Vulnerability assessment and cybersecurity audit, in one prioritised report
A cybersecurity assessment shows where your organisation is exposed, how serious each weakness is and what to fix first. Arke Technologies, in Johannesburg, pairs vulnerability assessment software with a NIST-aligned review of controls, cloud settings and policies, and gives organisations across South Africa one prioritised, board-ready report.
What a vulnerability assessment is, and what an audit adds
A vulnerability assessment is a structured search for known weaknesses in your systems: missing patches, unsafe settings, exposed services, weak encryption and default passwords. It is often shortened to vuln assessment or VA. To describe a vulnerability assessment in one line: find every weakness you can, rate each one, and fix the ones that matter first.
Vulnerability analysis is the rating step. Each finding is scored for severity (usually with the Common Vulnerability Scoring System, CVSS), for how easily it could be exploited, and for what it would cost you if it were. A critical flaw on a test server matters less than a medium one on the system that runs payroll.
A cyber security audit asks a different question: are the controls you rely on designed properly and working? An information security audit, also called a computer security audit or IT security audit, tests policies, user access, backups, logging and change control against a framework. Our cybersecurity services combine both, because a clean scan means little if nobody checks who holds administrator rights.
Vulnerability assessment software: what the tools do, and what they miss
Tools for vulnerability assessment range from free, open-source scanners to commercial vulnerability assessment software and the vulnerability management built into Microsoft Defender for Endpoint. Each compares what it finds on your network with databases of published vulnerabilities and insecure settings.
Free vulnerability assessment tools are useful for a first look. Their limits show at scale: hundreds of findings with no view of which systems matter to your business, false positives that someone must weed out, and nobody accountable for the result.
We choose the tooling to fit your estate and licences, run it with agreed credentials, and validate findings before they reach your report. If you already hold Microsoft Defender licences, we use the vulnerability management you have paid for rather than add another product.
Cloud vulnerability management in Azure and AWS
Cloud vulnerability management in Azure and AWS is as much about configuration as patching. Microsoft Defender for Cloud provides cloud security posture management for Azure, and for connected AWS and Google Cloud accounts, flagging open storage, exposed management ports and missing encryption. That Microsoft cloud security posture management, with the Azure vulnerability assessment solution Defender offers for virtual machines and container images, gives us a continuous baseline.
For Azure vulnerability management and AWS vulnerability management we also review identities, permissions, logging, backup and encryption, and map results to the CIS Benchmarks so your cloud team gets fixes it can apply. Planning a move? Our Microsoft Azure and AWS services build these controls in from the start.
Cybersecurity risk management aligned with the NIST framework
An assessment is only useful if it feeds decisions, so we report against the frameworks your board, auditors and insurers recognise:
NIST Cybersecurity Framework. Version 2.0 of the framework, published by NIST in 2024, organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. We score your maturity in each, giving the board one view of cybersecurity risk management.- ISO/IEC 27001. Findings map to the Annex A controls, so the assessment doubles as a gap analysis for ISO 27001 readiness.
- CIS Controls. A prioritised set of safeguards that turns findings into an ordered work plan.
- Cyber Essentials. The UK's Cyber Essentials scheme rests on five technical controls (firewalls, secure configuration, user access control, malware protection and security update management), all tested in our CIS-based review; certification itself comes from UK certification bodies.
- POPIA. Section 19 requires appropriate, reasonable technical and organisational measures to protect personal information. The assessment tests yours, and our POPIA compliance service closes the gaps.
- King IV, PFMA and MFMA. Principle 12 of King IV asks governing bodies to govern technology and information; public-sector clients also answer to the PFMA or MFMA and to the Auditor-General. The report can go to an audit and risk committee unchanged.
Security risk management is continuous: deciding which risks to treat, transfer, avoid or accept, with a cybersecurity risk assessment as the evidence for each decision. Our IT governance, risk and compliance service runs that wider information security risk management programme.
What a vulnerability assessment sample report contains
Before you buy, ask any provider what its report contains; the report is the product. Ours includes:
- Executive summary. One page for the board: the overall risk rating, the priorities to fix first and the trend since the last assessment.
- Scope and method. What was tested, when, with which credentials and tools.
- Findings workbook. Every finding with the affected asset, severity, evidence, recommended fix, suggested owner and target date.
- Threat and vulnerability assessment register. If you already use a threat vulnerability assessment template, we populate yours; otherwise we supply one with asset, threat, vulnerability, likelihood, impact, risk rating and treatment columns.
- Control gap map. Results against the NIST framework, ISO/IEC 27001 and POPIA.
- Remediation roadmap. Quick wins, 90-day work and items that need budget, so finance can plan.
- Retest record. Evidence of what has been closed, and when.
From one-off assessment to vulnerability management
A vulnerability assessment is a snapshot, and new flaws are published every week. Vulnerability management in cyber security is the continuous cycle of scanning, prioritising, patching and verifying. Threat and vulnerability management adds threat intelligence, so a flaw attackers are already exploiting jumps the queue.
For clients on our managed detection and response or managed IT services, we run that cycle as a vulnerability management system: scheduled scans, patching under change control, exceptions recorded with an owner, and a monthly report of open findings by age and severity. Open findings become a number your risk committee can track by age, rather than a surprise at audit time. If a scan shows an attack under way, our incident response team takes over.
Governance, audit evidence and procurement
- Cyber security audit and compliance evidence. Findings, dates and retest results are kept as evidence for internal audit, external auditors and the Auditor-General.
- Confidentiality. Everyone with access to your systems is bound by confidentiality and our security controls. Findings go only to the people you name, and every remote session is approved and logged.
- Ownership. You own the report, the findings workbook and the raw scan data. Accounts created for the assessment are removed when it ends.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete standard bidding documents (SBD forms) when a bid requires them. See our company facts.
- Buying route. Scoping call, proposal and purchase order, or a response to your tender. Cybersecurity audit services and cybersecurity assessment services can also recur annually under a managed-service SLA.
- Continuity. Each report keeps the same structure and finding references, so the next assessment measures the trend against this one, whoever performs it.
What a cybersecurity assessment costs
We quote each cybersecurity assessment as a project after a scoping call, because two organisations with the same headcount can run very different estates. What drives the cost:
- the number of IP addresses, servers and endpoints in scope;
- how many websites and web applications need scanning;
- the number of cloud subscriptions and Microsoft 365 or Google Workspace tenants;
- on-site visits or remote work;
- the depth of the controls and policy review; and
- whether a retest and a board briefing are included.
For context, published rates for IT project work in South Africa run from about R550 to R750 an hour ex VAT (matnet.co.za, September 2026). For testing costs, see our guide to penetration testing cost in South Africa.
Last reviewed: September 2026.
Vulnerability assessment in disaster management and climate change
The same words mean something different in disaster management. A disaster risk and vulnerability assessment, or a climate risk vulnerability assessment, measures exposure to hazards such as floods, drought and heat, and underpins municipal disaster management plans. Vulnerability assessment in disaster management and for climate change is a specialist planning discipline, and we do not offer it.
The two meet in IT continuity: a municipality that has assessed its exposure to floods or long power outages needs systems that survive them. We design backup and disaster recovery for exactly that, and support municipalities with the IT side of continuity planning.