In 1995, we founded one of the first Internet security testing services, and our tests were run by more than 1,000 different Internet sites in our first year of testing. We migrated our Internet testing service into our special services group for our key clients because we found that off-the-shelf scans had to be supplemented with expert analysis to meet our clients' needs.

Our experience and professional performance are unmatched in the industry, and today, we provide the most sophisticated testing service available without doing a full red-team process. (We also do full-scale red-teaming, but that's another story).

The truth is, no large company can afford to fix every vulnerability in every system they have, and even if they could, the risk almost never justifies that level of effort.

When you use NetScan services, you get more than just a vulnerability scan. You get a partner who works with your people to help them do a better job of protecting your network to the appropriate level for your needs. That means helping them understand the risks associated with vulnerabilities and helping you make prudent risk management decisions.

Listings of hundreds of test results with ratings and rankings may look very impressive, but they don't help most defenders do a better job. They don't lead to more effective protection, they don't produce better incident detection, and they don't improve incident response.

NetScan service goes a step beyond other services by analyzing your situation and relating the results of scans to your computing environment. When appropriate, we also devise special purpose demonstrations in conjunction with your staff so that they can understand risks that off-the-shelf scanners simply cannot tell them about. For example, if it's appropriate to your needs:

• We can demonstrate the weaknesses that allow email viruses to enter and spread through your site and help find a cost effective solution.
• We can verify that only the computers authorized to have special access actually have that access by controlling the source of attacks, not just their destinations.
• We can help you figure out how to schedule improvements so that more important things are fixed before less important ones.

That bears repetition. Our tests are specially designed to determine whether your systems meet your security policies. That means that you get:

No false positives.	We don't clutter our reports with lists of the test results that aren't important to you. We only list the vulnerabilities you care about and include explanations of what they mean to you and how you can fix them.
No false negatives.	The total number of possible vulnerabilities in a network is so large that no test can cover them all. We work with you to determine what to test for and what not to test for. That way, you understand what is and is not being tested and why.
No surprises.	We coordinate our tests with your security team so they don't disrupt normal operations or cause unnecessary concern.

What you do get is useful help and advice on vulnerabilities, what to do about them, and what not to do about them.