Overview
Several US rules expect scanning on a schedule. PCI DSS requires quarterly internal and external scans, with external scans by an Approved Scanning Vendor. The FTC Safeguards Rule expects vulnerability assessments at least every six months unless you run effective continuous monitoring, and NYDFS Part 500 requires vulnerability management including automated scans. A managed program keeps you on schedule. We are not an ASV.
Thousands of new vulnerabilities are published every year. Without a program, teams drown in scanner output while the issues that matter go unpatched. A managed vulnerability program turns that noise into a prioritized, tracked list of fixes.
We discover your assets, run authenticated scans of infrastructure and applications on a regular schedule, validate findings manually to remove false positives, and prioritize using exploitability, exposure and business context — not CVSS alone.
Periodic penetration tests (VAPT) then go deeper on your highest-risk systems, so you get both breadth and depth in one program.
How our managed services work for US organizations
- Round-the-clock cover through US nights, weekends and holidays, when in-house teams are offline
- Escalations to your named contacts by phone, email, Slack or Microsoft Teams, following agreed severities
- Monthly service reviews scheduled around your US time zone, with evidence packs for SOC 2, HIPAA and PCI DSS
- Delivered remotely from India, with data-handling terms agreed in the contract before onboarding
What's included
Our approach
- BaselineAsset inventory and first full scan with validated findings.
- Risk modelAgreed asset criticality, severity thresholds and fix-time SLAs.
- Recurring cyclesWeekly or monthly scanning with validated deltas.
- Manual VAPTPeriodic penetration tests of the highest-risk systems.
- Executive reportingTrends, SLA performance and risk reduction over time.
What you receive
- Validated vulnerability register
- Monthly risk and trend report
- Remediation SLA tracking
- Periodic penetration test reports
- Audit evidence for vulnerability management controls
Standards & frameworks
- ISO/IEC 27001 A.8.8
- PCI DSS 11.3 & 11.4
- CIS Control 7
- NIST CSF 2.0
- FTC Safeguards Rule 314.4(d)(2)
- CISA KEV catalog
Frequently asked questions
What is VAPT?
Vulnerability Assessment and Penetration Testing combines broad automated scanning with manual exploitation of the most important findings.
How often will you scan?
Typically weekly or monthly depending on your risk and compliance requirements; PCI DSS requires at least quarterly internal and external scans.
Do you fix the vulnerabilities?
We prioritize and guide remediation, and can apply fixes through our patch management service where agreed.
Can you support US organizations from India?
Yes. All services are delivered remotely by our team in India. India is 9.5 hours ahead of US Eastern time during US daylight saving time (10.5 hours in winter) and 12.5 to 13.5 hours ahead of Pacific time. Meetings and testing windows are agreed around your US time zone at scoping, and 24/7 services run around the clock.
Where is our data processed?
Engagement data is handled by our team in India under NDA, with encrypted storage, least-privilege access and secure deletion at the end of the agreed retention period. Data-handling terms are agreed in the contract. If you need something specific, such as US-only data residency or a business associate agreement, raise it at scoping and we'll tell you plainly whether we can meet it.