Vulnerability Management Services for NZ Businesses

Vulnerability management is the repeating cycle of finding security weaknesses across your systems, deciding which ones matter, fixing or reducing them, and confirming the fix worked. It covers misconfigured settings, weak credentials and exposed services as well as missing patches. The cycle repeats because new weaknesses are published every week and systems change.

Patch management applies vendor updates, and it is one part of vulnerability management. The wider service also finds weak settings, exposed admin interfaces, default credentials and outdated components inside business software. A business can patch diligently and still be exposed, because no patch closes a service that should not have been reachable from the internet.

Laptops and desktops, physical and virtual servers, internet-facing systems such as firewalls and remote access, and Microsoft 365 and supported cloud settings. Each area is listed separately in your scope. External scans only cover the addresses you authorise in writing.

Agents on your computers and servers report missing updates and weak settings as checks run and devices report in. Scheduled external scans check what can be reached from the internet, and cloud settings are reviewed against current guidance. We also check again after significant changes, such as a new system going live.

How often external scans and cloud reviews run, and when findings are reviewed, is agreed in your vulnerability management scope before work starts. Urgent findings are raised through the agreed escalation route rather than waiting for the next scheduled report. Remediation timeframes reflect the risk, the systems affected and any approval or vendor dependency.

We apply patches and correct settings on the systems we manage. Where the fix has to come from a software vendor or another provider, we raise the finding with them, track progress and discuss mitigation or replacement if no fix is available. If you choose to accept a risk, we record the decision with an owner and review date.

We weigh four things together: whether the weakness is being exploited, how an attacker could reach it, the impact on your business and its severity score. The CISA Known Exploited Vulnerabilities catalogue is one free input on exploitation. A lower-scored weakness under active attack can outrank a higher-scored one nobody is using.

We check the agreed action using a follow-up scan, agent report or configuration review. A fixed finding needs a successful check. If the weakness remains but a control reduces the risk, we record it as mitigated, and any accepted risk is recorded separately with an owner and review date. A closed ticket alone does not show that a weakness has been removed.

The Common Vulnerability Scoring System rates weaknesses from None through Low, Medium and High to Critical on a scale of 0 to 10. CVSS v4 includes Threat and Environmental metrics so a score can reflect exploitation and the environment in which the system runs. A base score alone is a starting point, which is why we use it alongside exploitation, exposure and business importance.

The New Zealand Information Security Manual sets two days from release for critical patches. It is a MUST for Confidential, Secret and Top Secret systems and a SHOULD, preferably within two days, at other classifications. The manual applies to government agencies, so for other businesses it is a published benchmark, not a rule and not an Exodesk service commitment.

No. Vulnerability management is the ongoing cycle of finding and fixing known weaknesses across the whole environment. A penetration test is a point-in-time exercise in which a person actively tries to break in by chaining weaknesses together. The two work best as complements.

The National Cyber Security Centre runs a Vulnerability Insights Programme that reports on internet-facing weaknesses, and its sign-up page is written for government organisations. Check eligibility with the NCSC directly. Its incident response service is available to all New Zealanders, including small businesses.

Yes. Vulnerability management can be bought on its own, without moving the rest of your IT to Exodesk. We can work alongside your current IT provider or internal team, with the agreement setting out who fixes each type of finding.

The cost depends on the number of computers and servers, the internet-facing systems scanned, whether cloud settings are included and how much of the fixing we carry out. A large first backlog can need a one-off clean-up. Your quote sets out what the recurring fee covers.