A vulnerability assessment is a systematic process of identifying, classifying and prioritizing vulnerabilities in systems, networks and applications.
Vulnerability assessment uses automated tools and manual techniques to discover known weaknesses in technology infrastructure. Unlike pentesting (which attempts to exploit vulnerabilities), assessment focuses on identification and cataloging. Severity is classified using systems like CVSS (Common Vulnerability Scoring System) and a risk-prioritized remediation plan is generated.
At minimum quarterly and after significant infrastructure changes. High-risk environments may require monthly or continuous scanning.
They are complementary. Vulnerability assessment broadly identifies known weaknesses. Pentesting validates whether those vulnerabilities are actually exploitable and measures real impact. A mature strategy includes both.
Need an assessment in this area?