A vulnerability assessment is a systematic review of your systems, networks, and applications to identify security weaknesses, rank them by risk, and produce a prioritized list of what to fix. It’s mostly automated: scanning tools compare what’s running in your environment against vulnerability databases of known flaws, misconfigurations, and missing patches. Where a penetration test proves what an attacker could do, a vulnerability assessment tells you everything an attacker might try. Done monthly or continuously, it’s the control that keeps a newly disclosed vulnerability from sitting unpatched on your firewall for six months.
In this guide
- Why vulnerability assessments matter
- Types of vulnerability assessments
- The 5-step process
- How vulnerabilities are scored
- Vulnerability assessment tools
- Vulnerability assessment vs. penetration testing
- What a vulnerability assessment costs
- Common mistakes
- How Sixwatch runs vulnerability management
- FAQ
- Glossary
Why vulnerability assessments matter
Thousands of new vulnerabilities are published every month — more than 48,000 CVEs in 2025 alone, a record, after roughly 40,000 in 2024. Attackers automate scanning for them across the whole internet, and exploitation of a newly disclosed flaw in a firewall or VPN can begin within days of publication. Most ransomware groups gain access through vulnerabilities that had patches available, in some cases for months.
A vulnerability assessment closes that gap. It finds:
- Missing operating system and application patches
- Outdated software with known exploits
- Misconfigurations: open ports, default credentials, weak encryption, unnecessary services
- Exposed systems that shouldn’t be internet-facing
- Web application flaws such as SQL injection and cross-site scripting
- Cloud misconfigurations: public storage, over-permissive roles, legacy authentication
- Unauthorized or forgotten devices on the network
Compliance frameworks require it: PCI DSS mandates quarterly scans, HIPAA’s risk analysis depends on it, CMMC and SOC 2 expect regular scanning, and cyber insurers ask.
Types of vulnerability assessments
| Type | What it examines | How often |
|---|---|---|
| Network (external) | Internet-facing systems: firewalls, VPNs, web and mail servers, remote access | Monthly or continuous |
| Network (internal) | Servers, workstations, printers, IoT, and network equipment from inside the network | Monthly |
| Host / endpoint | Individual servers and workstations: patches, configuration, installed software | Continuous via agents |
| Web application | Custom and hosted apps for OWASP Top 10 flaws | With each release, or monthly |
| Database | Database configuration, access controls, patching, injection exposure | Quarterly |
| Cloud configuration | Microsoft 365, Azure, AWS, Google Cloud settings and identity | Continuous |
| Wireless | Wi-Fi encryption, rogue access points, segmentation | Quarterly |
| Authenticated vs. unauthenticated | Whether the scanner logs in (finds far more) or tests from outside | Both |
Most small and mid-size businesses need external network, internal network, endpoint, and cloud configuration assessments as a baseline.
The 5-step vulnerability assessment process
1. Define scope and inventory assets
You can’t scan what you don’t know about. Build an asset inventory: every server, workstation, network device, cloud service, and application, with an owner. Unknown devices found during scanning get investigated; they’re often the biggest risk.
2. Scan
Automated tools probe each asset, identify software versions and configurations, and match them against vulnerability databases (the National Vulnerability Database, vendor advisories, threat intelligence feeds). Authenticated scans, where the tool logs in, find far more than unauthenticated ones.
3. Analyze and prioritize
Raw scan output is overwhelming: hundreds or thousands of findings. Vulnerability analysis filters out false positives and ranks the rest by:
- Severity (CVSS score)
- Whether an exploit is publicly available or actively used (CISA‘s Known Exploited Vulnerabilities catalog, EPSS scores)
- The asset’s importance and exposure (internet-facing domain controller vs. internal test box)
- Compensating controls already in place
The result is a short list of what actually matters this month, not a 400-page PDF.
4. Remediate
Patch, reconfigure, upgrade, isolate, or decommission. Assign owners and deadlines by severity: critical and exploited within days, high within two weeks, medium within a month. Document exceptions where a fix isn’t possible and what compensating control covers it.
5. Verify and repeat
Rescan to confirm fixes worked. Track metrics over time: number of open criticals, average time to remediate, percentage of assets scanned. Then do it again next month. This continuous cycle is called vulnerability management.
How vulnerabilities are scored
- CVE (Common Vulnerabilities and Exposures): the ID for a specific known flaw, e.g., CVE-2026-12345.
- CVSS (Common Vulnerability Scoring System): a 0–10 severity score. Critical 9.0–10, High 7.0–8.9, Medium 4.0–6.9, Low 0.1–3.9.
- EPSS (Exploit Prediction Scoring System): probability the vulnerability will be exploited in the next 30 days.
- CISA KEV: the government’s list of vulnerabilities confirmed to be actively exploited. Anything on it is a top priority regardless of CVSS.
A CVSS 7.5 vulnerability on the KEV list, sitting on your internet-facing VPN, beats a CVSS 9.8 on an isolated internal server with no known exploit. Prioritization is about exposure and exploitation, not just the score.
Vulnerability assessment tools
| Category | Examples | Notes |
|---|---|---|
| Network and infrastructure scanners | Tenable Nessus, Qualys VMDR, Rapid7 InsightVM, OpenVAS (open source) | The core of most programs |
| Endpoint-integrated | Microsoft Defender Vulnerability Management, CrowdStrike Spotlight, SentinelOne | Continuous, agent-based; often bundled with EDR |
| Web application scanners | Burp Suite, OWASP ZAP (open source), Acunetix, Invicti | For custom and hosted apps |
| Cloud posture management | Microsoft Defender for Cloud, Wiz, Prisma Cloud, Orca | Configuration and identity risk in cloud platforms |
| Attack surface management | Censys, Shodan Monitor, CyCognito | Finds what’s exposed from the outside, including things you forgot |
| MSP / managed platforms | Bundled scanning within managed security services | Scanning plus the remediation, which is what most businesses actually need |
Tools produce findings. The value is in the analysis and the fixing, which is why most businesses under 250 employees get vulnerability management through a managed cybersecurity provider rather than buying a scanner.
Vulnerability assessment vs. penetration testing
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Goal | Find and list all known weaknesses | Prove which weaknesses lead to compromise |
| Method | Automated, broad | Manual, deep |
| Frequency | Monthly to continuous | Annual |
| Cost | Low; often included in managed security | $5,000 – $50,000+ |
| Finds | Missing patches, misconfigurations, known CVEs | Attack chains, logic flaws, what scanners miss |
Vulnerability assessment is the ongoing hygiene. Penetration testing is the annual exam. Businesses need both, and the pen test findings are far shorter when the vulnerability program is working.
What a vulnerability assessment costs
| Option | Typical cost |
|---|---|
| One-time external assessment | $1,000 – $5,000 |
| One-time external + internal assessment | $2,500 – $10,000 |
| Scanner licensing (self-managed) | $2,000 – $10,000 / year plus staff time |
| Continuous vulnerability management via MSP | Included in managed security plans at $50 – $150 / user / mo, or $5 – $15 / device / mo standalone |
| PCI ASV quarterly scans | $500 – $2,000 / year |
The cheapest option, a one-time scan, has the least value; vulnerabilities found in March are irrelevant by June. Continuous management is what reduces risk.
Common mistakes
- Scanning without an asset inventory. The unscanned server is the one that gets breached.
- Unauthenticated scans only. They miss most of what’s wrong inside the operating system.
- Treating the report as the deliverable. A 300-page PDF nobody acts on is worse than no scan; it documents that you knew.
- Prioritizing by CVSS alone. Ignore exposure and exploitation data and you’ll patch the wrong things first.
- No remediation deadlines or owners. Findings age indefinitely.
- Ignoring “low” findings that chain together into a critical path.
- Scanning once a year to satisfy an auditor.
- Forgetting cloud and SaaS. Misconfigured Microsoft 365 is a vulnerability too.
How Sixwatch runs vulnerability management
Sixwatch includes continuous vulnerability management in every managed cybersecurity plan for businesses across Tampa Bay and Cincinnati: an asset inventory, authenticated internal and external scanning, cloud configuration assessment, prioritization using exploitation data rather than raw scores, and remediation with defined timelines, since we’re the team doing the patching. Monthly reports show what was found, what was fixed, and what’s open, in language a business owner or auditor can read.
Founder John Owens brings 25+ years of IT and security experience. Every plan includes a 30-minute emergency remote response and same-day onsite support, and our 5.0 Google rating includes clients whose scan reports got shorter every month.
The best IT service, security, and support in Tampa. Thank you for the quick response and guidance with our network issues.
Kat
Book a 15-minute call or request a proposal.
Frequently asked questions
What is a vulnerability assessment? A systematic, mostly automated review of systems, networks, and applications to identify known security weaknesses, rank them by risk, and produce a prioritized remediation list.
What are the types of vulnerability assessments? Network (external and internal), host or endpoint, web application, database, cloud configuration, and wireless. Each can be run authenticated (logged in) or unauthenticated.
How often should a vulnerability assessment be done? Monthly at minimum; continuously for endpoints and cloud. PCI DSS requires quarterly external scans by an approved vendor plus scans after significant changes.
What is the difference between a vulnerability assessment and a penetration test? An assessment is automated and lists weaknesses. A penetration test is manual and demonstrates which weaknesses can actually be exploited and how far they lead.
What tools are used for vulnerability assessment? Nessus, Qualys, Rapid7 InsightVM, and OpenVAS for networks; Microsoft Defender Vulnerability Management and EDR-integrated tools for endpoints; Burp Suite and ZAP for web apps; cloud posture tools for Microsoft 365 and Azure.
What is a CVSS score? A 0–10 rating of a vulnerability’s severity. Scores above 9 are critical. Prioritization should also consider whether the flaw is exposed and actively exploited.
How much does a vulnerability assessment cost? One-time assessments run $1,000 to $10,000. Continuous vulnerability management is typically included in managed security services.
Glossary
- Asset inventory: The list of every system, device, and application in scope.
- Authenticated scan: A scan performed with login credentials, revealing internal configuration and patch state.
- CVE: The standard identifier for a publicly known vulnerability.
- CVSS: The standard severity score for a vulnerability.
- EPSS: A model predicting the probability of exploitation.
- False positive: A reported vulnerability that doesn’t actually exist.
- KEV: CISA’s Known Exploited Vulnerabilities catalog.
- Remediation: Fixing a vulnerability by patching, reconfiguring, or removing the affected system.
- Vulnerability management: The continuous cycle of assessment, prioritization, remediation, and verification.
When was your last vulnerability scan, and who fixed the findings? Book a 15-minute call · Request a proposal