When an assessment is the right call
An assessment suits you better than a penetration test when you need coverage rather than depth: a first look at an estate nobody has reviewed, an inventory before a compliance deadline, or a periodic sweep between deeper tests.
It is also the honest choice when you already know you have a backlog. Paying someone to prove an attacker can get in, when you have not yet patched what you know about, buys you a report you could have predicted.
Why severity ranking matters more than finding count
Any scanner can produce a list of hundreds of findings. A list that long is the same as no list at all, because nobody can act on it.
Ranking by severity means weighing how exposed the affected system is, what an attacker would gain, and how much effort the attack takes, not just copying a vendor score. The result is a short set of things to do first and a documented reason why the rest can wait.
What is reported
Each finding is written so two different audiences can use it: a summary that a manager can read to decide priority, and enough technical detail that an engineer can reproduce and fix it.
- Assessment of the systems you put in scope
- Weaknesses identified and ranked by severity
- Remediation steps for each finding
- One retest once the fixes are in
False positives are our problem, not yours
Automated tooling reports things that are not real. A finding that cannot be confirmed does not go in the report as a finding; where a result is genuinely uncertain, the report says so and says what would settle it.
This is the difference between an assessment and a forwarded scanner PDF. You are paying for the judgment applied to the output, not the output.