Vulnerability assessment
- Term
- Vulnerability assessment
- Exam
- CISA & CISM
- Definition
Identifying and ranking potential weaknesses without exploiting them.
- Explained
A vulnerability assessment identifies and ranks potential weaknesses, usually with scanners, without exploiting them. Authenticated scans see far more than unauthenticated ones, and prioritization should consider business criticality, not just severity scores.
- In practice
A scanner reports missing patches across 500 servers, ranked by severity.
- Often confused with
- Penetration test
- Exam angle
Authenticated scans find much more than unauthenticated ones.
- Related