How it works

An engagement runs in five stages, from the scan exports you already have to a re-scan that confirms each closure.

Accepts exports from Microsoft Defender, Tenable/Nessus, Qualys, OpenVAS and Trivy, or any CSV

  1. Triage

    You send the exports from your current scanner. We rank every item: actively exploited and business-critical first.

    By you and Pennward

  2. Plan

    A ranked plan in plain English, with a drafted change for each item. Drafts are written with AI.

    By Pennward

  3. Approve and apply

    A person approves every drafted change before anything on your systems is altered. Your IT team applies it, or we do with your written sign-off.

    By your IT team, or us

  4. Follow up

    We follow up with whoever owns each open item until it is closed or formally accepted as a risk.

    By Pennward

  5. Re-scan and hand over

    A re-scan confirms each closure. You receive the evidence pack shown in the sample report.

    Verified by re-scan

Start with a free 15-minute review. You don’t need to send any scan data for it.

Arrange a free 15-minute review

How we decide what comes first

Every finding gets one of four levels, from two public sources (CISA’s list of vulnerabilities known to be exploited, and FIRST’s Exploit Prediction Scoring System, EPSS) and your scanner’s own severity rating.

  1. P1The vulnerability is on CISA’s Known Exploited Vulnerabilities list, so it is known to have been exploited in real attacks.
  2. P2A 10% or higher chance of being exploited in the next 30 days (its EPSS score), or rated critical.
  3. P3An EPSS score of 1% or more, or rated high.
  4. P4Everything else.

Within each level, issues on systems you tell us are business-critical come first. Both sources are public, so you can check any ranking yourself: the CISA Known Exploited Vulnerabilities catalogue and FIRST EPSS.

Questions

Who is Pennward for?

Growing UK businesses, roughly 20 to 249 staff, without an in-house security team. We work alongside your IT team or IT provider. IT providers can also bring us in for their clients: see For IT providers.

Do you need access to our systems?

No. Your IT team makes the changes, or we do with your written sign-off.

Do you put our data into an AI tool?

Only four facts about each issue: the CVE number, the software package, the version you have and the version that fixes it. Hostnames, IP addresses, system names and your company name are not among those four. Our tool also checks every value before sending, and refuses it if it looks like an IP address, is the name of one of your systems or your company, or contains any such name longer than three letters.

Drafts are written by Anthropic’s Claude through its business API, which by default does not use what we send to train its models. A person reads and approves every draft before anyone acts on it.

Where is our data kept, and for how long?

Your scan exports are processed on an encrypted computer, in a local database that is not exposed to the internet. They are used only for your engagement, and we delete them 90 days after the sprint ends. We sign a data processing agreement with you before you share any data.

Who will we deal with?

You work directly with the founder, from the first review to the final evidence pack.

What if our IT provider isn’t keen?

We don’t replace them. They get a ranked list with a drafted fix for each item, and we’re happy to talk it through with them first. If they’d rather not take part, we can apply approved changes with your written sign-off.

What if the re-scan shows an issue is still open?

It stays open. We find out why, such as an update that didn’t apply or a pending restart, and keep following it up. Only fixes a re-scan confirms count as verified.

Will this get us through Cyber Essentials Plus?

We fix the high-risk and critical security updates the assessment checks and give you evidence of what was fixed and when. Only a certification body can certify you. For Cyber Essentials assessment accounts created after 26 April 2026, the assessment fails automatically if high-risk or critical security updates are not installed within 14 days of release (IASME’s notice on the April 2026 changes).

We have a deadline. Can you work to it?

Tell us the date and we’ll say in the free review whether a 30-day sprint fits. See Deadlines.

Do you look for new vulnerabilities?

Not as a separate service. We start from what your existing scans have reported. When we close an issue, we also check where the same weakness appears elsewhere in your estate.

See pricing

Contact

Tell us what you need and we’ll arrange a free 15-minute review.

hello@pennward.co.uk

Or email us directly. Don’t attach scan exports yet; we’ll agree a secure way to share them.