Guides
Get more out of every vulnerability scan.
Plain-language guides on scanner exports, prioritisation and client reporting, written for the people who have to explain the results.
- Reporting
How to turn a vulnerability scan export into a client-ready report
Which file to export from Nessus, Greenbone / OpenVAS, Qualys, Rapid7 and Nuclei, how to check it, and how to turn it into a prioritized report a client will act on.
October 17, 2026 · 4 min read - Reading scan results
How to read a Nessus scan report (and turn it into a client report)
A section-by-section walkthrough of Nessus scan results: severity, plugins, credentialed checks, VPR and CVSS, and how to turn the export into a report a client acts on.
October 17, 2026 · 5 min read - Reading scan results
Why your OpenVAS PDF report is missing CVEs (and how to fix it)
Greenbone / OpenVAS PDF reports often drop CVE details or whole results. Here is why it happens, how QoD filters hide findings, and which export to use instead.
October 17, 2026 · 3 min read - Prioritization
CVSS vs EPSS vs CISA KEV: how to prioritize vulnerabilities
CVSS measures severity, EPSS predicts exploitation and CISA KEV confirms it. What each score means, where each falls short, and a practical order for fixing vulnerabilities.
October 17, 2026 · 4 min read - Reading scan results
Credentialed vs non-credentialed vulnerability scans: what changes in your report
Authenticated scans find more and guess less. How credentialed and non-credentialed scans differ, how to spot a silent credential failure, and how to report coverage honestly.
October 17, 2026 · 3 min read - Reporting
What a vulnerability assessment report should include (with a template)
The sections every vulnerability assessment report needs, what goes in each, and the mistakes that make clients ignore them. A section-by-section template for MSPs and consultants.
October 17, 2026 · 3 min read - Prioritization
Vulnerability remediation timelines: how to set SLAs for clients
How fast should Critical, High and Medium vulnerabilities be fixed? Common remediation timelines, what frameworks require, and a starting SLA matrix MSPs can adapt per client.
October 17, 2026 · 3 min read - MSP practice
Vulnerability management for MSPs: cadence, reporting and QBRs
How MSPs turn vulnerability scanning into a repeatable managed service: scan cadence, monthly reports clients read, ticket handoff, and showing progress in quarterly business reviews.
October 17, 2026 · 3 min read - Compliance
How often should you run vulnerability scans? PCI DSS, HIPAA, CIS and insurance
Quarterly is the compliance floor, monthly is the practical baseline. What PCI DSS, HIPAA, CIS Controls and cyber insurers expect, and how to set a scan cadence per client.
October 17, 2026 · 2 min read - MSP practice
Vulnerability scan vs penetration test: what's the difference?
A vulnerability scan finds known weaknesses automatically; a penetration test proves what an attacker could do with them. When clients need each, and how to explain the difference.
October 17, 2026 · 2 min read
Have a scan export handy?
Run the free pre-flight check and see what it supports.