Rules tuned for you
We dial out false positives, harden high-risk areas and add custom signatures, so every finding is ready to act on.
What is vulnerability scanning?
The first line of defence for compliance and operations.
Commercial tools continuously match your systems against known-vulnerability databases (CVE, CWE, OWASP), broad coverage, run daily to monthly.
PCI-DSS, ISO 27001 and HKMA all require quarterly scans, plus one after any launch, patch or config change.
Best practice · quarterly scans paired with an annual penetration test, breadth and depth together.
Why choose UD vulnerability scanning
Most SaaS providers use a single tool, so blind spots are inevitable. UD covers three tools under one contract, with engineers choosing the mix and managing it end to end.
We pick the right scanner for you, all three commercial tools licensed
UD holds enterprise licences for Acunetix, Burp Suite and Nessus, combining them to fit your asset types, compliance target and budget, so you don't procure vendor by vendor.
1
contract
Acunetix
Burp Suite
Nessus
24/7 trilingual local support
Cantonese, Mandarin and English from a directly-hired local team, no outsourced call centre, and someone always picks up.
20 years · 500+ clients
Across 20+ industries, backed by 21 international certifications, a 100% local team, and sensitive data that never leaves Hong Kong.
Three commercial vulnerability scanners
Use any one, or combine them for the widest coverage. UD engineers assess your environment during scoping and recommend the mix.
Acunetix
Automated web-app security scanning, deep-checking XSS, SQL injection, CSRF, SSRF and other OWASP Top 10 flaws.
Best for
Corporate sitesWeb appsCMS (WordPress)SaaS platformsWeb APIs
Burp Suite
Integrated web-app testing platform, paired with manual analysis for deeper security testing.
Best for
Pen-test supportAPI security testingAttack-surface mapping
Nessus
Broad vulnerability scanning across PCs, servers, network devices and cloud infrastructure, CVE matching and configuration audit.
Best for
Internal networksServersCloud assetsCompliance audit (SCAP / OVAL)
What it covers
All findings are consolidated into a regular report, then read, ranked and followed up item by item by UD engineers.
Findings ranked by risk
Each scan's findings are grouped by CVSS severity, and engineers tackle the critical items first.
CriticalCritical / High
MediumMedium
LowLow
InfoInfo
UD's custom rules keep false positives down, so every listed vulnerability is ready to act on.
Which businesses need it
Any organisation under PCI-DSS, ISO 27001, HKMA, SFC or PDPO, or holding large volumes of personal data or processing payments, should build vulnerability scanning into its quarterly IT-governance routine.
Banking & Finance
Insurance
Listed companies / IPO
E-commerce & SaaS
Healthcare & Clinics
Education institutions
Government-funded NGOs
New cross-border platforms
Get a quote or ask us
Whether you want a formal quote or just have a question, a UD engineer will be in touch shortly to scope the work, recommend a scanner mix and prepare a tailored quote.
A dedicated specialist follows up
A recommended scanner mix after scoping
One contract, no juggling three vendors
Frequently asked questions
How is vulnerability scanning different from a penetration test?
Vulnerability scanning is automated, broad detection, wide coverage but limited depth, mainly identifying known CVEs and configuration gaps; a penetration test is hands-on, with white-hats simulating attacks in depth, trying to chain several low-risk flaws into a full attack path and verifying business-logic flaws. Best practice: quarterly scans paired with an annual pen test. If your organisation needs a DPO organisation-level audit, consider SRAA as well.
How often should we scan?
At least quarterly, matching PCI-DSS Requirement 11.2 and the ISO 27001 control cycle. Add a scan right away after a major system change, before a new service goes live, after Patch Tuesday, before a compliance audit, and after an HKCERT or vendor advisory. For high-risk environments (financial core systems, e-commerce payment flows), consider monthly or even weekly scans.
Which scanner suits our company best?
It depends on asset type. Small corporate sites, web apps and SaaS platforms usually use Acunetix; corporate networks, servers and cloud infrastructure use Nessus; add Burp Suite for API and deeper testing needs. UD engineers assess your environment during scoping before recommending, so you don't buy licences you don't need.
Do we have to buy all three scanners?
No. Use any one, or combine them. Most clients start with one or two based on business needs and adjust later as things change. UD holds enterprise licences for all three, so you sign just one contract and don't deal with three separate vendors.
Will scanning disrupt our live business?
We coordinate timing and technique during scoping. By default we use a low-load scan mode and can run outside peak hours; highly sensitive systems can be tested first in a staging environment to confirm. Once configured, scans run fully on a schedule with no manual effort from your IT team.
How do we get a quote, and what do you need from us?
Submit the form at the foot of the page, noting your target scope (website, API, internal network, servers, cloud infrastructure, etc.), number of assets, compliance target (PCI-DSS, ISO 27001, HKMA, etc.) and expected scan frequency. A UD engineer will reply shortly to arrange a scoping meeting, after which we provide a formal quote.
We already scan in-house, do we still need to outsource?
It depends. If you currently rely on open-source tools (such as OpenVAS) handled part-time by internal staff, an outsourced commercial solution can markedly deepen coverage, cut false positives and free up your IT team. Several compliance regimes (PCI-DSS Requirement 11.2.2, HKMA supervisory expectations) also expect or imply an independent third-party scan, which outsourcing satisfies.