Inquiry
Tell us what to assess
Give us the number of hosts and web addresses, say whether internal systems are included and name your deadline. We answer with a scope and a schedule.
To talk it through first, call +91 86868 92922 or email contact@berry9.com.
12 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
How much do vulnerability assessment services cost in Hyderabad?
Small scopes start from INR 9,000 + 18% GST. A larger assessment is priced in a written proposal once we know how many hosts, web applications and environments it covers, because those numbers set the work. See the section on What an assessment costs above.
How does an assessment differ from a penetration test?
An assessment looks broadly for known weaknesses and ranks them. A penetration test is a focused attempt to exploit weaknesses, including flaws that no scanner knows about, such as one customer being able to read another customer's records. Many teams start with an assessment and add a test where the stakes are higher. See the section on Scan, assessment or penetration test above.
Is a vulnerability scan the same as a vulnerability assessment?
No. A scan is what the tool produces. An assessment adds an engineer who reviews the results against your environment, removes false positives and ranks what is left, then writes a report with a fix for each finding.
Do you offer vulnerability management services?
We deliver assessments and retests as defined engagements, each scoped and priced in a written proposal. The fixes, and the day-to-day work of keeping systems patched, stay with your team; the report tells them what to fix and in what order.
Will scanning disrupt our live systems?
Scans are designed to be safe, and we work to avoid disrupting production. Before it starts we write down the windows in which scanning may run and anything that must be left alone.
Do you assess internal networks as well as public ones?
Yes. We scan public addresses from outside your network. For internal systems you provide a jump host or VPN account during scoping, and we can come on site by arrangement.
Do you scan with credentials?
Where you want it, yes. A scan without credentials shows what an outsider sees. A scan with credentials also shows missing patches and unsafe settings on the system itself, which is where most of the findings on internal servers come from.
Does your assessment satisfy the PCI DSS quarterly scan requirement?
Not on its own. PCI DSS external scans must be run by an Approved Scanning Vendor, and BERRY9 is not one. An assessment from us can support your wider vulnerability management, and your assessor says which scans count. See the section on Assessment as compliance evidence above.
How long does a vulnerability assessment take?
Most run 5 to 10 working days after testing starts. A very large estate, or a scope that includes internal systems, can run longer, and the proposal lists the dates. See the section on How long an assessment takes above.
Can you give us the scanning IP addresses in advance?
Yes. We agree the scanning windows with you and give you the fixed source addresses before scanning starts, so your team can allow them and recognize them in its logs.