Most organizations have antivirus, a firewall, and some form of cybersecurity in place. Almost none of them can tell you, with any confidence, what their actual vulnerabilities are. That gap between feeling secure and being secure is what a vulnerability assessment is designed to close. The question is whether your organization needs one. Here is how to tell, and what you should expect to find when you do.
Contents
How to know if your organization needs a vulnerability assessment
There are a handful of signals that come up consistently across the organizations we work with. None of them are technical on the surface. Most of them are questions that leadership teams should be able to answer about their own organization, but often cannot.
You have not seen a vulnerability report in the past year
If you are an executive director, a CFO, a board member, or in any leadership role, ask yourself when you last received a written report on your organization’s cybersecurity vulnerabilities. Not a status update. Not a verbal assurance from your IT team. An actual document that shows what is exposed, what is at risk, and what is being done about it.
If you cannot remember the last time you saw one, or if the answer is never, that is a strong signal. You are accountable for organizational risk. Without that visibility, you are making decisions without the information you need.
Your IT team or provider has not run a vulnerability scan in the past quarter
This is a more direct question to ask. Your internal IT team or your managed service provider should be able to confirm, with specifics, when the last vulnerability scan was conducted and what it found. If the answer is vague, or if it has been more than a few months, your environment has likely accumulated new vulnerabilities that nobody has identified.
Vulnerability scans need to run on a regular cadence because IT environments change constantly. New computers are added. Employees join and leave. Software is updated, or worse, falls out of date. Microsoft and other vendors release patches every month. A scan that was run a year ago does not reflect what your environment looks like today.
You rely on tools, not on testing
There is a common pattern we see in organizations that have not done a vulnerability assessment. They have invested in security tools. Antivirus on every computer. A firewall at the perimeter. Maybe multifactor authentication. Maybe endpoint detection software.
These tools matter. But they are protective layers, not diagnostic ones. They are designed to block threats, not to tell you whether your environment is configured properly in the first place. A password policy that is not being enforced. An operating system that stopped receiving security updates. A setting inside your Microsoft 365 tenant that allows attackers to bypass your multifactor authentication. None of those things are caught by your antivirus or your firewall. They require a scan that is looking for them specifically.
Your cyber insurance renewal is coming up
Cyber insurance providers are tightening their underwriting requirements. Many policies now require evidence of an active vulnerability management program. A self-reported questionnaire is increasingly not enough. Insurers want to see documented evidence that your organization actively identifies and remediates vulnerabilities on a regular basis.
A vulnerability assessment provides exactly that documentation, and it does so in a format that insurers, auditors, and boards understand. If your renewal is approaching, this is a good time to get ahead of it.
You operate in a regulated or compliance-sensitive environment
Organizations in healthcare, long-term care, financial services, education, and government carry an additional layer of obligation. Regulatory frameworks generally require organizations to actively manage cybersecurity risk and to be able to demonstrate that they are doing so. A vulnerability assessment produces the kind of documented, prioritized risk evidence that compliance reporting requires.
Even in non-regulated environments, the underlying principle holds. If your organization holds sensitive data, whether that is client records, employee information, financial data, or proprietary business information, you have a responsibility to know where it might be exposed.
You have grown, restructured, or migrated recently
Mergers, acquisitions, office moves, cloud migrations, and rapid growth all introduce vulnerabilities. New systems are connected to old ones. Permissions get duplicated. Accounts created during a transition get forgotten about. A vulnerability assessment is the most efficient way to identify what came along with the change and what got left in an insecure state.
What a vulnerability assessment actually finds
Reading about warning signs in the abstract is useful, but it does not show you what is actually at stake. To make this concrete, here is what we found in a recent engagement with a long-term care organization in the Greater Toronto Area. The findings below are drawn directly from the scan results. The organization’s identity has been redacted, but the numbers are real.
Compromised credentials circulating on the dark web
The scan identified five staff email accounts with passwords actively listed on the dark web. The most recent compromise had occurred only weeks before we ran the assessment. The organization had no idea. No alert had fired. No security tool had flagged it.
Dark web exposure of credentials is one of the highest-risk findings a scan can produce. A valid username and password gives an attacker the same access as the employee whose credentials were stolen, and unless multifactor authentication is properly configured and enforced, the attacker can simply log in. In this case, the scan caught it because it was actively searching for it. Otherwise, the organization would not have known until those credentials were used against them.
Risk score: 100 out of 100.
Computers running an unsupported operating system
The same scan found 32 computers still running Windows 10, an operating system that Microsoft no longer issues security patches for. Every one of those machines had antivirus installed and active. It did not matter. The operating system itself was the vulnerability. No antivirus can patch a vulnerability in an unsupported OS, because there is no patch.
This is the kind of finding that quietly accumulates over time. Computers get replaced gradually. Older models stay in service longer than they should. Nobody at the leadership level is tracking which devices are running what version of which operating system. A scan catches it in minutes.
Risk score: 97 out of 100.
Microsoft 365 legacy authentication protocols still enabled
The scan found that the organization’s Microsoft 365 tenant was still allowing legacy email protocols such as IMAP and POP3. These are older ways of connecting to email that do not support multifactor authentication. Even though the organization had MFA enabled across their tenant, an attacker could bypass it entirely by using one of these older protocols to authenticate.
This finding affected 174 users. It is exactly the kind of vulnerability that an antivirus cannot detect, because it is not a virus or a malicious file. It is a configuration setting inside the M365 environment that needs to be found and corrected manually.
Risk score: 90 out of 100.
Account lockout disabled across the network
On 219 of the organization’s computers, account lockout was not enabled. That means an attacker could try unlimited password guesses on any account on any of those machines without ever being blocked. A brute force attack that would normally fail against a properly configured network would succeed against this one.
This kind of setting is easy to overlook because it is not something that produces an obvious symptom. Computers work normally with or without it enabled. The vulnerability is invisible until it is exploited.
Risk score: 77 out of 100.
Service accounts with passwords set to never expire
The scan identified 29 service accounts whose passwords were set to never expire. Service accounts are used by systems and applications to communicate with each other, and they often have elevated privileges. A service account with a permanent password becomes a permanent vulnerability. If the password is ever compromised, the attacker has indefinite access.
Risk score: 30 out of 100.
Every one of these vulnerabilities had something in common. None of them were caused by a hacker. None of them were active attacks. They were all configurations, settings, or accumulated debt that had been sitting in the environment for months or years. The organization had antivirus. They had a firewall. They had multifactor authentication turned on. They had what they reasonably believed was a secure setup.
They also had no way of knowing what they did not know. That is what a vulnerability assessment provides. Not protection, not remediation, but visibility. Once you can see the gaps, you can decide what to do about them. Without that visibility, you are managing risk by hoping it does not materialize.
If any of the warning signs earlier in this article apply to your organization, it is worth taking the next step. More information, including pricing, a detailed video walkthrough, and answers to frequently asked questions, can be found on our vulnerability assessment page.