What it examines
A vulnerability assessment looks for known and potential weaknesses in the agreed systems, such as missing patches, insecure configurations and exposed services. Findings are ranked so that your team can decide what to investigate and fix first. Identifying a weakness is different from proving that it can be exploited. The assessment shows where to look, and a penetration test can then validate what matters most.
Questions it helps answer
- Which systems and services contain known weaknesses?
- Which findings should we address first, given their likely impact?
- Do our configurations and patch levels match what we intended?
When it is useful
- Establishing a baseline before a significant change, or after a period of rapid growth.
- Building a prioritised remediation plan across a mixed estate.
- Preparing for ISO 27001, NIS2 or customer assurance questions about how weaknesses are identified.
How the engagement is scoped
- Coverage is defined during scoping: systems, networks, applications and exclusions are agreed in writing.
- Automated discovery can be complemented by manual review where agreed, to reduce false positives and add context.
- Identification is different from proving exploitability. Validation is a separate step, agreed when needed.
- Findings need interpretation in the context of your environment, so ratings are reviewed against your systems and risks.
Typical deliverables
These are typical deliverables. The actual scope and deliverables are agreed for each engagement.
- Assessed scope and coverage, including what was excluded.
- Prioritised findings with supporting observations.
- Recommended remediation and follow-up steps.
Relevant assurance context
Technical findings can inform risk treatment, security improvements and assurance evidence. The appropriate assessment depends on your obligations, environment and objectives.
Testing supports a wider assurance programme; it does not establish compliance or certification on its own.