Scanning tools (Nessus, Qualys, OpenVAS) which is good, should I scan daily

we use openvas we scan on friday eveenings

Same here.

To get into the details: Processes without records never improve, because you don't know what to fix.

Your time to detect an issue directly determines its cost. Correct me if I'm wrong.

Absolutely. If I were to add anything: Forgotten test environments are more often the entry point than live systems.

This is my opinion, I'm not claiming it's absolute truth.

Timely topic.

Let me clarify the technical side. When making a decision first look at what data you have on hand.

Mistakes made on the security vulnerability scanning side are usually reversible but expensive. Just leaving this note, it might be useful.

Let's separate the concepts, they're getting mixed up. Your time to detect an issue directly determines its cost.

The answer varies greatly by industry; there is no one-size-fits-all rule. Good luck with that.

Exactly, and not many people know this. Your time to detect an issue directly determines its cost.

This is my opinion, I'm not claiming it's absolute truth.

Exactly and not many people know this. Start with a small trial; don't commit to everything at once.

Good luck with that.

Good call starting this thread.

We got stuck at the same point for a while. Having backups accessible on the same network and with the same identity makes them part of the target.

The discussion got scattered let me summarize. btw forgotten test environments are more often the entry point than live systems.

If I were you Id go this route.

Thanks, this was very helpful.

Three different views emerged, they all complement each other. The real issue isn't the number, but what it's based on.

Payment information changes are never verified through the channel they came from. This is my opinion, I'm not claiming it's absolute truth.

Let me summarize what's been said so far. Trying to do this alone is the most expensive way.

This is my opinion, I'm not claiming it's absolute truth.

We need to make a distinction here. Processes without records never improve, because you don't know what to fix.

If you have questions write them; I'll answer as best I can.

Thanks for writing this, that's the right way. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

i'm a small business let me explain from my side but tbh the biggest time-waster for us was not knowing who had the final say.

security isn't absolute; it's about makign attacks not worth the effort.