What Does a Cybersecurity Vulnerability Scan Cost?
Quick Answer
For a small UK business, the cost of a cybersecurity vulnerability scan can range from a relatively inexpensive automated scan to £1,000 or more for a properly reviewed vulnerability assessment.
The price depends mainly on:
How many computers, servers and devices need checking
Whether you need an external scan, internal scan or both
Whether cloud services are included
Whether websites or web applications need testing
Whether a cybersecurity professional reviews the results
Whether you need help fixing the problems afterwards
At Systems Secure, our cybersecurity consulting rate is £760 + VAT per day.
For a typical small-business vulnerability assessment, one to two days of work is often a sensible starting point, putting the likely cost at around:
£760 + VAT for one day
or
£1,520 + VAT for two days
The important thing is understanding what you are actually getting for that money.
A £100 automated scan and a £1,000 vulnerability assessment might both be described as a "security scan", but they are not necessarily the same service.
What is a cybersecurity vulnerability scan?
A vulnerability scan looks for known security weaknesses in your computers, servers, network equipment and other systems.
This might include things such as:
Missing security updates
Outdated software
Vulnerable services
Weak security configurations
Unnecessary services exposed to the internet
Known vulnerabilities in operating systems and applications
Network devices that should not be publicly accessible
The National Cyber Security Centre describes vulnerability scanning as an automated way of detecting security weaknesses and says it can provide a cost-effective way of finding common security problems.
https://www.ncsc.gov.uk/guidance/vulnerability-scanning-tools-and-services
The scanner compares what it finds against large databases containing known vulnerabilities.
But running the scanner is only part of the job.
Why do vulnerability scan prices vary so much?
Because the words "vulnerability scan" can describe several very different services.
At the cheapest end, somebody might simply run an automated scanner and send you the report.
At the other end, a cybersecurity consultant might:
Work out what systems you actually have
Decide what should be scanned
Carry out external and internal scans
Review the results
Remove false positives
Investigate unusual findings
Assess which vulnerabilities actually matter
Explain the risks in plain English
Prioritise what should be fixed first
Work with your IT provider to resolve them
Rescan afterwards to confirm the fixes
The computer might perform the scan.
The value comes from understanding the results.
What affects the price?
How many devices do you have?
A company with:
8 laptops
One router
Microsoft 365
No servers
is very different from a business with:
60 computers
Multiple servers
Several offices
Firewalls
Remote-access systems
Cloud servers
Public-facing applications
The larger the environment, the more there is to discover, scan and investigate.
Are you scanning externally or internally?
This is an important distinction.
External vulnerability scanning
An external scan looks at your business from the internet.
It is essentially asking:
"What can someone outside my business see and potentially attack?"
That might include:
Firewalls
VPN services
Remote-access systems
Websites
Servers
Other internet-facing services
This is useful because these are systems attackers can potentially reach without already being inside your network.
Internal vulnerability scanning
An internal scan looks at devices inside your organisation.
For example:
Computers
Servers
Printers
Network equipment
Other connected devices
This can uncover vulnerabilities that wouldn't necessarily be visible from the internet.
Both views are useful.
They answer different questions.
Why not just buy the cheapest scan?
There is nothing inherently wrong with automated vulnerability scanning.
In fact, the NCSC recommends regular vulnerability scanning as part of a vulnerability management programme. It recommends organisations carry out vulnerability assessments across their estate at least monthly.
The problem is what happens after the scanner finishes.
You could receive a report containing:
247 vulnerabilities
That sounds terrifying.
But those findings might include:
5 genuinely serious problems
20 things worth fixing
100 low-risk issues
Duplicate findings
Issues that don't apply to your environment
False positives
A business owner shouldn't be expected to work that out.
What should I get for my money?
A useful vulnerability assessment shouldn't simply give you a 150-page technical report and wish you luck.
You should be able to answer:
What did you find?
How serious is it?
What should I fix first?
How do I fix it?
What can wait?
For a small business, I would expect a good report to separate findings into something like:
Critical
Deal with these immediately.
High
Important vulnerabilities that should be addressed quickly.
Medium
Problems that should be planned for and corrected.
Low
Lower-risk improvements and housekeeping.
There should also be an explanation of why each finding matters to your particular business.
A vulnerability scanner can be wrong
This is another reason human review matters.
Automated vulnerability scanners sometimes produce false positives.
A scanner might believe a device is vulnerable when it isn't.
The opposite can also happen.
A clean vulnerability scan does not guarantee that a business is secure.
The NCSC specifically warns that automated scanners cannot detect every vulnerability and that they do not provide the same depth as appropriately skilled human testing.
That doesn't make vulnerability scanning useless.
It just means you need to understand what the tool can and cannot tell you.
Is a vulnerability scan the same as a penetration test?
No.
These are often confused.
A vulnerability scan primarily looks for known weaknesses.
A penetration test goes further.
During a penetration test, a security professional actively investigates whether weaknesses can be exploited and what an attacker might be able to achieve.
That requires considerably more manual work.
As a result, penetration testing normally costs more than vulnerability scanning.
For many small businesses, starting with a vulnerability assessment makes sense.
If something particularly important or unusual is identified, more focused testing can then be considered.
What about a £20 or £50 online vulnerability scan?
You'll find extremely cheap scanning services online.
Some are perfectly legitimate.
But understand what you're buying.
A very cheap service is likely to be highly automated.
You may receive information about your public IP address or website, but that doesn't necessarily mean your business has been assessed.
Think of it like plugging a car into a diagnostic computer.
The computer can identify problems.
But somebody still needs to understand what those results mean and decide what needs fixing.
Cybersecurity scanning is similar.
Can I run vulnerability scanning myself?
Yes.
There are both free and commercial vulnerability scanning tools available.
The NCSC provides guidance specifically designed to help organisations choose vulnerability scanning products and services.
https://www.ncsc.gov.uk/guidance/vulnerability-scanning-tools-and-services
Running the software isn't necessarily difficult.
The harder questions are:
What should I scan?
Did I scan everything?
Is the finding genuine?
How serious is it?
Could fixing it break something?
What should I fix first?
Has the problem actually been resolved?
That is where experience becomes useful.
How often should a business run vulnerability scans?
Not just once.
New vulnerabilities are discovered constantly.
Software changes.
New devices appear.
Configuration changes are made.
The NCSC recommends vulnerability assessments across an organisation's estate at least monthly, with more frequent assessments considered for particularly exposed systems.
That doesn't necessarily mean paying a consultant £760 every month.
A sensible arrangement might involve automated scanning being performed regularly, with professional review when important findings appear or as part of a scheduled cybersecurity review.
The right approach depends on the business.
Does Cyber Essentials include a vulnerability scan?
This depends on which certification you mean.
The basic Cyber Essentials certification is a verified self-assessment and does not include an additional vulnerability scan.
Cyber Essentials Plus includes technical testing, including vulnerability scanning as part of the assessment.
IASME, which operates Cyber Essentials on behalf of the NCSC, confirms this distinction in its current guidance.
https://iasme.co.uk/cyber-essentials/frequently-asked-questions/
So if somebody tells you:
"We've got Cyber Essentials, so we've already had a vulnerability scan."
that isn't necessarily correct.
Do I need a vulnerability scan if I already have an IT company?
Possibly.
Your IT company may already perform vulnerability scanning or use systems that identify vulnerabilities.
Ask them.
A useful question would be:
"Do you regularly vulnerability-scan our computers, servers and internet-facing systems, and can you show me the results?"
If they do, great.
There is no point paying someone else to unnecessarily duplicate work.
If they don't, you can have an independent cybersecurity company carry out the assessment and pass the findings to your existing IT provider.
Your IT company can then fix the problems.
You don't need to replace them.
Is a vulnerability scan worth paying for?
If you've never had one done, usually yes.
You can't fix a vulnerability you don't know exists.
One of the benefits of scanning is that it can uncover relatively ordinary problems before somebody takes advantage of them.
Things such as:
A forgotten server
An old VPN service
An unpatched computer
An exposed remote-access service
Unsupported software
A firewall service that shouldn't be public
None of these sounds particularly dramatic.
But attackers frequently exploit ordinary vulnerabilities rather than using some ingenious new hacking technique.
The NCSC describes regular scanning as an important part of understanding the risks facing an organisation.
What should I ask before paying for a vulnerability scan?
Before agreeing to anything, ask exactly what is included.
I would ask:
Are you scanning internally, externally or both?
How many devices are included?
Are servers included?
Are firewalls and network devices included?
Are cloud systems included?
Will a cybersecurity professional review the results?
Will false positives be investigated?
Will you explain what needs fixing?
Will findings be prioritised?
Is remediation included?
Will you rescan afterwards?
Will you work with my existing IT company?
Those questions make comparing quotes considerably easier.
Otherwise you could be comparing two completely different services.
How much should my small business budget?
For a straightforward small-business assessment, I would budget around one to two days of professional cybersecurity time rather than simply looking for the cheapest automated scanner.
At Systems Secure, that means approximately:
Assessment | Typical cost |
|---|---|
One day | £760 + VAT |
Two days | £1,520 + VAT |
The actual amount of work depends on what needs scanning and how complicated the environment is.
A ten-person Microsoft 365 business with laptops and one office is going to require a very different assessment from a 50-person business with multiple locations, servers and externally accessible systems.
That's why I would want to understand the environment before telling somebody exactly what they need.
What to do next
Before buying anything, start with your existing IT company.
Ask them:
"When was our last vulnerability scan, what did it cover, and can I see the results?"
You may discover that vulnerability scanning is already included in the service you're paying for.
If it isn't, or you would like an independent cybersecurity assessment, Systems Secure can review your environment and explain what we find in plain English.
We don't replace your IT company or provide general IT support.
We specialise in cybersecurity and are happy to work alongside whoever already manages your IT.
Systems Secure
In short
Vulnerability scan prices depend heavily on what is being tested
A cheap automated scan is different from a professionally reviewed assessment
External and internal scans find different types of weakness
A scanner can produce false positives, so human review matters
A vulnerability scan is not the same as a penetration test
The NCSC recommends vulnerability scanning as part of an ongoing vulnerability-management process
Basic Cyber Essentials does not include a vulnerability scan, although Cyber Essentials Plus includes technical testing
Ask your existing IT provider whether they already scan your systems
For a typical small-business professional assessment, £760–£1,520 + VAT is a sensible guide based on one to two days of Systems Secure consulting time
I particularly like this one because it can rank for the price question, while the article itself teaches the owner why a £49 scanner report and a proper vulnerability assessment shouldn't be compared purely on price.
