Security services · Hygiene

Vulnerability management.

Thousands of new vulnerabilities are published every year, and attackers now use AI to weaponise them in hours. We find, rank and track every weakness across your estate, so your team fixes what matters first, fast.

Get a fixed-price quote
Continuous, not once a yearRanked by real exploit riskPatch timelines tracked
weekly scan · sample● demo
  1. FOUND Known-exploited flaw on VPN gateway
  2. FLAGGED 3 servers past end of life
  3. FIXED Critical patch applied in 9 hours
  4. PASSED No new internet-facing services
  5. FLAGGED Exception approved until month end
In plain words

Vulnerability management is the ongoing job of finding weaknesses in your systems, ranking them by real risk and making sure they get fixed. We scan your servers, laptops, cloud and internet-facing assets continuously, rank findings with CVSS severity, EPSS exploit odds and known-exploited lists, hand your team a short weekly fix list and track every patch against agreed deadlines.

Cadence
Continuous
Ranking
CVSS · EPSS · known-exploited lists
Tracks
Patch deadlines and exceptions
Pricing
Monthly, per asset
Why speed matters now

CERT-In’s patch clock.

In May 2026 CERT-In published recommended times to patch or mitigate, based on how exposed a system is and whether attackers are already using the flaw. We track your fixes against these clocks.

CERT-In’s recommended patch times from its May 2026 AI security blueprint: known exploited flaws on internet-facing systems within 12 hours where feasible; critical internet-exposed flaws within 1 day; known exploited flaws on internal systems within 1 day; critical flaws on internal high-value systems within 3 days; high-severity flaws within 5 days. TIME TO PATCH OR MITIGATE Known exploited · internet-facing12 hoursCritical · exposed to the internet1 dayKnown exploited · internal systems1 dayCritical · internal high-value systems3 daysHigh severity5 days
From CERT-In’s AI security blueprint of 25 May 2026, which is advisory. Its point: attackers now use AI to turn new flaws into working attacks within hours, so patch windows have to shrink to match.
What we cover

Everything with an IP address, and more.

  • Authenticated internal scans

    Servers, laptops and network devices, scanned with credentials for accurate results.

  • External attack surface

    Everything you expose to the internet, including forgotten hosts and shadow IT.

  • Cloud and containers

    Cloud workloads, images and Kubernetes clusters.

  • Risk-based ranking

    CVSS for severity, EPSS for exploit odds, known-exploited lists for urgency.

  • Patch deadline tracking

    Deadlines per severity and exposure, with escalation when they slip.

  • Exceptions workflow

    When a fix must wait, a documented exception with an expiry date and a compensating control.

How it works

Find, rank, fix, verify.

  1. Weeks 1–2

    Asset discovery

    We build the list of what you own, inside and out, because you cannot fix what you do not know about.

  2. Week 2

    Baseline scan

    A full first scan, cleaned of duplicates and false alarms.

  3. Weekly

    Prioritisation

    A short fix list ranked by exposure and exploit odds, not raw counts.

  4. Ongoing

    Remediation

    Your team fixes; we help with tricky patches and compensating controls.

  5. Ongoing

    Verification

    Rescans confirm each fix and close the ticket.

What you get

A short list, not a 400-page PDF.

HANULSECVulnerability management report CLIENTSample · 600-asset logistics company SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High6Medium14Low22 TREND · OVERDUE ITEMS FALLING ON TRACK Sample layout, not client data
  • 01
    Weekly prioritised fix list

    The handful of fixes that remove the most risk this week.

  • 02
    Trend dashboard

    Open findings, time to fix and overdue items over time.

  • 03
    Exception register

    Every accepted risk, its owner, its control and its expiry date.

  • 04
    Quarterly risk review

    A short call with leaders on trends, blockers and priorities.

Who it is for

For teams drowning in scan results.

  • IT teams with scanners but no time to sort the output
  • Companies that need patching evidence for ISO 27001, SOC 2, PCI DSS or regulators
  • Organisations with a growing cloud and internet footprint
  • Firms that want to meet CERT-In’s recommended patch timelines
Standards

Ranked with open standards.

CVSS and EPSSSeverity and exploit odds
CIS BenchmarksSecure configuration
CERT-InDirections and audit guidelines
ISO/IEC 27001Information security
PCI DSS v4.0Card data security
NIST CSF 2.0Govern to recover

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is the difference between vulnerability management and a pentest?
A penetration test is a deep, point-in-time attack by people. Vulnerability management is continuous and broad: it finds known weaknesses across everything you own and makes sure they get fixed. Most organisations need both.
Q02What are CVSS and EPSS?
CVSS scores how severe a vulnerability is. EPSS estimates how likely it is to be exploited in the next 30 days. Together, plus lists of flaws already being exploited, they tell you what to fix first.
Q03What patch timelines does CERT-In recommend?
CERT-In’s advisory blueprint of May 2026 recommends patching or mitigating known exploited flaws on internet-facing systems within 12 hours where feasible, critical internet-exposed flaws within a day, and high-severity flaws within five days, with other timelines in between.
Q04Do you install agents on our machines?
Only if you want them. We can use agent-based scanning, network scanning with credentials, or the tools you already own.
Q05How is it priced?
A monthly fee based on the number of assets and how often they are scanned.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings