Vulnerability and compliance

Vulnerability and compliance software scans client networks and systems for known weaknesses, including missing patches an RMM might have missed, and maps findings against the requirements of a compliance framework a client needs to meet. Authenticated scanning, logging into a system rather than just probing it externally, finds more than an unauthenticated scan can, and external attack surface scanning shows what an outsider sees when they look at a client's public-facing systems. Dark web monitoring for leaked client credentials is a common addition. This category produces evidence and reports, not remediation itself; fixing what a scan finds is usually a separate piece of work done through the RMM or manually.

Pricing is per endpoint, per site or per tenant per month, depending on how the product scopes a scan. Some products price on a flat basis for compliance framework mapping regardless of endpoint count, since that work is more about documentation than per-device scanning.

Network vulnerability scanning combined with missing patch detection covers the basics, but authenticated scanning finds significantly more than an external scan alone, so check whether a product supports it and how much setup it needs. Compliance framework mapping matters if clients need to demonstrate alignment with a specific standard, and risk scoring helps prioritise which findings matter versus a long list of low-severity noise. Automated evidence collection saves real time when a client faces an audit, and client-facing reports determine how easily you can turn a scan into something non-technical stakeholders understand.

PSA integration for remediation tickets is the connection that matters most, since a scan is only useful if findings turn into tracked, assigned work rather than a report nobody actions. Multi-tenant console support matters for running this across many clients from one place, and scheduled recurring scans reduce how much manual effort is needed to keep evidence current.

Ask about the contract term, whether pricing is per endpoint, site or tenant, and how scan frequency affects the price. Ask whether compliance framework mapping covers the specific frameworks your clients need, since coverage varies by vendor and not every product supports every standard.

A small MSP with clients who have no formal compliance obligations can often start with basic network and patch scanning without needing compliance framework mapping. A larger MSP serving clients in regulated industries typically needs authenticated scanning, framework mapping and automated evidence collection as standard, since audit season becomes unmanageable without them at scale.