Vulnerability assessment
A vulnerability assessment systematically examines a system, product, or environment to identify and evaluate security weaknesses within a defined scope.
More than a scanner export
A scanner can identify possible weaknesses, but someone still needs to establish whether the findings apply. Configuration review, version information, and manual examination can help distinguish a real issue from an incorrect match. NIST’s testing guide describes multiple assessment techniques and their limitations.
Keep the tested systems, available credentials, exclusions, and assessment date with the findings. An unauthenticated view of a service may reveal less than a review with authorized access. Neither view covers systems that were left out.
Finding a weakness and exploiting it are different claims
A penetration test attempts to demonstrate what an attacker could do with weaknesses. A vulnerability assessment can identify and evaluate issues without demonstrating an entire intrusion path. The methods can overlap, so read the agreed scope rather than relying on the engagement’s name.
The technical follow-on article explains how a separately authorized operation can test a specific access question. It is not a substitute for a broad vulnerability assessment.
Findings also need business context before they become a risk assessment. An issue’s severity does not, by itself, establish the likelihood or consequences of an incident in your environment.