Ongoing Security Monitoring

The service includes quarterly automated vulnerability scans of your website, email, and network infrastructure; real-time CVE alerting when new critical vulnerabilities affect your technology stack; SSL/TLS certificate expiry monitoring; attack surface change detection; security posture trending with quarter-on-quarter comparison; and rapid re-testing after your team applies fixes. You receive a comprehensive report after each quarterly scan plus alert notifications between scans.

Ongoing security monitoring is $200 AUD per quarter - covering all your registered domains, IP addresses, and email domains. This works out to less than $67 per month for continuous protection. There is no long-term contract - you can cancel at the end of any quarter. We recommend starting with a Full Business Assessment ($1,200) to establish your baseline, then transitioning to quarterly monitoring.

A one-off audit gives you a snapshot - your security posture on that specific day. Security is dynamic: new vulnerabilities are published daily, your infrastructure changes, certificates expire, and new services are deployed. Continuous monitoring bridges the gap with regular scanning, real-time CVE alerts, and change detection. Organisations with continuous monitoring experience 73% fewer security incidents than those relying on annual audits alone.

You receive three types of alerts: critical CVE notifications (when a CVSS 9.0+ vulnerability affects your known technology stack, within 4 hours), certificate expiry warnings (at 30, 14, and 7 days before expiry), and attack surface change alerts (new ports, services, or subdomains detected). Alerts are sent via email to your nominated security contact and can optionally integrate with Slack, Microsoft Teams, or PagerDuty.

Yes. Each quarterly scan includes the same breadth of testing as our standalone assessments - OWASP web application testing, full network port scanning, SSL/TLS assessment, and email authentication verification. The key difference from a full pentest is that quarterly scans are primarily automated (no manual business logic testing), which keeps the cost to $200/quarter. We recommend a full manual assessment annually supplemented by quarterly automated monitoring.

Yes. You can add or remove assets from your monitoring scope at any time by emailing your account contact or updating your monitoring dashboard. New assets are included in the next quarterly scan and immediately added to CVE alerting and certificate monitoring. There is no additional charge for reasonable scope changes within a typical small business footprint (up to 20 domains and 20 IP addresses).

During the baseline scan, we catalogue your technology stack - web servers, CMS platforms, frameworks, mail servers, VPN appliances, and other software. This forms a technology profile that our CVE monitoring engine cross-references against new vulnerability disclosures. When a new critical CVE matches a technology in your profile, we verify the version match against our scan data before alerting - reducing false alarms while ensuring relevant threats are caught quickly.

No. Monitoring is billed quarterly with no minimum commitment. You can cancel at the end of any quarter and retain all reports and data from your monitoring period. Most clients find ongoing monitoring essential once they see the volume of changes and new vulnerabilities detected between quarterly scans - the average SMB sees 3-5 material changes to their attack surface per quarter.

Yes. Each quarterly report includes trend analysis showing your overall risk score, number of open vulnerabilities by severity, mean time to remediate, and quarter-on-quarter comparison. After 12 months of monitoring, you have a full year of security posture data - invaluable for board reporting, insurance renewals, and compliance evidence. The trend data is presented in both executive and technical formats.

Our CVE monitoring engine runs continuously, not quarterly. When a critical vulnerability is published that affects your technology stack, we alert you within 4 hours with specific details: which of your assets is affected, the vulnerability details, available patches, and recommended mitigation steps. We can also perform an immediate targeted scan of the affected service to confirm exploitability - this is included in the monitoring service at no extra charge.

Quarterly reports include specific remediation guidance for every finding - which patches to apply, which configurations to change, which ports to close. For organisations without internal security expertise, we offer a remediation support add-on where our team works directly with your IT provider to implement fixes. Re-testing after remediation is always included to confirm fixes are effective.

The simplest path is to start with a Full Business Assessment ($1,200) which establishes your security baseline, then transition to quarterly monitoring ($200/quarter). If you have already had a recent security assessment (within the last 12 months), we can onboard directly into monitoring - we perform an initial baseline scan and set up CVE alerting and certificate monitoring within the first week. Contact us to discuss the best starting point for your organisation.