Skip to main content

Help us improve the Digital Marketplace - send your feedback

KHIPU NETWORKS LIMITED

Greenbone Vulnerability Assessment Scanning and Management

We can provide vulnerability assessment scanning and management of internal and external infrastructures. As a fully managed cloud service, the solution detects and manages internal and external vulnerabilities, enabling you to prioritise what is important so you can manage your cyber security risks, compliance and quality.

Features

  • Vulnerability assessment and management of your network
  • Mitigation approach for each vulnerability discovered
  • Classifies vulnerabilities by potential risk
  • Granular reporting of results
  • FREE external vulnerability scans available
  • Fully flexible managed services available

Benefits

  • Improved Security - detect vulnerabilities (e.g. heartbleed)
  • Translates vulnerabilities into RISKS
  • Categorises and prioritises RISK for targeted resolution
  • Management & Detailed reporting - CEO to security analyst
  • Tailored Service - flexible to meet your specific needs
  • Reduces your overall risk to a vulnerability breach
  • Automation removes time consuming tasks associated with vulnerability management
  • Very cost effective approach for vulnerability management

Pricing

  • Education pricing available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@khipu-networks.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

4 0 7 6 3 3 8 9 9 6 9 8 3 8 1

Contact

KHIPU NETWORKS LIMITED Sales Team
Telephone: 0345 272 0900
Email: sales@khipu-networks.com

About your service

Service categories

Systems Infrastructure Software

Security

  • Security analytics
Multi cloud support
No

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
For a vulnerability assessment to be successful, we would ask for any DOS protection on your perimeter to whitelist the scanner. This will allow the scan to operate at full speed and not trigger the DOS protection.

For any required upgrade / patches to the vulnerability assessment service, these will be applied as part of the managed service. If there is a reboot of services required that may involve downtime, we will work with the customer to manage when such a task is performed.
System requirements
  • IPAddress Space subject to assessment
  • Possible amendment to firewalls for a vulnerability scan

User support

Email or online ticketing support
Yes, at extra cost
Support response times
KHIPU offers support packages with SLAs for 24x7x365 or business hours (08:00–18:00). Response times depend on incident priority, agreed with customer:

P1 – Urgent: Critical outages or major incidents requiring immediate attention - response within 1 hour.
P2 – High: Significant issues affecting important functionality but do not completely halt operations - response within 2 hours.
P3 – Medium: Moderate impact, such as warnings or non-critical alerts - response within 4 hours.
P4 – Low: Minor issues, or informational requests that have little to no operational impact - response within 4 hours.

Cases are logged and automatically confirmed by email.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.2 AA
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
KHIPU is committed to delivering exceptional technical and after-sales support throughout and beyond project implementation. We provide maintenance and support for all supplied solutions, ensuring equipment is serviced to the agreed level of cover. Our support services include:

• Maintain Services: Break-fix support with 1st, 2nd and 3rd line troubleshooting for all KHIPU delivered solutions. KHIPU holds top-level certifications and works directly with manufacturers as required.
• Monitor Services: Proactive monitoring, alerting and analysis.
• Fully Managed Service: Complete responsibility for device management.
• Co-Managed Service: Shared responsibility for device management.
• SOC Service: Comprehensive detection and response to protect critical infrastructure from cyber threats.

All services are available 24x7x365 or during business hours (08:00–18:00) and include support via telephone, email, secure portal and remote access.

Every customer is assigned a Technical Account Manager to ensure SLAs are met and support requirements are fulfilled. Customer references are available on request to demonstrate our proven track record.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Getting Started Guide

The KHIPU Getting Started Guide document is issued to all new customers and provides essential information for accessing technical and after-sales support. It begins with an overview of KHIPU’s ethos and commitment to delivering exceptional service during and after project implementation. The guide explains the onboarding process, including account setup, portal access, and escalation procedures.

Initial Setup & TAC Activation

After a support service is purchased, customers are contacted to arrange an onboarding call.

The Case Management Team provides a personalised walkthrough of:

KHIPU TAC procedures
Call logging process
Access to the KHIPU TAC Portal and File Share Portal

Key Steps in Onboarding

Account Creation: Customer details and authorised callers are registered on KHIPU systems.
Platform Access: Credentials for TAC portal and secure file sharing are provided.
Escalation & Complaint Procedures explained.
Maintenance and SLA details reviewed with the customer to ensure all details are correct.

NOC & Managed Services Onboarding
For customers using NOC Monitor, Monitor Plus, or Managed Services:

Asset registration, dashboard setup, and mobile app access (for enhanced tiers).
Health checks and dependency mapping are completed.
Quarterly reports and proactive monitoring are enabled and scheduled.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
KHIPU End-of-Contract Data Handover Checklist.
When a contract ends, KHIPU ensures a secure and compliant process for returning customer data if requested:
1. Data Identification
Confirm all customer-owned data, including logs, reports, configurations, and backups, across systems covered by the agreement.
2. Data Extraction
Prepare data in the agreed format (e.g., encrypted files, CSV, PDF) and verify completeness and integrity before transfer.
3. Secure Transfer
Use encrypted channels such as secure portals or physical media. Apply encryption for data at rest and in transit, and confirm authorised recipient access with multi-factor authentication.
4. Customer Confirmation
Obtain written confirmation that the data has been received and validated for integrity and usability.
5. Data Destruction
Remove all residual copies from KHIPU systems and confirm deletion within the agreed timeframe.
6. Compliance
Ensure all steps comply with GDPR and Data Protection Laws. The process is documented for audit purposes.

This structured approach guarantees security, transparency, and legal compliance during the data handover process.
End-of-contract process
At the end of the contract, if the organisation chooses not to renew and continue with the service, all data pertaining to the organisation is deleted. If the organisation chooses to renew then the service continues as normal. 90-days prior to the contract expiration date an initial reminder email is sent, followed up by gradually increasing reminders until the date of expiration.

Included in the Price

Data extraction and secure transfer in standard agreed formats.
Customer confirmation and validation process.
Secure deletion of residual data.
Compliance with GDPR and legal requirements.

Additional Costs

Bespoke data formats or media (e.g., physical drives, custom encryption).
Accelerated timelines for data handover or destruction.
Extended storage beyond the agreed retention period.
Consultancy or technical support for data migration to third-party systems.
Documentation accessibility standard
None or don’t know
How the documentation is accessible
Documentation is provided directly to designated contacts.

Using the service

Web browser interface
No
Application to install
No
Designed for use on mobile devices
No
Service interface
Yes
User support accessibility
None or don’t know
Description of service interface
Users log in through a browser using the appliance’s IP address to access dashboards, configure scans, review results, and manage assets. The interface offers customisable dashboards with charts and tables, filtering options, and the ability to download data in various formats. It serves as the primary interaction point for monitoring security status, organising scan tasks, and visualising vulnerabilities, enabling effective oversight of an organisation’s security posture.
Accessibility standards
None or don’t know
Description of accessibility
Greenbone does not publicly document support for specific accessibility standards. If accessibility compliance is required for your environment, KHIPU will request this.
Accessibility testing
Greenbone does not publicly document support for specific accessibility standards. If accessibility compliance is required for your environment, KHIPU will request this.
API
Yes
What users can and can't do using the API
The Greenbone API ecosystem provides structured programmatic control over Greenbone’s vulnerability‑management platform through two core protocols: the Greenbone Management Protocol (GMP) and the Open Scanner Protocol (OSP). GMP enables remote management tasks such as authentication, task creation, scanning control, retrieving reports, and managing users, policies, and assets, while OSP provides a standardised interface for controlling different scanners. These APIs are accessed through libraries such as python‑gvm, which abstracts protocol communication and offers connection methods including TLS, SSH, and Unix socket connections. Greenbone provides formal API documentation for multiple protocol versions, including GMP 22.x and OSP 24.x, ensuring compatibility with both Community Edition and Enterprise environments. Usage typically involves authenticated sessions, sending XML‑based commands, and parsing structured responses. The APIs are primarily designed for administrators, integrators, and automation workflows, enabling remote orchestration, continuous scanning, and integration into SIEM/SOAR pipelines. Limitations include strict version dependencies—older GMP versions require older python‑gvm releases—and the requirement for correct protocol matching between client and server. Additionally, API functionality depends on the permissions of the authenticated user, and some advanced features remain available only within Enterprise editions. Overall, the Greenbone API suite delivers powerful, extensible automation capabilities while requiring careful version alignment and security‑aware configuration.
API documentation
Yes
API documentation formats
  • HTML
  • PDF
API sandbox or test environment
No
Customisation available
Yes
Description of customisation
Greenbone offers extensive customisation capabilities within its Greenbone Security Assistant (GSA) web interface, enabling organisations to tailor their vulnerability‑management experience to operational needs. Users can customise dashboards by adding, deleting, or reorganising chart and table displays, allowing them to highlight specific metrics such as tasks, CVEs, or vulnerability trends. Displays can be filtered, downloaded, reorganised, and visually adjusted between 2D and 3D formats, offering flexible analytic perspectives. Customisation is performed directly through the GSA interface via drop‑down selections, dashboard tabs, and built‑in filtering tools, making it accessible without requiring backend modifications. More advanced users—typically security administrators or engineers—can further customise GSA behaviour through configuration files and environment variables, such as adjusting login settings, language preferences, update behaviour, and API server connections, as documented in the GSA’s development and configuration repository. These customisations allow organisations to align the interface with internal workflows, governance requirements, and reporting needs. While everyday analysts may adapt dashboards to support their monitoring activities, deeper systemic customisation is generally managed by IT security administrators responsible for maintaining consistent operational standards across the Greenbone deployment. Overall, Greenbone’s multi‑layered configurability ensures that both casual users and advanced administrators can shape the platform to fit their roles and security objectives.

Scaling

Independence of resources
Each service that KHIPU provide to its customers are separate dedicated services which have guaranteed performance levels unaffected by other users/customers.

Analytics

Service usage metrics
Yes
Metrics types
Greenbone provides a range of metrics through its Greenbone Security Assistant (GSA) dashboards, helping users monitor vulnerability trends and overall security posture. These metrics appear in customisable charts and tables, showing task status, discovered CVEs, vulnerability test (VT) counts, and scan results aggregated over time. Users can filter displays, switch chart types, and organise multiple dashboards to track different aspects of security activity. The overview dashboard highlights key indicators such as open tasks, recent vulnerabilities, and system findings, providing a quick operational snapshot. Together, these metrics enable security teams to visualise risk levels, identify patterns, and prioritise remediation effectively.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request
Resource tagging
Yes
FOCUS resource tagging
Yes

Resellers

Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Greenbone Networks

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least every 6 months
Penetration testing approach
In-house
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process
Yes
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type
Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

Data export approach
Data can be exported from Greenbone through its reporting system, which allows users to download scan results in multiple formats. Reports in the GSA interface can be exported using built‑in report formats such as XML, Anonymous XML, ARF, and others, enabling integration with third‑party tools. Users can also export results directly in XML through the “Export” option for use in platforms like Ivanti Neurons. Additionally, delta reports and other summaries can be exported as PDF, supported by report plugins that convert data into various document formats.
Data export formats
Other
Other data export formats
  • XML
  • PDF
Data import formats
Other
Other data import formats
XML

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
The service is run at an agreed time with the customer on a 24*7*365(6) schedule. This service has a targeted 99.9% availability on a quarterly basis, excluding scheduled maintenance windows. In the event that KHIPU does not meet the guaranteed levels of availability, service credits are issued in the form of “service tokens”. A service token entitles the user to call upon the professional services of KHIPU Networks for work outside of their standard maintenance contract. Service credits are issued and discussed during quarterly service review meetings, based upon the number of failures in the prior quarter. Up to 5 service credits are capped per quarter for each end-user.
Approach to resilience
This information is available upon request.
Outage reporting
The service reports any outages via email alerts and telephone calls.

Identity and authentication

User authentication needed
No
Access restrictions in management interfaces and support channels
Access to the management platform is controlled by a federated authentication scheme across an encrypted https channel. Access is restricted to a limited amount of personal.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
User-defined

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
KHIPU adhere to ISO policies and procedures. We are certified to ISO9001 (Quality Management), ISO27001 (Information Security Management), ISO14001 (Environmental Management) and ISO45001 (Occupational health and safety). Any potential breach or risk of security or process is highlighted to senior management including the board of directors immediately.
Software Security Code of Practice
Yes

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
All service configuration changes follow an ITIL-based Change Control Process. Requests must be logged via the KHIPU Supportdesk and submitted by authorised personnel only. Each change is assessed for technical suitability, security risks, and service impact. Findings are clearly communicated to the customer, who makes the final decision to proceed, including consideration of any commercial implications. This process ensures a full audit trail and that all aspects of the change are reviewed before implementation.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
KHIPU uses continuous scanning tools like Tenable Nessus and Qualys to identify vulnerabilities across servers, applications, and networks. Findings are assessed using CVSSv3 and prioritised from Low to Critical. Asset and service owners remediate issues, with critical/high vulnerabilities patched within 14 days of discovery. The process includes identification, classification, remediation, and verification, with reports provided within five business days post-remediation. Threat intelligence is sourced from vendor advisories, industry platforms, and external feeds, ensuring timely updates and compliance with ISO27001 and Cyber Essentials Plus. This proactive, risk-based approach enables rapid response and strong security across all services.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
KHIPU provides 24x7x365 protective monitoring via its Security and Network Operations Centre using Cyber Managed Detection and Response (CMDR). Servers, firewalls, and critical assets are continuously monitored for abnormal behaviour, trend anomalies, and suspicious logs. Potential compromises trigger real-time alerts, followed by immediate triage, severity validation, and escalation to technical teams. Customers are informed through agreed channels. Response times meet strict SLAs: critical within one hour, high within two, and medium/low within four. This proactive approach, combining automated monitoring, early indicators, and structured escalation, ensures rapid detection and resolution while maintaining compliance and service integrity.
Incident management type
Supplier-defined controls
Incident management approach
KHIPU’s approach to incident management is ITIL-aligned and prioritises rapid resolution.

Customers log incidents via telephone, email or support portal with required details. Cases are categorised by priority in agreement with the customer:
P1 – Urgent: Critical outages or major incidents requiring immediate attention
P2 – High: Significant issues affecting functionality, not completely halting operations.
P3 – Medium: Moderate impact, e.g. warnings or non-critical alerts.
P4 – Low: Minor issues, or informational requests with negligible operational impact.

Service-affecting incidents are escalated to 2nd/3rd line teams and account/technical managers. Escalation procedures and SLAs are provided during onboarding, ensuring transparency and accountability.
Post-quantum cryptography secure
No

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

Connection to public sector networks
No

Pricing

Discount for educational organisations
Yes
Free trial available
No

Discount percentage by annual call-off contract value (excluding VAT)

Less than £250,000
10%
Between £250,000 and £500,000
10%
Between £500,001 and £1,000,000
10%
Between £1,000,001 and £2,500,000
10%
Between £2,500,001 and £5,000,000
10%
Over £5,000,001
10%

Non-mandatory Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
LRQA
ISO/IEC 27001 accreditation date
Tuesday 6 May 2025
What the ISO/IEC 27001 doesn’t cover
Not applicable, all business areas and operational offices are in scope of the certificate.
ISO 28000:2022 certification
No
ISO 9001 certification
Yes
Who accredited the ISO 9001 certification
LRQA
ISO 9001 accreditation date
Tuesday 6 May 2025
What the ISO 9001 doesn’t cover
Not applicable, all business areas and operational offices are in scope of the certificate.
Quality management systems (QMS)
Yes
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Please provide your Cyber Essentials Certificate Number
De598042-4dcc-442e-abff-8c64f3d32edb
Cyber essentials plus
Yes
Please provide your Cyber Essentials Plus Certificate Number
Fa457bce-7b40-4650-a92d-0f1919abfd7a
Other security certifications
No

Social value

Section B - Commitment for Future: Delivery
  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Plans for positive actions with community groups.
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events
  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition
  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce
  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@khipu-networks.com. Tell them what format you need. It will help if you say what assistive technology you use.