Built on Qualys.
NEST uses established Qualys scanning technology to identify known vulnerabilities and configuration issues. Turtledove turns those findings into a practical view for everyday vulnerability management.
All services
NEST vulnerability scanning.
NEST brings Qualys-backed scanning into a platform that lets you track and triage vulnerabilities, with quality of life features designed by the people who use the tools every day
Vulnerability management, made manageable.
Vulnerability management means understanding the weaknesses in your systems, deciding what needs attention and following through on fixes.
NEST uses a small software agent on each enrolled endpoint to build a daily view of known vulnerabilities, application updates and configuration issues. It goes beyond a list of available operating-system patches, helping you see the software and settings that need attention across your devices.
starting at £499per year + VAT
A clearer view. A more useful to-do list.
Bring the findings that matter into one place, with enough context for the people responsible for putting them right.
Issue bundling
Detections of the same underlying software problem collapse into a single issue - “617 hosts need a JDK update” instead of thousands of rows - so you triage the work once, not once per detection.
Inbox
A daily heads-up view of what’s changed since your last scan - new vulnerabilities, resolved issues, and everything in between.
Asset & vulnerability detail pages
A full deep-dive view for any asset or vulnerability, one click away from any table row.
Triage tools: hide & risk-accepted
Hide items you’ve already reviewed and mark vulnerabilities as risk-accepted, so dashboards reflect what actually still needs attention.
Risk acceptance records a decision; it does not remove a Cyber Essentials remediation requirement.
Asset tagging
Label and organise your estate around how your team actually works.
Dashboard trends & count toggle
See whether your risk is trending up or down over 1 or 6 months, and switch instantly between total detections and de-duplicated issues.
CVSS vector filtering
Filter by the individual CVSS components - attack vector, complexity, privileges required - not just the headline score.
Findings become issues.
Related vulnerabilities are grouped around the thing you need to fix. That makes the work easier to understand, prioritise and hand to the person responsible, without losing sight of the devices affected.
Useful from the first login.
Clear default views help you understand your security picture without first building dashboards. NEST is designed to be approachable for people new to vulnerability management and useful to experienced technical teams.
Your team. Your MSP. One view.
Unlimited user accounts and one MSP access seat are included for each organisation. Bring the people who manage your devices into the same view, so findings can inform a shared conversation about what needs fixing.
Cyber Essentials is a year-round commitment.
The Danzell question set, introduced on 27 April 2026, makes ongoing compliance explicit: the signed declaration acknowledges responsibility for maintaining the controls throughout the certification period. This applies to Cyber Essentials and underpins Cyber Essentials Plus.
High-risk and critical security updates and vulnerability fixes must be applied within 14 days of release. Missing that requirement now means an automatic failure on the relevant update-management questions.
A signed declaration needs an ongoing process behind it. NEST gives your team a straightforward, accessible way to find known vulnerabilities, prioritise the work and follow fixes across your estate - helping you maintain the standard you have committed to, throughout the year.
Read IASME’s April 2026 changes (opens in a new tab)The best vulnerability management tool to meet existing compliance requirements
Regular visibility of vulnerabilities gives your team something concrete to work from between audits and assessments.
Cyber Essentials & Plus
Keep software vulnerabilities and configuration issues visible throughout the year. NEST helps your team identify what needs attention and prepare for the technical assessment.
Cyber Essentials & PlusISO 27001
Bring a repeatable view of technical weaknesses into your information security management system, supporting decisions about risk, remediation and the evidence you maintain.
ISO 27001 supportPCI DSS
Use findings to support the patching and vulnerability-remediation work within your PCI DSS programme. Formal validation, including any required ASV scans, remains a separate activity.
Take a look inside NEST.
Explore the dashboard and see how devices, vulnerabilities and issues come together in the live demo.
Open the live demo (opens in a new tab)
No card. No trial.
Common questions.
How does NEST check our devices?
A small software agent is installed on each enrolled endpoint. NEST brings the resulting vulnerability and configuration findings into a daily view, with related findings grouped into issues your team can work through.
Can our MSP use NEST alongside us?
Yes. Each organisation has unlimited user accounts and one MSP access seat, so your internal team and external support can work from the same information.
Does NEST replace penetration testing?
No. NEST provides recurring checks for known vulnerabilities and configuration issues. Penetration testing adds manual investigation of how weaknesses could be exploited and the impact they could have.
Does NEST provide Cyber Essentials certification?
NEST supports ongoing vulnerability management and preparation for assessment. Certification is awarded separately after the relevant scheme requirements have been assessed.
What is the design-partner option?
For organisations that want closer collaboration with the NEST team, the design-partner option includes fortnightly standups and custom support. Get in touch to discuss what your team needs.