Vulnerability Management & Penetration Testing

What this covers

Vulnerability management is the ongoing discipline of finding, prioritizing, and fixing weaknesses. Penetration testing is a point-in-time exercise that shows how those weaknesses could be chained together by an attacker. Agencies need both.

Typical activities

• Deploying and tuning vulnerability scanners for internal, external, and cloud assets
• Risk-based prioritization that accounts for exploitability and asset criticality
• Patch process design and metrics
• External, internal, web application, and wireless penetration testing under a written rules of engagement
• Phishing simulations and social engineering tests, where authorized
• Retesting to confirm remediation

What you receive

Scanner configuration and reporting, a prioritized remediation backlog, penetration test reports with reproduction steps and evidence, and retest confirmation.

Considerations for public agencies

Testing is performed only under written authorization from the agency, with scope, timing, and emergency contacts agreed in advance. Reports are handled as sensitive security information.

Signals that this work is needed now

An agency can check these without hiring anyone.

• Producing a current list of internet-facing addresses and administrative interfaces takes several phone calls and still leaves gaps.
• Scanning is unauthenticated only, so results describe what an outsider sees and say little about unpatched software on servers and workstations.
• Remote access, VPN, or managed file transfer appliances sit at the network edge, a category that has repeatedly drawn emergency, out-of-cycle vendor patches.
• Patch work is tracked in email threads rather than in a backlog with named owners, due dates, and evidence of completion.
• A compliance driver already applies: card payments for utility billing or recreation put part of the network in PCI DSS scope, federal tax information brings IRS Publication 1075 obligations, and criminal justice information brings the CJIS Security Policy.
• The last test looked only at the perimeter, while the realistic path in is a phished employee on a flat internal network.

Where this fits with services you already have

Most agencies are not starting from zero. CISA has offered no-cost vulnerability scanning of internet-facing systems to state, local, tribal, and territorial organizations, and the MS-ISAC has offered advisory and monitoring services to members, though availability and funding change and should be confirmed with each provider. Those services are a baseline for external exposure, not a replacement for authenticated internal scanning, cloud configuration review, or manual application testing.

Existing relationships shape the scope. If a managed service provider patches your servers, findings land in that provider's queue, so settle who remediates and on what timeline before the first report arrives. Major cloud providers publish their own rules for customer testing of tenant resources, and some activity requires advance notice. Hosted line-of-business systems such as permitting, ERP, and computer aided dispatch are often closed to customer testing, which makes the contractual right to request the vendor's own test summary or independent audit report the practical alternative.

One scoping choice deserves a deliberate answer: whether the staff who watch alerts know the test is coming. Telling them exercises remediation. Not telling them exercises detection.

What to require in the solicitation

1. A stated methodology. Name the references to be followed, such as NIST SP 800-115 and the OWASP Web Security Testing Guide, and require a description of what is examined by hand rather than by tool.
2. Named testers and screening. Ask for resumes and certifications of the individuals who will perform the work, require written approval before substitution, and state which personnel screening applies where testing touches criminal justice or federal tax information.
3. A redacted sample report, scored in the technical evaluation. It shows whether the agency will receive analysis or a scanner export.
4. Out-of-band notification. Critical findings, exposed credentials, and any sign of prior compromise reported on discovery rather than held for the final report.
5. Retesting priced in the base award, inside a defined window after the agency reports a fix, rather than a separate purchase.
6. Evidence handling. Where raw tool output, screenshots, and captured credentials are stored, who may access them, how long they are kept, and written confirmation of destruction.

How to tell whether it worked

• Time to remediate by severity, counted from the date a weakness was first detectable rather than the date a ticket was opened.
• Authenticated scan coverage as a share of known assets, reported separately from an estimate of assets missing from the inventory.
• Recurrence. Findings that reappear at retest point to a process gap. Repeat categories such as default credentials or unsupported operating systems are worth fixing at the source.
• External surface trend. The number of listening services and administrative interfaces reachable from the internet should fall or be explained.
• Detection. For unannounced testing, whether monitoring noticed the activity, what it noticed, and how long that took.

A falling finding count is not progress on its own. Scope narrows and tools change, so a quieter report can mean less was examined. Compare like for like.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions