In 2025, the NIST National Vulnerability Database registered over 40,000 new vulnerabilities (CVEs). The average organization has hundreds, or even thousands, of unpatched security gaps in its infrastructure, often without knowing they exist. Vulnerability assessment is a systematic process that allows you to find them before attackers do. In this article, we explain what vulnerability assessment is exactly, how to conduct it step by step, and what tools and practices to implement to effectively manage IT infrastructure security.
Definition of vulnerability assessment
Vulnerability assessment is a systematic process of identifying, analyzing, classifying, and prioritizing security gaps in information systems, networks, applications, and IT infrastructure. The goal is to create a complete picture of an organization’s exposure to cyber threats and to deliver an organized list of vulnerabilities requiring remediation.
Unlike penetration testing, vulnerability assessment does not involve actively exploiting discovered gaps. VA answers the question “what vulnerabilities exist in our infrastructure?”, while pentests verify “whether and how they can be exploited?”. Both approaches are complementary and together form the foundation of proactive vulnerability management.
A typical vulnerability assessment includes:
- Automated scanning — using specialized tools to detect known vulnerabilities (CVEs) in operating systems, network services, and applications.
- Configuration analysis — verifying system settings against security best practices and benchmarks (CIS Benchmarks, DISA STIG).
- Risk classification — evaluating each vulnerability according to the CVSS standard with business context taken into account.
- Reporting — documenting results with prioritization and remediation recommendations.
Vulnerability assessment vs penetration testing vs red team
Organizations often confuse these three approaches to security evaluation. Although they complement each other, they differ fundamentally in terms of objectives, methodology, and scope.
| Aspect | Vulnerability assessment | Penetration testing | Red team |
|---|---|---|---|
| Objective | Identification of known vulnerabilities | Exploitation of vulnerabilities and impact assessment | Simulation of a real APT attack |
| Approach | Automated + manual verification | Manual with tools | Manual, multi-vector |
| Scope | Broad (entire infrastructure) | Defined (selected systems) | Unrestricted (organization as a target) |
| Depth | Shallow (identification) | Deep (exploitation) | Very deep (attack chains) |
| Duration | Hours-days | Days-weeks | Weeks-months |
| Frequency | Continuous/monthly/quarterly | Annual/semi-annual | Annual |
| Cost | Low-medium | Medium-high | High |
| Output | List of vulnerabilities with CVSS | Report with exploitation evidence | Report with attack chains and strategic recommendations |
Vulnerability assessment is the foundation — without regular scanning, you don’t know what gaps exist in your infrastructure. Penetration tests verify whether detected vulnerabilities can actually be exploited. Red team checks whether the entire security ecosystem (people, processes, technology) works effectively against an advanced adversary.
Vulnerability assessment process step by step
An effective vulnerability assessment consists of eight stages, each of which is essential for the credibility and value of the results.
Planning and scope definition
Before scanning begins, the scope of the assessment must be precisely defined. This includes:
- Identifying the systems, networks, and applications covered by the scan.
- Establishing time windows (especially for production systems).
- Defining exclusions — systems that cannot be scanned (e.g., legacy systems sensitive to aggressive scans).
- Defining roles and responsibilities — who scans, who analyzes, who remediates.
- Establishing communication policies — who to notify about scanning and results.
Discovery — asset inventory
You cannot protect what you don’t know about. Asset discovery is the process of identifying all devices, systems, and services on the network. It includes active network scanning (Nmap, asset discovery in VA platforms), passive monitoring of network traffic, integration with CMDB and asset management systems, and identification of shadow IT — unauthorized devices and services.
Many organizations discover 10 to 30% more assets at this stage than they had in their records. It is precisely these unknown assets that most often constitute the weakest link.
Vulnerability scanning
The actual scanning involves comparing the configuration and software versions of detected systems against known vulnerability databases (NVD, vendor advisories). We distinguish two types of scanning:
- Credentialed scanning — the scanner logs into the system and checks installed packages, configurations, and permissions. It delivers significantly more accurate results and fewer false positives.
- Uncredentialed scanning — the scanner analyzes the system from the outside, examining open ports, service banners, and query responses. It simulates the perspective of an external attacker.
The best practice is to use both approaches: credentialed scans for a complete picture, uncredentialed scans for verifying external exposure.
Results analysis
Raw scanning results require expert analysis. Automated scanners generate dozens, or even hundreds, of results, not all of which are equally significant. At this stage, verification of results and elimination of false positives takes place, correlation of vulnerabilities across systems, identification of patterns (e.g., missing patches on a group of servers), and contextualization — assessing how a vulnerability relates to the specific environment.
Prioritization
Not all vulnerabilities require immediate remediation. Prioritization is based on the CVSS score (described in detail in the next section), but supplemented with business context:
- Is the system accessible from the internet?
- What data does it process (personal data, financial data, IP)?
- Does a known exploit exist (check in CISA KEV — Known Exploited Vulnerabilities)?
- How critical is the system for business continuity?
A CVSS 7.0 vulnerability on an internet-facing payment server is realistically more important than a CVSS 9.5 vulnerability on an isolated test server.
Reporting
A vulnerability assessment report should be tailored to the audience:
- Technical report — detailed list of vulnerabilities with CVE ID, CVSS score, description, detection evidence, and remediation steps. For the IT and security team.
- Executive summary — overview of the security posture, key risks, comparison with previous scans, priority recommendations. For management and decision-makers.
A good report also includes trend comparisons: how many vulnerabilities were added since the last scan, what is the average remediation time, how is the overall exposure changing.
Remediation
The remediation plan should specify concrete corrective actions for each vulnerability with assigned responsibility and deadlines. Typical actions include:
- Patching — installing security patches (the most common form of remediation).
- Configuration change — disabling unnecessary services, changing settings.
- Compensation (workaround) — when a patch is not available: network segmentation, additional firewall rules, virtual patching via WAF/IPS.
- Risk acceptance — a documented decision to consciously leave a vulnerability unpatched (e.g., a legacy system with no available patches) with a description of the justification and compensating measures.
Rescan — remediation verification
After implementing fixes, a rescan is necessary to confirm that vulnerabilities have been effectively removed. The rescan should cover exactly the same systems and use identical scanning profiles as the original scan. This stage closes the process loop and provides documented proof that remediation was effective — which is particularly important in the context of audits and regulatory requirements.
CVSS — the standard for vulnerability criticality assessment
CVSS (Common Vulnerability Scoring System) is an open standard for assessing vulnerability criticality, maintained by the FIRST organization. The currently applicable version is CVSS v4.0 (published in 2023), although CVSS v3.1 is still widely used.
The CVSS score consists of three metric groups:
- Base Score — vulnerability properties independent of the environment (attack vector, complexity, required privileges, impact on confidentiality/integrity/availability).
- Temporal Score — factors that change over time (exploit availability, patch availability, information certainty).
- Environmental Score — adaptation to a specific organization’s environment (asset criticality, existing compensating controls).
Vulnerability classification by CVSS
| Level | CVSS Score | Remediation time | Example |
|---|---|---|---|
| Critical | 9.0–10.0 | Immediately (24-48h) | Unauthenticated RCE (Log4Shell, EternalBlue) |
| High | 7.0–8.9 | Within 7 days | SQL injection, privilege escalation |
| Medium | 4.0–6.9 | Within 30 days | Stored XSS, information disclosure |
| Low | 0.1–3.9 | Within 90 days or risk acceptance | Verbose error messages, missing headers |
The CVSS Base Score alone is not sufficient for decision-making. Supplement it with:
- EPSS (Exploit Prediction Scoring System) — the probability that a vulnerability will actually be exploited within 30 days.
- CISA KEV — a list of vulnerabilities actively exploited in attacks (these always have the highest priority, regardless of CVSS).
- Business context — asset criticality, internet exposure, data being processed.
Vulnerability assessment tools
The choice of tool depends on the scanning scope, budget, and infrastructure specifics. Below is a comparison of the most popular solutions.
Commercial solutions
| Tool | Vendor | Strengths | Use case |
|---|---|---|---|
| Nessus Professional | Tenable | Largest plugin database (200,000+), low false positive rate | On-premise infrastructure, compliance |
| Qualys VMDR | Qualys | Cloud-native, asset inventory, auto-prioritization | Large environments, multi-cloud |
| Rapid7 InsightVM | Rapid7 | Real risk scoring, SIEM/SOAR integration | Organizations with a mature SOC |
| Tenable.io | Tenable | Cloud-managed Nessus, container scanning | Hybrid environments |
Open source solutions
| Tool | Strengths | Limitations |
|---|---|---|
| OpenVAS / Greenbone | Free, large test database (NVT), active community | Slower than commercial tools, requires infrastructure management |
| Nuclei | Fast, template-based, ideal for CI/CD | Requires expertise to write custom templates |
| OWASP ZAP | Best free web scanner, good documentation | Web applications only |
Cloud-native tools
Major cloud providers offer built-in VA solutions: AWS Inspector (EC2 instances, container images, Lambda), Azure Defender for Cloud (virtual machines, containers, databases), and GCP Security Command Center (GCP resources, web security scanner). These tools work excellently within their ecosystems but cannot replace a dedicated VA solution for multi-cloud or hybrid environments.
Types of vulnerability assessment
Depending on scope and objective, we distinguish several types of vulnerability assessment:
Network vulnerability assessment scans network infrastructure: routers, switches, firewalls, servers, workstations. It identifies open ports, outdated services, weak protocol configurations, and missing system patches. This is the most common and broadest type of VA.
Web application vulnerability assessment focuses on web applications and APIs. It detects vulnerabilities from the OWASP Top 10 list: injection, broken authentication, security misconfiguration, XSS, SSRF, and others. It uses both automated scans (DAST) and source code analysis (SAST).
Cloud vulnerability assessment evaluates cloud resource configuration against best practices (CIS Benchmarks for AWS/Azure/GCP). It checks IAM permissions, storage bucket configuration, data encryption, security groups, and network ACLs.
OS vulnerability assessment focuses on operating systems — missing patches, weak configurations, unnecessary services, user permissions. It covers Windows, Linux, and macOS systems alike.
Database vulnerability assessment analyzes database servers (Oracle, MS SQL, PostgreSQL, MySQL) for default passwords, excessive permissions, missing patches, and unencrypted connections.
IoT/OT vulnerability assessment covers Internet of Things devices and industrial control systems (SCADA, PLC). This type requires particular caution — aggressive scanning can disrupt the operation of industrial devices. Passive monitoring techniques and dedicated tools (Claroty, Nozomi Networks) are used here.
Continuous vulnerability management — from point-in-time scans to a continuous process
The traditional approach to VA — quarterly scans commissioned from an external provider — is insufficient. New vulnerabilities are published daily, infrastructure changes dynamically, and attackers do not wait for a quarterly scanning window.
Continuous vulnerability management (CVM) is a model in which scanning and vulnerability management is a continuous process:
- Daily or weekly automated scans of critical and internet-facing systems.
- Immediate ad hoc scans after the publication of critical CVEs (e.g., a zero-day in popular software).
- Automatic assignment of vulnerabilities to system owners through integration with CMDB.
- Automatic creation of remediation tickets in ITSM systems (ServiceNow, Jira).
- Real-time dashboards with vulnerability management KPIs.
- CI/CD integration — scanning container images and artifacts before deployment.
CVM requires an appropriate platform (Qualys VMDR, Tenable.io, Rapid7 InsightVM), defined processes, and a clear division of responsibilities. At nFlo, we implement continuous vulnerability management programs tailored to the scale and maturity of the organization — from basic quarterly scans to advanced CVM with SOC integration.
Vulnerability assessment in the context of NIS2 and the National Cybersecurity System Act
The NIS2 Directive (Network and Information Security Directive 2), transposed into Polish law through the amendment of the National Cybersecurity System Act, imposes on essential and important entities the obligation to implement cybersecurity risk management measures. Vulnerability assessment is one of the foundations for meeting these requirements.
NIS2 requirements for vulnerability management
- Article 21(2)(d) — vulnerability handling, vulnerability disclosure.
- Article 21(2)(e) — policies and procedures for assessing the effectiveness of risk management measures (including regular security testing).
- Article 21(2)(g) — basic cyber hygiene practices, including patch management.
Organizations covered by NIS2 should implement:
- Regular (at minimum quarterly) vulnerability assessment of the entire infrastructure.
- Defined SLAs for vulnerability remediation depending on criticality (e.g., Critical: 48h, High: 7 days).
- Process documentation — who scans what, when, and how remediation proceeds.
- Annual penetration tests as a supplement to the VA program.
- Reporting to management on the state of vulnerability management.
Failure to implement these measures may result in administrative fines of up to EUR 10 million or 2% of annual global turnover (for essential entities).
Building a vulnerability management program — KPIs and metrics
A mature vulnerability management program requires measurable KPIs that allow tracking effectiveness and justifying investments:
MTTD (Mean Time to Detect) — average time from CVE publication to detection of the vulnerability in the infrastructure. Target: under 24 hours for Critical vulnerabilities on the CISA KEV list, under 7 days for other Critical and High vulnerabilities.
MTTR (Mean Time to Remediate) — average time from vulnerability detection to its remediation. Industry benchmarks: Critical — 15 days (target: 48h), High — 30 days (target: 7 days), Medium — 90 days (target: 30 days).
Vulnerability coverage — percentage of assets covered by regular scans. Target: 100% of production assets, minimum 95% of all assets.
Scan frequency — frequency of scanning. Target: at minimum once per month for internet-facing systems, once per quarter for internal systems.
Remediation rate — percentage of vulnerabilities remediated within the defined SLA. Target: 95% for Critical, 90% for High.
Risk score trend — trend of the overall risk level over time. Should show a declining or stable tendency.
Regular reporting of these metrics to management builds awareness and justifies the security budget. At nFlo, having completed over 500 security projects for 200+ clients, we see a clear correlation between the maturity of a VM program and an organization’s resilience to incidents.
Challenges in vulnerability management
Even the best-planned VA program encounters real obstacles:
False positives and false negatives
Automated scanners are not perfect. False positives (false alarms) generate unnecessary work and undermine trust in the results. False negatives (missed vulnerabilities) give a false sense of security. Solution: use credentialed scans (which drastically reduce false positives), regularly verify results manually, and supplement VA with pentests.
Asset discovery and shadow IT
You cannot scan what you don’t know about. Unauthorized devices, undocumented servers, cloud instances created outside IT control — shadow IT is one of the biggest blind spots of a VM program. Solution: implement continuous asset discovery, integrate VA tools with CMDB, monitor network traffic for new devices.
Patch management and maintenance windows
Detecting a vulnerability is half the battle — the other half is fixing it. Many organizations struggle with patching delays: production systems require maintenance windows, legacy systems have no available patches, and IT teams are overloaded. Solution: automate patch management where possible, define clear remediation SLAs, escalate unremediated Critical vulnerabilities to management.
Information overload
A typical scan of a medium-sized infrastructure generates hundreds, or even thousands, of results. Without effective prioritization, teams drown in data and don’t know where to start. Solution: apply risk-based prioritization (CVSS + EPSS + business context), focus on actively exploited vulnerabilities (CISA KEV), automate low-priority items.
Coordination between teams
VA requires collaboration between security, IT operations, development teams, and business. A lack of clear division of responsibilities leads to a situation where no one feels responsible for remediation. Solution: define a RACI matrix, automate ticket assignment to system owners, report compliance to management.
How to get started — practical recommendations
If your organization does not yet have a formal vulnerability assessment program, start with these steps:
- Asset inventory — create a current list of all systems, applications, and network devices.
- Tool selection — for small organizations, OpenVAS or Nessus Essentials (free for up to 16 IPs); for medium and large organizations, Nessus Professional, Qualys, or Rapid7.
- First scan — conduct a credentialed scan of the entire infrastructure, starting with critical systems.
- Analysis and prioritization — focus on Critical and High vulnerabilities, especially those with available exploits.
- Remediation — fix the most urgent vulnerabilities, document risk acceptance decisions.
- Regularity — establish a schedule of regular scans (at minimum quarterly).
- Maturing — gradually transition from point-in-time scans to continuous vulnerability management.
Vulnerability assessment is not a one-time project, but a continuous process. Each cycle of scanning, analysis, and remediation improves the organization’s security posture. Combined with penetration testing, SOC monitoring, and compliance management, VA creates a solid foundation of cyber resilience — particularly important in the context of NIS2 requirements and the growing threat landscape.
Related concepts
Learn about the key terms related to this article in our cybersecurity glossary:
- Vulnerability assessment — A systematic process of identifying, analyzing, and classifying security gaps…
- Penetration testing — A controlled process of simulating an attack on an IT system to detect vulnerabilities…
- Cybersecurity — A set of techniques, processes, and practices for protecting IT systems, networks, and data…
- Risk assessment — The process of identifying and analyzing threats affecting organizational security…
- SIEM — A system that integrates log collection, event correlation, and security alerting…
Learn more
Explore related articles in our knowledge base:
- What are penetration tests? Key information
- What is cybersecurity? Definition, pillars, threats, and best practices
- What is SIEM? Definition, components, benefits, and challenges
Check our services
Need support with vulnerability management? Check out:
- IT vulnerability management — continuous process of vulnerability identification and remediation
- Penetration testing — security verification through simulated attacks
- SOC — Security Operations Center — 24/7 security monitoring
Related topics
See also:
