Koja je razlika izmedju provjere ranjivosti i pentesta?

Provjera ranjivosti je automatizirano skeniranje u sirinu koje popisuje i prioritizira poznate slabosti; penetracijsko testiranje ide u dubinu i pokusava slabost iskoristiti kako bi dokazalo stvarni utjecaj. Prvo radite stalno, drugo povremeno.

Kako Aegis odlucuje sto je prioritet?

Kombinacijom tehnicke ozbiljnosti (CVSS), procjene vjerojatnosti iskoristavanja (EPSS) i potvrde aktivnog iskoristavanja (CISA KEV). Tako se prvo rjesava ono sto je opasno danas.

Ima li laznih pozitiva?

Kod svakog skeniranja lazni pozitivi su moguci. Zato Aegis nalaze obogacuje kontekstom, a kriticne potvrdjuje kroz dodatnu provjeru ili pentest prije nego trosite vrijeme na popravak.

Zamjenjuje li ovo pentest?

Ne. Skeniranje daje sirinu i kontinuitet, ali ne dokazuje iskoristivost. Za dokaz i regulatorne zahtjeve i dalje je potrebno penetracijsko testiranje.

Vulnerability assessment (vulnerability scan) vs. pentest — the difference

A vulnerability assessment isn't the same as a pentest —
here's the difference

A vulnerability assessment continuously and automatically scans your infrastructure in breadth and prioritises findings by real risk (CISA KEV), whereas penetration testing goes in depth and tries to exploit a vulnerability like a real attacker.

✓ Continuous, broad coverage ✓ Prioritized by CISA KEV ✓ Measurable over time

Breadth of scanning vs. proof of depth

Both approaches are valuable and complement each other, but they answer different questions. Scanning asks "where might it be weak"; a pentest asks "can it actually be exploited".

CRITERION	Vulnerability assessment (scan)	Penetration testing
Goal	List and prioritize known weaknesses	Exploit a weakness and prove the impact
Method	Automated scanning	Manual + automated, with exploitation
Coverage	Broad — many systems	Deep — selected targets
Frequency	Continuous / regular	Periodic (e.g. quarterly, annually)
Outcome	A prioritized list with recommendations	A proven finding with steps and a retest
False positives	Possible — require verification	Verified through exploitation

When to use which: use vulnerability assessment continuously as hygiene and for breadth; Penetration testing periodically, for depth, proof and regulatory requirements. Aegis does both on the same platform.

Priority by risk, not by the alphabet

A list of a thousand vulnerabilities is useless if you don't know which to fix first. Aegis prioritises by whether a vulnerability is actually being exploited in attacks.

Continuous scanning

Regular checking of services, applications and configurations instead of a one-off snapshot.

CVE and CISA KEV

Known vulnerabilities prioritized by whether they are actually being exploited in attacks.

COVERAGE SCORE

A measurable score of 0–100 shows how exposed you are and where you are weakest.

Concrete recommendations

For each finding, a clear next step — what to fix, where and why.

Tracking over time

See whether things are improving and how quickly you close vulnerabilities.

Link with the SIEM

A vulnerability linked to detection — if your exact weak point is under attack, you know immediately.

19.000+

cases processed

13.000+

detection rules

10.000+

pentest findings

280.000+

automatic blocks

Aggregated, anonymized and illustratively rounded production metrics.

CVE, CVSS, EPSS and KEV — how to read a vulnerability

A vulnerability is a weakness in software or configuration that an attacker can exploit. Known vulnerabilities get a CVE identifier (e.g. CVE-2024-12345) so they can be referred to unambiguously.

How severity is measured

CVSS — a technical severity score (0–10). It tells you how dangerous a vulnerability is "on paper".
EPSS — an estimate of the probability that a vulnerability will be exploited in the near future.
CISA KEV — a list of vulnerabilities confirmed to be actively exploited in attacks.

Aegis combines these signals so you first deal with what is genuinely dangerous today, not just the highest CVSS number. Vulnerabilities found by scanning are linked with SIEM detection and, when needed, prove it through Penetration testing.

Vulnerability assessment — frequently asked questions

What's the difference between vulnerability assessment and a pentest? +

A vulnerability assessment is an automated broad scan that lists and prioritizes known weaknesses; penetration testing goes deep and tries to exploit a weakness to prove real impact. Do the first continuously, the second periodically.

How does Aegis decide what's a priority? +

By combining technical severity (CVSS), the probability of exploitation (EPSS) and confirmation of active exploitation (CISA KEV). This way, what's dangerous today gets fixed first.

Are there false positives? +

With any scan, false positives are possible. That's why Aegis enriches findings with context and confirms critical ones through an extra check or pentest before you spend time on a fix.

Does this replace a pentest? +

No. Scanning provides breadth and continuity, but does not prove exploitability. For proof and regulatory requirements, penetration testing is still needed.