Vulnerability assessment: what it is

In short

A vulnerability assessment answers the question "what known weaknesses are there in my systems?". It uses scanners that compare services, versions and configurations against up-to-date test databases, and produces a list of findings with their CVE, CVSS severity and the recommended fix. It is a non-invasive check: it looks for vulnerabilities, it does not try to exploit them.

How it works

Scans differ by vantage point and by target:

• external: starts from the internet and sees what an external attacker would see (public addresses, exposed services, certificates);
• internal: starts from the company network and simulates someone who is already inside, for example malware that arrived in an email;
• web application: tests websites, portals and online applications with web-specific checks;
• on the endpoints: an agent installed on PCs and servers reads software, versions and missing updates from inside the machine.

Automated tools get it wrong in two directions: they report problems that are not there (false positives) and miss some that are (false negatives). That is why a good assessment includes a manual review of the results by qualified staff.

Why it matters

Technical vulnerability management is required by all the main standards: ISO/IEC 27001 (control A.8.8), the CIS Controls, the NIS2 Directive. And it is of little use if done once a year: thousands of new vulnerabilities come out every month, and the systems on the network change. The value lies in continuity and in comparing one scan with the next: what is new, what has been resolved, what has been accepted and why.

A vulnerability assessment does not replace a penetration test, which checks how far an attacker can actually get. The guide vulnerability assessment and penetration test compared explains when you need one and when the other.

Example

A 40-person company runs its first internal scan and finds a NAS with three-year-old firmware, two printers whose administration panel is reachable with the factory password, and an old server still running an obsolete file-sharing protocol. None of the three appeared in the inventory. After the fixes, the next scan shows those findings closed and adds a new one: a laptop back from a trip without that month's updates. This is how a continuous assessment works.

Related terms

• Attack Surface Management: decides what needs scanning
• Patch management: closes the findings
• Hardening
• Penetration test