Assess Once, Comply to Many
Accurate Exposure Picture
Authenticated and unauthenticated scanning together show your true patch position and your real network exposure, not one view mistaken for the whole.
Validated Findings Only
Manual verification removes false positives before reporting, so infrastructure teams spend their time remediating rather than disproving.
Stronger Patch Management
Recurring measurement highlights systemic gaps, including unmanaged hosts, end-of-life software and images shipping outdated components.
Audit-Ready Evidence
Scope, scan records, authentication coverage, risk ranking and passing results are documented in the form assessors expect for PCI DSS, ISO 27001, SOC 2, HIPAA and Indian regulatory requirements.
What is an Internal Vulnerability Assessment?
Regular internal scanning is a mandatory control in most standards. PCI DSS v4.0.1 Requirement 11.3.1 requires internal scans at least once every three months, with all high-risk and critical vulnerabilities resolved and confirmed by rescan. Requirement 11.3.1.2 requires authenticated scanning, and Requirement 11.3.1.3 requires scanning after any significant change. ISO/IEC 27001:2022, HIPAA and HITRUST, SOC 2, NIST CSF 2.0 and SP 800-40, and RBI, SEBI CSCRF and CERT-In requirements set comparable expectations.
What We Assess
- Servers and operating systems: Windows, Linux and Unix servers: missing patches, unsupported versions, local policy and hardening state, installed third-party software.
- Network and security devices: Routers, switches, firewalls, load balancers and wireless controllers: firmware levels, insecure management protocols, default and weak credentials.
- Virtualization and hypervisors: Hypervisor hosts and management consoles, including patch state and administrative interface exposure.
- Endpoints and workstations: Corporate desktops, laptops and kiosks: operating system and application patch levels, and locally exploitable configuration weaknesses.
- Databases: Engine versions and patch state, default accounts, weak authentication settings and insecure listener configuration.
- Cloud and hybrid workloads: Virtual machine instances and managed services in IaaS and hybrid environments, assessed through agent, credentialed or API-based collection.
- Containers and images: Container images and registries scanned for vulnerable base layers, outdated packages and embedded secrets, where in scope.
Why Choose ControlCase for Internal Vulnerability Assessment?
Scanning Approaches
ControlCase performs both unauthenticated and authenticated scanning. They answer different questions, and a mature vulnerability management program needs both.
Description: Probes each target from across the network without credentials, enumerating live hosts, open ports, listening services, protocol and cipher support, service banners and versions. This is the view an internal attacker has before compromising any account.
Key areas: Services that should not be listening, forgotten management interfaces, expired or weak certificates, and default credentials on network-accessible devices.
Applies to: Verifying segmentation assumptions, finding unmanaged and unexpected hosts, and confirming what is exposed.
Description: Logs into each target with a dedicated read-only scanning account: SMB and WMI or remote registry on Windows, SSH on Linux and Unix, and native read-only interfaces for databases, hypervisors, network devices and cloud instances.
Key areas: Missing patches in software not facing the network, end-of-life components, weak local policy and configuration drift against hardening baselines.
Applies to: Measuring true patch compliance, hardening verification and audit evidence. Required for internal scanning under PCI DSS Requirement 11.3.1.2.
ControlCase Internal Vulnerability Assessment Process
