· NorthSecure AI
“We need a security test” is a starting point, not a scope. Before comparing proposals, name the decision you need to make: identify possible weaknesses, prioritize current exposure, demonstrate whether an attack path works, or verify that earlier findings were fixed. These are different outcomes. The methods may overlap, but one deliverable should not silently stand in for another.
| Your question | Likely work | What to specify before purchase |
|---|---|---|
| “What known technical issues might exist on these assets?” | Vulnerability scan | Exact assets, credential level, scan frequency, validation of false positives, and who reviews the results. |
| “What is our current exposure within a defined public footprint, and what should we fix first?” | Scoped external security assessment | Authorized domains and IPs, business context, evidence sources, analyst review, report audience, and prioritization method. |
| “Can a tester demonstrate a viable attack path?” | Penetration test | Written authorization, rules of engagement, permitted techniques, exclusions, safety contacts, and evidence handling. |
| “Were the findings from the earlier report actually addressed?” | Remediation validation or retest | The earlier findings, changed assets, required evidence, validation depth, status labels, and whether a new current-state review is also needed. |
What a scan answers
A vulnerability scan uses tools to look for defined signs of weaknesses, missing patches, and exposed services. It is useful for repeatable coverage, but its results require interpretation. A scan finding may be a false positive, may lack business context, or may miss a weakness outside the tool's checks. A clean scan does not prove an environment is secure. The Canadian Centre for Cyber Security's guidance on vulnerability monitoring and scanning calls for analysis of scan reports and legitimate findings, not just running a tool.
What an assessment answers
“Assessment” is a broad term, so ask what the provider will examine and deliver. NorthSecure AI's published External Security Assessment covers an agreed public-domain and IP scope, analyst-reviewed findings, an executive report, a technical appendix, and a prioritized remediation roadmap. Its checks are authorized, controlled, and non-destructive. It is not a penetration test. The smaller External Security QuickCheck is a limited snapshot for up to one primary public domain; it is a different scope.
A current-state report describes what is found within its agreed scope at the time of review. It does not automatically provide finding-by-finding status against an earlier assessment. That comparison requires the old report, a mapping of each finding to today's assets, an agreed validation method, and separate authorization where needed.
What a penetration test answers
A penetration test uses skilled testers to investigate whether weaknesses can be exploited within defined constraints. It goes beyond automated scanning and may involve attack-like activity. The Canadian Centre for Cyber Security distinguishes penetration testing from scanning and calls for agreed rules of engagement. If a contract, insurer, or customer specifically requires a penetration test, confirm the required method and evidence. Do not substitute a non-destructive assessment and call it equivalent.
What remediation validation answers
After remediation, the useful question may be: “Which original findings are resolved, partially resolved, still present, or unable to be verified?” A validation exercise compares the earlier evidence and affected assets with agreed present-day checks. The result may differ from a new current-state assessment: an old finding can be closed while a new issue appears elsewhere, or the original asset may no longer exist. Status labels, proof thresholds, changed asset ownership, and permitted testing depth need to be agreed before work begins. NorthSecure AI's published External Security Assessment does not include this finding-by-finding comparison. Whether separate validation work is feasible must be confirmed before any proposal promises it.
Five questions to put in the request for proposal
- What decision must the report support, and who will use it?
- Which domains, IPs, applications, cloud services, and third-party assets are in scope? Who can authorize testing of each?
- Is the requested outcome a current-state view, exploitability demonstration, prior-finding validation, or a combination?
- Which techniques are permitted, and what are the operational safety and evidence-handling rules?
- What will the deliverable contain, what is excluded, and who owns remediation and any later retest?
If you are a Canadian organization seeking a current view of public-facing exposure, request a scoped assessment. Tell us the decision you need to make and whether a previous report needs validation. Do not send credentials, detailed findings, or sensitive technical records through the website form. We will clarify fit and scope before work begins.
Need a current view of your public-facing exposure? Tell us the decision your report must support.
Request a scoped assessment