A vulnerability scan is one of the best sources of project work an MSP has. It is also one of the easiest to give away for free.
The pattern is familiar. The scan finds 200 issues. Some are patches your managed service already covers. Others are an unsupported server, an old firewall, or a line-of-business app that needs a vendor upgrade. If you don't separate the two, your team quietly absorbs the second group, or it never gets done.
Key takeaways
- Sort every finding into covered (your contract already pays for it) or project (it needs approval and a quote).
- Group project findings by fix, not by finding: one upgrade can close forty rows.
- Lead the quote with evidence the client understands: "this is being exploited right now", not "CVSS 9.8".
- If the client says no, record it as an accepted risk, with an end date.
Step 1: Draw the line your contract already draws
Read your agreement before you read the scan. Most managed service agreements cover routine patching of supported operating systems and common software on a schedule. They usually don't cover:
- Replacing or upgrading end-of-life systems and software, where no patch is coming.
- Major version upgrades of line-of-business apps, especially when the software vendor has to be involved.
- Configuration projects: hardening, TLS changes, firewall rule clean-up, network segmentation.
- Hardware replacement, such as network devices with no firmware fix.
Whatever your contract says, write the line down once and apply it the same way every month. Clients accept a consistent rule much more easily than a case-by-case argument.
Step 2: Group project findings by fix
Clients don't buy findings. They buy fixes. A single end-of-life server can produce dozens of findings in a scan. Present it as one item:
| Fix | Findings it closes | Why now |
|---|---|---|
| Replace Windows Server 2012 R2 host | 38 | Extended support ended October 2023 |
| Upgrade the VPN appliance firmware | 6 | 2 are on the CISA KEV list |
| Disable old TLS versions on the web server | 4 | Fails common insurer questionnaires |
Three lines are something a client can decide on in one meeting. Two hundred rows are not.
Step 3: Rank by evidence, not by score
A CVSS score says how bad a flaw could be. It doesn't say whether anyone is using it. For the quote, lead with stronger evidence:
- On the CISA KEV list. Attackers are exploiting it right now. This is the easiest conversation you will have.
- High EPSS score. A good chance it gets exploited in the next 30 days.
- End of life. No patch is ever coming, so the risk only grows.
"Two of these are being actively exploited, and there will never be a patch for this server" will get a budget approved. "We found 14 criticals" usually won't.
Step 4: Get a decision, and record it
Send the project items as a short proposal with a price and a due date for each. Then make sure every item ends in one of two places:
- Approved: it becomes a ticket with an owner and a due date, and the next scan proves it was done.
- Declined: it becomes an accepted risk, with the client's reason, any compensating control and an end date. When the date comes, ask again.
The second outcome is just as important as the first. If a breach ever happens through a declined item, a signed acceptance shows the risk was explained and the client chose. Without it, the client may remember things differently.
Step 5: Show the work at the next review
At the quarterly review, show three lists: what was fixed (proven by a rescan), what was accepted, and what is still open or past due. Billable work that was approved and done is the best proof that your managed service is worth renewing.
How Scan Hub helps
We built Varaxon Scan Hub to make this sorting quick. It is scanner-agnostic: upload an export from the scanner you already run, or connect Microsoft Defender or ConnectSecure. Each report ranks findings by CISA KEV, VulnCheck KEV and EPSS first, flags end-of-life software with the date support ended, and is white-label, so it goes to the client under your name.
After you review a report, Scan Hub can push the fixes into ConnectWise PSA or HaloPSA as tickets, record accepted risks (or let the client sign them online), and prove fixes in the next report.
Every new account gets a 14-day free trial of Core, with up to 10 reports and no card needed. Start a free trial or see sample reports.
Top comments (0)