What is a Vulnerability Assessment?

A vulnerability assessment answers one question: what known weaknesses exist across my systems? It does not try to break in. That restraint is the point - it makes the process safe to run frequently and across everything you own.

What a scanner is actually doing

Most scanners work by fingerprinting. They identify the software and version behind each exposed service, then look that up against vulnerability databases such as the cve catalogue. Web scanners go further, sending crafted requests to detect classes of flaw like sql-injection or xss from the responses.

This is why version disclosure matters more than it appears to. Software announcing itself as an outdated release is telling every passing scanner exactly which exploits to try.

What scanners are good at

• Unpatched software and missing security updates
• Default or weak configuration, exposed admin interfaces
• Expired or misconfigured TLS
• Forgotten assets - the staging server nobody decommissioned
• Regression: something that was fixed and quietly came back

Run continuously, a scanner is a smoke detector. That is genuinely valuable and it is cheap.

What scanners systematically miss

Anything requiring understanding of your application's intent:

• broken-access-control - a scanner cannot know that user A should not see user B's invoice
• Business logic flaws - negative quantities, skipped payment steps, race conditions at checkout
• Chained attacks - three medium findings that combine into account takeover
• Anything behind meaningful authentication or multi-step workflows

These are the findings that end up on the front page of a breach report, and they need a human. See penetration-testing.

Reading the output honestly

Scanner reports are long and mostly informational. Two habits make them useful:

Rank by exposure, not just severity. A critical finding on an internal host behind a VPN is usually less urgent than a high on an internet-facing login page. cvss gives you a base score; only you know the context.

Expect false positives. Verify before you file the ticket. A team that has chased three phantom criticals will start ignoring the fourth, and the fourth will be real.