A network vulnerability assessment is a structured scan of every device, port, and service on a Canadian corporate network to identify exploitable weaknesses before attackers reach them. A penetration test actively exploits findings; an assessment maps the attack surface, validates findings, and ranks risks for remediation. Canadian SMBs should run automated scans monthly and full-methodology assessments quarterly.
KEY TAKEAWAYS
- A network vulnerability assessment finds weaknesses across infrastructure before attackers do. Fixing them is separate work.
- The defensible cadence for Canadian SMBs is monthly automated scans plus a full quarterly assessment, aligned to CIS Controls v8.1.
- Tooling matters less than methodology. Any credentialed scanner works when run inside a documented 7-step process.
- Internal and external scans answer different questions. Run both, on different cadences, with different rules of engagement.
- Score by CVSS plus exploit availability plus business context. Critical and CISA KEV findings get a 72-hour SLA.
Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
What is a network vulnerability assessment, explained
According to NIST SP 800-115, vulnerability assessment is a foundational technical security testing activity that feeds higher-order assurance work. In practice it is a mostly automated review that catalogs known weaknesses, validates them, and ranks each finding by exploitability and business impact.
Those weaknesses fall into four buckets: missing patches, weak configurations, default credentials, and exposed services. The output is a prioritized remediation plan rather than a raw scanner export. A 300-row CSV handed to a Canadian SMB owner is a scan, and it is the most common thing sold as an assessment.
A penetration test is a different product. It attempts to exploit findings to prove impact across a narrow scope. An assessment maps and ranks findings across a broad asset base so an internal team or a managed provider can fix them on a defined SLA. Most Canadian SMBs need the second one working before commissioning the first.
Why network VAs matter for Canadian SMBs in 2026
According to Statistics Canada (2024), 16% of Canadian businesses were impacted by a cyber security incident in 2023, and national recovery spending doubled to CA$1.2 billion in two years. Only 59% of businesses ran any activity at all to identify their cyber security risks.
The Canadian Centre for Cyber Security flags unpatched and misconfigured network assets among the most exploited entry points, and names ransomware as the top cybercrime threat to Canada’s critical infrastructure. Cyber insurance underwriters now ask Canadian SMBs to evidence quarterly scans and documented remediation before binding coverage.
PIPEDA prescribes no scan cadence. The Office of the Privacy Commissioner has consistently treated failure to identify and remediate known vulnerabilities as a breach of the safeguarding principle when a compromise follows. CIS Controls v8.1 defines 18 controls and 153 safeguards, and Control 7 is Continuous Vulnerability Management.
CISSP-led, Canadian-owned, and running assessments for Ontario and British Columbia firms since 2012.
The 7 steps of a network VA methodology
According to the Canadian Centre for Cyber Security, its 13 baseline controls for organisations under 499 employees span MFA, patching, backups, and incident response. A defensible assessment methodology gives each of the 7 steps below a single owner, a tool, and a documented output.
Skipping a step is the failure mode that turns a scan into noise, and in our experience the 2 most commonly skipped are scope and manual validation. Scope decides what the number at the end even means. Manual validation decides whether the client trusts it.
| Step | Activity | Tool | Output |
|---|---|---|---|
| 1. Scope | Define IPs, segments, scan windows, rules of engagement | Signed RoE document | Approved scope statement. |
| 2. Asset discovery | Enumerate live hosts, ports, services across in-scope ranges | Nmap, scanner discovery scan | Asset inventory CSV. |
| 3. Authenticated scan | Credentialed scan against discovered assets for CVEs and config | Any credentialed vulnerability scanner | Raw findings export. |
| 4. Manual validation | Verify critical findings, eliminate false positives | Analyst review, Nmap NSE, manual checks | Confirmed findings list. |
| 5. Risk scoring | Apply CVSS, CISA KEV, EPSS, and business context | NVD lookups, KEV catalog | Prioritized risk register. |
| 6. Reporting | Executive summary plus technical detail per finding | Scanner reports, custom narrative | Board-ready PDF plus CSV. |
| 7. Remediation and retest | Fix on SLA, document accepted risk, rescan to confirm | Ticketing system, scanner re-run | Closed-loop evidence pack. |
Network VA tooling: what Canadian SMBs actually deploy
Five product families cover the bulk of Canadian SMB programmes, and the choice matters less than most buyers expect. Tenable Nessus leads on raw plugin coverage and is the usual first-time pick. Qualys is the cloud-native option for firms already running other Qualys modules. Rapid7 InsightVM blends scanning with attacker analytics.
Microsoft Defender Vulnerability Management is the default for Microsoft 365 E5 and Defender for Endpoint customers. It scans where the agent already lives, which removes the need for a separate authenticated scanner on a managed Windows fleet. Nmap rounds out every programme as the discovery and validation utility analysts reach for directly.
Whichever you pick, report the same 3 named numbers every cycle: findings by severity, mean time to remediate, and percentage closed inside SLA. That is the same discipline any defensible IT metrics programme applies, and it is what an underwriter reads.
Internal vs external scanning: when each is needed
Internal and external scans answer 2 different questions and need different rules of engagement. An external scan models an unauthenticated attacker on the public internet. An internal scan models a malicious insider or a foothold after a successful phish. Running only one leaves half the attack surface unscored.
| Dimension | External scan | Internal scan |
|---|---|---|
| Attacker model | Unauthenticated internet attacker | Malicious insider or post-phish foothold. |
| Targets | Public IPs, web apps, VPN concentrators, edge appliances | Workstations, file servers, AD, printers, OT, IoT. |
| Authentication | Unauthenticated by default | Credentialed, domain or local admin. |
| Cadence | Weekly or continuous | Monthly authenticated, quarterly full. |
| Typical findings | Exposed RDP, expired certs, vulnerable VPN, leaked services | Missing OS patches, weak local admins, SMBv1, stale software. |
Scanning is one discipline inside a wider network security testing programme that also covers configuration review, segmentation checks, and phishing simulation. Treat the 3 as one calendar. Our engineers found that Canadian clients who schedule them separately end up running none of them consistently. Not sure where yours stand? Get in touch.
How to score and prioritize findings
According to NIST, CVSS scores severity in the abstract, which makes it the most common scoring mistake when used alone. A CVSS 9.8 in an isolated test segment matters less than a CVSS 7.5 on an internet-facing asset holding personal information about Canadians.
Use a three-factor model instead: the CVSS base score, exploit availability from the CISA Known Exploited Vulnerabilities catalog or a public proof-of-concept, and business context covering internet exposure, data sensitivity, and recovery impact. EPSS adds a probability of exploitation in the next 30 days.
Translate the result into four SLA tiers. Critical findings get a 72-hour fix or a compensating control. High findings get 30 days, medium 90 days, and low findings ride the next maintenance window or are formally accepted with written rationale. Those tier definitions belong in the scope document, agreed before the report lands.
“Our previous provider sent us a 340-row spreadsheet every quarter and called it an assessment. Nobody read it. Grouping the same findings by software package turned it into 11 tickets we could actually close.”
Operations lead, 70-person manufacturer, Hamilton, Ontario. Anonymized at the client’s request; quote shared with permission.
Common Canadian SMB findings (the patterns)
Most first-assessment findings cluster into a small set of repeating patterns. Documenting them in advance speeds up triage and helps a Canadian owner understand why the first report looks alarming. Across our client base the same 6 patterns account for the bulk of critical and high findings at onboarding.
| Pattern | Why it appears | Typical fix |
|---|---|---|
| Exposed RDP or SMB on edge | Legacy remote access never disabled after VPN rollout | Block at firewall, force VPN plus MFA. |
| Unpatched VPN or firewall firmware | Vendor advisories not subscribed; patch fear | Subscribe to vendor PSIRT, schedule maintenance. |
| Stale Windows Server builds | Reboot avoidance on production hosts | Cluster, patch, validate, then cut over. |
| Default or shared local admin | Image-build hygiene drift | Deploy LAPS, randomize credentials. |
| SMBv1, TLS 1.0, deprecated ciphers | Legacy compatibility checkbox left enabled | Disable by policy, validate dependencies first. |
| Out-of-support OS or appliance | Capital deferral on aging hardware | Replace, isolate, or accept risk in writing. |
What a defensible assessment requires from your provider
According to the Canadian Centre for Cyber Security, ITSM.50.030 (October 2020) sets out 10 areas to assess a managed provider against, including audit reports and incident response. Four of them decide whether an assessment report is auditable at all.
An assessment report that cannot be audited is an invoice with charts. Our engineers found that Canadian providers who cannot answer all 4 questions below in a first call rarely improve after onboarding.
- A signed scope document naming IP ranges, scan windows, exclusions, and the 4 SLA tiers, agreed before the first scan.
- Manual validation of every critical finding, with the analyst named. A raw scanner export is not an assessment.
- Retest evidence, meaning a scanner re-run per closed finding rather than a ticket marked done.
- Written accepted-risk records with a named approver, a compensating control, and a review date.
Ask any Canadian provider for a redacted sample report before signing. If the sample carries no scope statement and no retest evidence, that programme will not survive an underwriter’s questions. Talk to our team if you want a second read on the last one you received.
Remediation: closing the loop
The assessment creates value only when findings close. Treat remediation as 1 tracked workstream with named owners, ticketed change requests, and a retest gate. Each closed finding gets a scanner re-run as evidence, and each accepted finding gets a written rationale, a compensating control, and a review date.
That closed-loop evidence pack is what Canadian cyber insurance underwriters and CyberSecure Canada assessors ask to see. For a Canadian SMB without an internal security team, a provider-led programme collapses scope, scan, validate, and remediate into 1 accountable workflow. We run assessments under CIS Controls v8.1, and Fusion Computing delivers PIPEDA-aligned reporting with PHIPA-aware handling for healthcare clients.
FAQ
These are the questions Canadian owners and IT managers ask most often when scoping a vulnerability assessment programme. Each answer carries a number, so you can hold a prospective provider to the same standard rather than to a description of their tooling.
How often should a Canadian SMB run a network vulnerability assessment?
The defensible cadence is monthly automated scans plus a full-methodology assessment quarterly, with extra cycles after any major change such as a new firewall, a new site, a new application, or an incident. This aligns with CIS Controls v8.1 and what Canadian cyber insurance underwriters expect at renewal.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds, validates, and ranks weaknesses across a broad asset base. A penetration test deeply exploits a smaller scope to prove real-world impact. NIST SP 800-115 frames assessments as foundational and pen tests as higher-assurance follow-on work. Most Canadian SMBs need 1 strong assessment programme before commissioning a pen test.
Which scanner is best for a Canadian SMB?
For first-time programmes, Tenable Nessus has the broadest plugin coverage and the lowest learning curve. Microsoft Defender Vulnerability Management is the right pick if the firm already runs Defender for Endpoint on every Windows host. Qualys and Rapid7 InsightVM fit organisations standardizing on those stacks. Methodology matters more than the tool.
Do internal scans need to be authenticated?
Yes. Unauthenticated internal scans miss most of the missing-patch findings and produce 2 kinds of noise, false positives and phantom hosts. Use a service account with read-only or local admin rights, scoped to the scanner appliance, with credentials rotated each cycle. Authenticated scanning generates the patch-level CVE detail that drives remediation tickets.
How should we handle findings on a system we cannot patch?
Document accepted risk in writing with a named approver, a compensating control such as segmentation or host firewalling, and a scheduled review date within 12 months. Auditors and underwriters accept residual risk on legacy systems when the decision is documented. Silent omission is what they reject.
Does PIPEDA require vulnerability assessments?
PIPEDA names no specific control. Its safeguarding principle requires security appropriate to the sensitivity of the data, and breach reporting “as soon as feasible” under s.10.1 rather than on a 72-hour clock. The Office of the Privacy Commissioner has treated failure to remediate known vulnerabilities as a safeguarding failure when a breach follows.
How do CISA KEV and CVSS work together?
CVSS scores severity in the abstract. The CISA Known Exploited Vulnerabilities catalog flags CVEs being actively used by attackers right now. A CVSS 7 listed in KEV beats a CVSS 9 that is not, for triage purposes. Treat any KEV-listed finding on an in-scope asset as a 72-hour SLA item.
How long does a network vulnerability assessment take?
For a typical Canadian SMB of 50 to 250 endpoints on a single site with 1 cloud tenant, a full first cycle runs 3 to 5 business days: 1 day scope and discovery, 1 to 2 days scanning, 1 day validation and scoring, 1 day reporting. Quarterly cycles compress to 2 or 3 days once the asset inventory stabilizes.
Can vulnerability scanning break production systems?
Default scan profiles from the major vendors are tuned to be safe on production. Fragile operational technology, medical devices, and appliances over 10 years old can still react badly. The scope document should list exclusions and a slower profile for sensitive segments. Run aggressive checks only in pre-production or with explicit written approval.
How much does a network vulnerability assessment cost in Canada?
Assessments are normally bundled into a managed cybersecurity agreement rather than priced per scan. Fusion Computing prices cybersecurity services at CA$180 to CA$250+ per user per month, and managed IT services start at CA$180 per user per month, typically around CA$230. Ask whether quarterly assessments and retests are included before comparing rates.
Related Resources
These 5 companion posts cover the adjacent Canadian disciplines. Start with the security vulnerability assessment overview when scoping a first programme.
- Managed cybersecurity services.
- Security vulnerability assessment.
- Network penetration testing.
- Infrastructure security.
- How to conduct a cybersecurity risk assessment.
Fusion Computing is a Canadian-owned managed IT and cybersecurity provider serving businesses with 15 to 200+ users since 2012. CISSP-led security leadership, CIS Controls v8.1 alignment, and a 93% first-contact resolution rate on the help desk.
