In short: Vulnerability management software scans devices, networks and cloud services for missing patches and misconfigurations, then prioritises what to fix. Automated penetration testing platforms go further, safely chaining weaknesses together as an attacker would to show real attack paths. Both are licensed by number of assets, IP addresses or test scope, usually annually.
Vulnerability management and penetration testing explained
Attackers routinely exploit known weaknesses: unpatched software, default passwords, exposed services and misconfigured cloud accounts. Finding them first is the job of two related kinds of software.
- Vulnerability management scans your devices, servers, network and internet-facing services, compares what it finds with known vulnerabilities, and gives you a prioritised list to fix. Agent-based scanning covers laptops wherever they are.
- Penetration testing checks whether those weaknesses can actually be used. Traditionally this is a manual engagement by a testing firm. Autonomous penetration testing platforms such as Horizon3.ai NodeZero run safe, automated attacks across internal and external networks and identity systems such as Microsoft Entra ID, showing the attack paths and proving whether fixes worked.
Patching on time is part of Cyber Essentials: high-risk and critical updates must be applied within 14 days of release. Cyber Essentials Plus adds an independent vulnerability scan and technical checks, so regular scanning is good preparation.
Vulnerability management and penetration testing: vendors and products we supply
- Absolute Security Secure Endpoint: Visibility, Control and Resilience editions compared, with Persistence.
- Bitdefender Patch Management: Automated OS and third-party application patching from the GravityZone console.
- Blackpoint Cyber: CompassOne platform with 24/7 endpoint MDR and identity ITDR from a human-led SOC.
- Blackpoint Cyber CompassOne: Essentials, Core and Standard packages: MDR and ITDR plus posture, vulnerability and SIEM.
- CrowdStrike: Falcon endpoint protection, managed threat hunting, Falcon Complete MDR, identity, SIEM and AI security.
- CrowdStrike Falcon Spotlight: Scanless, sensor-based vulnerability assessment with ExPRT risk prioritisation and patch guidance.
- Exium XDR360: SIEM, detection and response with 7 to 365 day retention.
- Horizon3.ai: NodeZero autonomous penetration testing for networks, cloud and Active Directory, per asset.
- Horizon3.ai NodeZero Core: Continuous, unlimited autonomous pentesting, scheduled and run for you, per asset.
- Horizon3.ai NodeZero Flex: On-demand autonomous pentests of networks, cloud and Entra ID, per asset tested.
- Netwrix: 1Secure data and identity security, Netwrix Auditor and PingCastle AD assessments.
- Netwrix PingCastle: Active Directory security assessments, risk scores and remediation guidance.
- Nord Security NordStellar: Dark web, data breach and attack surface monitoring, sized by monitored domains and assets.
- SentinelOne: Singularity endpoint, cloud and identity security with Purple AI and managed detection and response.
- SentinelOne Network Discovery: Find, fingerprint and block unmanaged devices using your existing agents.
- SentinelOne Vulnerability Management: Agent-based OS and application vulnerability assessment, no scanner needed.
- ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
- ThreatDown Vulnerability and Patch Management: Find vulnerable software, rank it by CVSS and deploy patches from one console, per endpoint.
- Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
- Trend Micro Cloud Security: Container Security and File Security for Kubernetes, serverless and cloud storage.
- Trend Micro Cyber Risk Exposure Management: Attack surface discovery, vulnerability risk scoring and cloud posture in one view.
What to look for
- Coverage: internal network, external attack surface, endpoints, cloud and identity
- Prioritisation that considers whether a vulnerability is being exploited in the wild, not just its severity score
- Fix guidance and verification: clear remediation steps and a retest to confirm
- Safety: automated testing must not disrupt production systems
- Integration with your patching, ticketing and endpoint tools
- Reporting suitable for management, insurers and auditors
Many organisations find that the hardest part is not finding vulnerabilities but managing them. A long list of medium-severity findings can hide the few that matter. Look for tools that group findings by fix, for example a single update that resolves dozens of issues, and that show which weaknesses an attacker could actually reach from the internet or from a compromised laptop. That makes it far easier to agree priorities with whoever handles patching, whether an internal team or an IT support provider.
How vulnerability tools are licensed
Vulnerability scanners are usually licensed by the number of assets (devices or IP addresses) scanned, often annually. Autonomous penetration testing platforms are typically licensed by the number of hosts in scope, with some plans allowing unlimited test runs within that scope over the term. Some endpoint suites include vulnerability assessment and patching as add-ons, so check what you already own first.
Make sure the licence scope matches your estate as it grows: adding a new office or cloud environment can push you into a higher tier part-way through the term.
How to choose
- Decide what you need: continuous scanning, regular automated pen tests, or both.
- Count assets in scope: servers, workstations, network devices and public IPs.
- Agree who will fix what is found; a scan nobody acts on adds little.
- Keep manual penetration testing for regulated or high-risk systems where a human tester's judgement matters, and use automation between those tests.
- Track progress over time: the number of critical findings open at the end of each month is a simple measure that management and insurers understand.
Cloud Security covers cloud security assessments and CSPM for cloud misconfiguration.
How we help
We supply vulnerability management and automated testing licences, help define the scope and can work through findings with your team. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan lists known weaknesses. A penetration test tries to exploit them, often chaining several together, to show what an attacker could actually achieve.
How often should we scan for vulnerabilities?
Continuously or at least monthly for internal systems, and whenever internet-facing services change. Critical patches should be applied within 14 days to meet Cyber Essentials.
Can automated penetration testing replace a manual test?
It can run far more often and covers common attack paths well. Many organisations still commission manual tests for specific applications, compliance needs or complex environments.