Connect vulnerability discovery with authorised validation
Fortra’s published Offensive Security Essentials Bundle combines Fortra Vulnerability Management and Core Impact. The selection question is whether the team needs a workflow connecting weakness discovery with authorised testing, rather than another standalone scanner. Current contents, licence metrics and entitlements must still be confirmed in the quotation.
Begin with the assets the organisation owns and the assessments it is authorised to perform. Define what the scanner is expected to identify and which findings may progress into separately approved validation. Keep discovery permission distinct from permission to attempt intrusive activity on a target.
Accept the assessment workflow, not a tool count
A bounded evaluation should show that the operator can review a relevant finding, preserve its source context and produce evidence useful for remediation. Use a controlled environment and approved techniques. The purpose is to assess the workflow and operator readiness without creating unnecessary production risk or collecting live sensitive data.
Compare the package with existing licences and processes so overlapping functionality is visible. Handover should include scope controls, evidence handling, cleanup, reporting and retest responsibilities. For UAE organisations, asset-owner approvals and service restrictions must be resolved before an assessment begins. MMC can scope licensing and related enablement; it does not imply that a software order includes a penetration test or guarantees discovery of every weakness.
Evidence to request for this scope
- Confirm current Fortra VM and Core Impact entitlements, supported environments and operator requirements.
- Validate a controlled finding-to-review workflow under written assessment boundaries.
- Separate software licensing, authorised assessment delivery, reporting and retesting in the commercial scope.