Vulnerability Assessment

Vulnerability assessment identifies weaknesses without exploiting them. Penetration testing (pen testing) goes further by attempting to exploit vulnerabilities to demonstrate real-world impact. Assessments are faster and safer; pen testing is more invasive but proves exploitability. Many organizations use assessments as a rapid health check, followed by targeted pen testing on high-risk systems.

Prioritization uses severity (CVSS score), exploitability (is an exploit publicly available?), and business impact (criticality of affected system). A critical vulnerability in a non-critical system may be lower priority than a medium-severity flaw in a critical application. Organizations establish patching policies defining timelines based on severity and asset criticality.

CVSS (Common Vulnerability Scoring System) is a standardized scale (0–10) quantifying vulnerability severity. CVSS 9.0–10.0 is Critical, 7.0–8.9 is High, etc. Standardized scoring enables consistent communication across organizations and tools, supporting risk prioritization and compliance reporting.

No. Zero-day vulnerabilities are unknown to the broader security community and are absent from vulnerability databases. Scanners can only detect known, documented vulnerabilities. Detection of zero-days typically requires manual code review, security research, or exploitation by sophisticated attackers. This limitation is why defense-in-depth (layered security) is essential.