Vulnerability Assessment: What It Is, How It Works and When You Need One

A vulnerability assessment is a structured review that finds the known security weaknesses in your systems, confirms which are real and ranks them so you fix the most dangerous first. Typical findings are missing security updates, unsupported software, weak encryption, default passwords and services exposed that should not be. A good assessment ends with a short, prioritised list of fixes, not a raw export of thousands of scanner results.

It covers breadth rather than depth: every server, device, cloud service and web application in scope is checked against known vulnerabilities. That makes it the routine, repeatable layer of security testing that sits between less frequent manual tests.

What is a vulnerability assessment?

A vulnerability assessment combines automated scanning with human judgement to answer three questions: what do we have, what known weaknesses does it have, and which of those matter most? It is sometimes called a security vulnerability assessment or a cyber security vulnerability assessment; the meaning is the same. The NIST glossary defines it as a systematic examination of a system that checks whether its security measures are adequate and identifies where they fall short.

Three related terms are easy to confuse:

• A vulnerability scan is the automated step inside an assessment; our guide What is a vulnerability scan? explains how scanning works and how long a scan takes.
• A vulnerability assessment is the scan plus discovery, validation, prioritisation and reporting, carried out as a one-off or on a schedule.
• Vulnerability management is the ongoing programme that runs assessments, tracks fixes to deadlines and verifies them. Continuous threat exposure management (CTEM) builds on it by validating which exposures an attacker could actually use.

A penetration test goes further than an assessment by having a person try to exploit the weaknesses to prove real impact; our guide to penetration testing vs vulnerability scanning compares the two, and VAPT combines them in one engagement.

How do you conduct a vulnerability assessment? The five steps

A vulnerability assessment follows five steps, then a rescan once fixes are in place. Some guides group the same work into four stages (identification, analysis, risk assessment and remediation); the five steps below simply split identification into discovery and scanning.

1. Asset discovery and scoping. You cannot assess what you do not know about. The first step builds or checks the inventory of in-scope assets: IP ranges, hostnames, cloud accounts, web applications and endpoints. It often turns up forgotten test servers and unmanaged cloud services. Scope also covers scan windows, exclusions for fragile systems and the credentials needed for authenticated scanning.
2. Scanning. Scanners probe each asset and compare what they find against databases of published vulnerabilities (CVEs) and known misconfigurations. Authenticated scans log in and read installed software directly, so they find far more than unauthenticated scans, which can only infer versions from outside.
3. Validation. A person reviews the results to remove false positives and add context. A common example is a Linux server where the vendor has backported a security fix without changing the version number, so a version-based check reports a flaw that is already fixed. Validation also catches false negatives, such as hosts that blocked the scan.
4. Risk rating and prioritisation. Each confirmed finding is rated by technical severity, likelihood of exploitation and the importance of the asset. The section below explains how.
5. Reporting. The report gives an executive summary, each finding with the affected assets, its rating, the evidence and a specific fix, and a suggested owner and deadline. Comparing it with the previous report shows whether your exposure is shrinking.

After remediation, a rescan confirms each fix worked. PCI DSS builds this in: for internal scans, Requirement 11.3.1 expects high-risk and critical findings to be resolved and a rescan to confirm it, and external ASV scans are repeated until they pass.

How are vulnerabilities rated and prioritised?

Each confirmed finding gets a rating from severity, likelihood and context, because severity alone marks more issues “high” than most teams can fix at once. In an assessment report that means three inputs per finding:

• Severity: the CVSS base score, from 0.0 to 10.0, which says how bad a flaw would be if exploited, not how likely that is.
• Likelihood: the EPSS probability of exploitation in the next 30 days, and whether the flaw is already listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue.
• Context: whether the asset faces the internet, holds sensitive data or is critical to the business, which only someone who knows your estate can judge.

Here is how that changes the order of work (illustrative findings, not client data):

Risk-based ordering never overrides a fixed deadline. Cyber Essentials requires updates rated critical or high risk by the vendor, or fixing a vulnerability with a CVSS v3 base score of 7 or above, to be installed within 14 days of release, and PCI DSS Requirement 6.3.3 requires patches for critical vulnerabilities within one month of release. The NCSC’s vulnerability management guidance puts it simply: update by default, and triage and prioritise what an update cannot fix. Turning a rated list into owners and deadlines is the job of your wider vulnerability management programme.

What does a vulnerability assessment cover?

A vulnerability assessment can cover any part of your estate. Most are scoped by where the systems sit:

Automated web scanning (DAST) finds known and common issues, but not flaws in business logic or access control, which need a manual test. Endpoints such as laptops can be included through authenticated or agent-based scanning.

What are the types of vulnerability assessment?

There are five main types, named after what they examine: network, host, application, database and wireless. Most assessments combine several, and the scope table above shows how they map to external, internal and cloud systems.

Which vulnerability assessment tools are used?

Most assessments use a mix of commercial and open-source scanners, chosen for the type of system being checked. The examples below are tools commonly used across the industry, not a recommendation; the scanner matters less than the validation and prioritisation that follow it.

How often should you carry out a vulnerability assessment?

At least every three months for anything in PCI DSS scope, after every significant change, and more often for internet-facing systems. The main standards set these minimums:

The quarterly external scans for PCI DSS have to come from an Approved Scanning Vendor; see how PCI ASV scanning works and what a passing scan needs. The full requirements are in the PCI DSS v4.0.1 standard in the PCI SSC document library.

For Cyber Essentials Plus, running your own assessment a few weeks before the audit leaves time to fix missing updates before the assessor’s scans find them. Outside these rules, monthly scanning of internal and external systems, with a validated assessment at least quarterly, is a sensible baseline.

What is vulnerability testing?

Vulnerability testing usually means the scanning and validation steps of a vulnerability assessment: checking systems for known weaknesses and confirming which are real. Some providers use the term loosely to mean penetration testing, so ask whether a quote includes manual exploitation or only automated checks with review.

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment finds and ranks known weaknesses across many systems; a penetration test has a person try to exploit them to prove what an attacker could actually achieve. Most organisations need both, at different frequencies.

Our guide to penetration testing vs vulnerability scanning covers the differences in cost and depth, and VAPT services combine both in one engagement.

What are the limits of a vulnerability assessment?

A vulnerability assessment is only as good as its asset list and its scanner’s knowledge. It finds known weaknesses well, but it does not:

• Find flaws in business logic, such as one customer viewing another customer’s data.
• Show how several low-rated findings could be chained into a serious compromise.
• Cover assets nobody added to the scope.
• Stay current: it is a snapshot, and new vulnerabilities are published every day.

That is why assessments run on a schedule and are paired with periodic manual testing.

Why Sovereign Secure

• A PCI SSC Qualified Security Assessor company, so scanning is aligned with PCI DSS Requirement 11.3 and the evidence an assessor expects. External ASV scans are delivered through a PCI SSC Approved Scanning Vendor partner.
• An IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates, so we know what the CE+ scans look for.
• ISO 27001 certified ourselves, against the same standard whose control 8.8 sets the vulnerability management expectations above.
• Vulnerability scanning and penetration testing of internal and external networks, cloud, web applications and APIs.

Next step

If you need regular, validated scanning rather than a one-off report, our vulnerability scanning services cover internal and external scans, triage, remediation guidance and rescans, with PCI ASV scans through an approved partner. Call +44 161 523 5276 to discuss scope.