Vulnerability & Patch Assurance : Found, fixed, and proven fixed.
A scanner tells you what is exposed. Assurance tells you whether it got fixed, whether the patch cycle is really being met, and gives you the evidence to show it. Golonex runs that cadence on the tools you already own — and scopes a penetration test when your framework calls for one.
Part of security assurance. Golonex runs the cadence and keeps the evidence; the scanner and the patching stay with you or your vendor, overseen by the seat.
Every month, on a cycle you can show an assessor.
Continuous scanning
External and, where in scope, internal and cloud scanning on a schedule, so new exposures are found between assessments rather than at the next one.
Triage and ownership
Findings de-duplicated, severity-rated against your environment, and assigned to a named owner with a due date set by your policy.
Patch verification
The patch cycle checked independently — what should have been applied against what was — with exceptions tracked to closure.
Cloud configuration review
AWS, Azure, and Google Cloud posture checked against CIS benchmarks as part of the cycle: exposed storage, over-privileged roles, missing encryption.
Retests
Critical and high findings retested after the fix and confirmed closed in writing — not just marked done in a ticket.
Evidence
Scan coverage, findings, patch compliance, and retests mapped to your framework and kept in the evidence pack.
Where managed infrastructure runs your estate, patch assurance verifies its work independently — the same evidence, two sets of eyes.
Named testers. A report you can hand to a customer.
Not a standing product. When your framework, a prime, or a customer requires a penetration test, it is scoped on discussion and run as a fixed engagement inside this service.
Scoping
Targets, rules of engagement, timing, and success criteria agreed before any test runs.
Manual testing
Named testers work the things scanners miss — business logic, chained weaknesses, authentication and session handling.
Findings and debrief
Every finding severity-rated with a proof of concept and a specific fix, walked through live with your technical team.
Retest and letter
Critical and high findings retested after remediation, and a letter suitable for your auditors and customers issued at close.
A trend, not a snapshot.
- Monthly report: new, open, and closed findings, patch compliance, and the trend
- Written retest confirmation for every critical and high finding
- Findings mapped to NIST 800-171, ISO 27001 Annex A, or PCI DSS
- Where scoped: a penetration test report and attestation letter for auditors and customers
Vulnerability & patch assurance — your questions, answered
Do you do penetration testing? +
Where your framework or a customer requires it, yes — scoped on discussion as part of this service, with named testers, a findings report, and a retest after fixes. The standing work is the continuous part: scanning, patch verification, and retests every month. Red and blue teaming are not a product we sell.
What is patch assurance? +
Independent confirmation that the patch cycle your framework expects is actually being met — by your IT team, your MSP, or managed infrastructure. We compare what should have been patched against what was, report the exceptions, and track them to closure.
Does this replace our vulnerability scanner? +
No. We run the programme on the scanner you have or one we recommend; the licence is yours. What you get from Golonex is the cadence, the triage, the verification, and the evidence — not a product.
Can we start with the external perimeter only? +
Yes. Most engagements start with internet-facing systems and web applications and add internal networks, cloud configuration, and mobile applications in later cycles, as the framework or the risk requires.
What do we receive each month? +
New and closed findings, patch compliance against the cycle, retest confirmations, and the risk trend — written so it drops into your evidence pack and maps to NIST 800-171 3.11 and 3.14, ISO 27001 A.8.8, or PCI DSS 6 and 11.
Who runs it? +
A named Golonex engineer owns the cadence, with a second briefed for cover. A penetration test, where scoped, is a team of named testers for that engagement.
How is it priced? +
Fixed monthly pricing by seat, dedicated or fractional, set before the month starts; a six-month minimum for the engineer seat. A scoped penetration test is priced as a fixed engagement.
Know what is still open — and prove what is closed.
Bring your last scan and your patch policy. Thirty minutes tells you where the gap between the two sits.
Managed delivery — seven practices · All managed delivery →
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
04Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
You are here
Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work