A vulnerability assessment is a structured review that lists weaknesses and ranks them by how likely and how damaging each one is.
The product is a judged picture with scope, not a raw scanner file and not the year round fix program.
How it works
The review may include interviews, configuration checks, and scan results.
What matters is the ranking in your context and a clear statement of what was not tested.
An assessment can start and end as a project, for example before a peak season or a merger.
Management is the ongoing loop that keeps working after the report is filed.
Concrete examples
- A review of an internet shop before a peak season ranks five issues for the owners.
- An internal team assesses a new payroll system and writes what risk remains.
- A merger review assesses remote access at the company being acquired.
Protective measures
- Define scope and rules of engagement before any testing starts.
- Rank impact in your environment, not only a generic score from a tool.
- Name an owner for each finding in the delivered list.
- State what you did not test so leaders do not assume a wider clean result.
Related articles
What is vulnerability management? describes the ongoing program that continues after a ranked review is delivered.
What is vulnerability scanning? explains the automated probes that often feed this review but are not the review itself.
What is a vulnerability? defines the weakness that an assessment is trying to find and rank.