IT security: vulnerability assessments

Vulnerability assessments in Christchurch

Understand your real risk before insurers or attackers do. We scan your network, endpoints and cloud for the security gaps your antivirus and firewall miss, then hand you a prioritised, plain-English fix list your leadership team can act on. Built for Christchurch businesses of 20 to 200 staff.

Book the 15-Minute Founder Call

Or call 0800 242 206

Watch: what a vulnerability assessment actually gets you

Key points from the video:

The difference between a vulnerability assessment and a penetration test, and which one to start with.
What a proper scan checks: your network, endpoints, cloud, patching and multi-factor authentication.
The three ways assessments are priced, and how to compare quotes without getting caught out.
When a full assessment can safely wait, and the triggers that mean it cannot.

Why Christchurch businesses are turning to vulnerability assessments

Something shifted in the last few years. We used to get the call after an incident: a ransomware hit, a data breach, a client’s email account sending invoices to the wrong people. Now business owners call before anything has gone wrong, and three practical pressures drive that.

The incidents are real

CERT NZ reported over 7,100 cyber security incidents in 2022, and small and medium businesses made up a large share of them. Christchurch is not immune. The rebuild brought modern office fit-outs across the CBD, Addington and Riccarton, but a modern building does not mean modern network security. We see brand-new offices running outdated firewalls and unpatched servers every week.

Insurers and clients are asking

More Christchurch accounting firms, legal practices and insurance brokers now have to prove they have had a vulnerability assessment, because their own clients and insurers ask for it. Cyber insurance applications routinely ask for evidence. Without an assessment, cover may be refused. It is that blunt.

The Privacy Act 2020 expects it

The Act requires you to notify the Office of the Privacy Commissioner of a breach that causes serious harm. An assessment does not stop a breach on its own. It shows you knew where the gaps were and acted on them, which matters if you ever have to explain your position to a regulator.

Most of the businesses we work with are not doing this because they are scared. They want to stop guessing. They want a clear list of what is weak, what is fine and what to fix first. Most Christchurch businesses of 20 to 200 staff have never had one done properly. They assume the antivirus or the firewall covers it. It does not.

Vulnerability assessment or penetration test: which one do you need?

We get this question constantly, and it is the right one to ask before spending any money.

A vulnerability assessment scans your systems, applications and network for known weaknesses and builds a picture of where the gaps are. Think of it as a building inspection: a report showing every crack, unlocked window and spot that needs fixing, prioritised so you know what to sort first. It is broad by design.

A penetration test takes one of those cracks and tries to break through it. A tester acts like an attacker and pushes past your defences to see how far they can get. It is useful, and narrow by design. It tests specific entry points rather than mapping the whole surface.

For most Christchurch businesses running 20 to 200 endpoints, the assessment is where you start. You cannot test a door if you do not know which doors exist. Penetration testing makes sense after you have run assessments and closed the obvious gaps, as a stress test of specific controls. An assessment gives your team a roadmap: fix five things this month and ten next quarter. A penetration test gives you a story about one attack path. Both matter, at different stages.

We offer both as separate services because they solve separate problems. Most of our clients across Canterbury start with assessments on a regular cycle and add penetration testing once their posture matures. That order reduces risk and avoids paying for a report nobody acts on.

When a full vulnerability assessment can wait

Not every business needs one right now, and we would rather tell you that than sell you one.

If you had one done in the last six months and nothing major has changed, you can probably hold off. Same network, same staff count, same applications, no new cloud services or remote access points. Your existing report still has value. What matters is that someone is acting on its findings.

Small teams with a handful of devices and no server might not need a full assessment either. Five people on Microsoft 365 with multi-factor authentication and nothing on premise may be better served by a lighter security review. That describes many newer Christchurch businesses in shared workspaces around the central city, where the IT footprint is still small and simple.

Do not confuse small with safe. A business with 15 staff and one cloud app still holds client data, sends invoices and has email accounts attackers want. A full assessment might wait. Doing nothing is a different conversation.

It cannot wait when you have added new systems, changed providers, opened a second site or had a security incident. Any of those means your old picture of risk is out of date. When someone tells us nothing has changed, we usually find three things that have: new staff laptops, a SaaS tool somebody signed up for, or a firewall rule loosened for a project and never tightened.

Inside the assessment: scoping, scanning and reporting

Every assessment runs through three stages. Skip one and you get a report that is either too vague or too noisy to act on.

Scoping

We sit down with you and map what needs testing: network boundaries, cloud services, endpoints and line-of-business applications. A Christchurch accounting firm with 40 staff on a private cloud has a very different scope from a logistics company with drivers connecting from mobile devices across the Canterbury Plains. We define what is in, what is out and what matters most to your operations.

Scanning

We use a mix of automated tools and manual checks. The scanners look for known weaknesses: outdated software, misconfigured firewalls, open ports that should not be open, missing patches. Automated scanners throw up false positives constantly, so our engineers review every finding before it goes into your report. We check authentication settings, how your network segments talk to each other, and whether multi-factor authentication is enforced or only switched on in name.

Reporting

This is where most providers fall short. They hand over a 90-page PDF of severity scores and walk away. Your report ranks each vulnerability by business risk, not technical severity. A critical finding on an isolated test server is not the same as a medium one on the finance team’s shared drive. You get a summary your leadership team can read in five minutes, and the technical detail your IT staff or our managed IT team need to fix things. Every item carries a recommended action and a priority.

The whole process typically runs over a few days, not weeks, with minimal disruption to your working day.

How vulnerability assessment costs are structured

Most providers price assessments in one of three ways. Knowing the model before you sign prevents surprises on the invoice.

Fixed-fee project. A set amount for a single assessment over an agreed scope. Suits a one-off check or a report for an insurance renewal.
Recurring subscription. Assessments run monthly or quarterly as part of a managed security agreement. This is the approach we use with most clients, because threats change constantly and one scan a year does not cut it.
Per asset. You are charged by the number of IP addresses, devices or applications scanned.

Across all three, cost moves with network size and complexity, whether external systems, internal networks or both are in scope, reporting depth, and frequency. A 30-person accounting firm with one CBD office is a different job from a 150-person logistics operation with warehouse sites and remote workers on VPN. Quarterly scans cost more a year than a single engagement and far less per assessment.

Before you commit to any provider, including us, ask three questions. What is included in the report? Do they re-test after you have fixed things? Is the assessment aligned to a recognised framework such as SMB1001 or ISO 27001?

A vulnerability assessment that dumps a list of findings on your desk is not worth much. The value is in the prioritisation, the context around each finding and the clear next steps. The cheapest quote usually skips all three. We build assessments into ongoing managed security agreements so the findings get acted on rather than filed. That is the difference between a report and a result. See our vulnerability assessment cost guide for the detail.

Frequently asked questions

How long does a vulnerability assessment take for a Christchurch business?

Most assessments take between three and five business days, depending on how many devices and systems you run. A business with 20 to 50 endpoints usually sits at the shorter end. Larger setups with cloud services, remote staff and several offices take longer to scan properly. We schedule the work around your team and give you a clear timeline before we start.

What happens when your team starts a vulnerability assessment?

We scan your network, endpoints and cloud systems for known weaknesses without disrupting your staff. Most of it runs in the background, checking for outdated software, weak passwords and open ports. We do not shut down systems or take over workstations. Once scanning is done, we walk you through the findings in plain language so you know what to fix first.

Why do so many new Christchurch offices still have security gaps?

A new building does not mean new network security. Across the CBD, Addington and Riccarton, the rebuild brought modern fit-outs, but many businesses moved their old servers and firewalls straight into the new space. We regularly find brand-new offices running outdated firewall software and unpatched servers. That gap between the physical upgrade and the IT upgrade is exactly what an assessment catches.

How often should a Christchurch business repeat a vulnerability assessment?

At least once a year, or sooner if something changes. Adding cloud services, changing IT providers, opening a second site or having a security incident all reset the clock. If your last assessment was under six months ago and nothing has changed, your existing report still holds. Regular cycles matter more than one-off checks, because new weaknesses appear as your systems grow. Pairing it with dark web monitoring covers the credential side between scans.

Do we still need a vulnerability assessment if we already have cyber insurance?

Yes. Most cyber insurance applications now ask for proof you have run one before they offer cover. No assessment often means no cover, or a higher premium. Insurers want evidence you know your weak points and are working through them. The Privacy Act 2020 also expects you to show you acted on known gaps, and an assessment gives you that paper trail.

Stop guessing where your gaps are

Fifteen minutes with a founder, not a sales rep. Tell us what you run and we will tell you plainly whether an assessment is the right first step, or whether something simpler would do.