Vulnerability Assessment: Definition and How It Fits in VAPT
Vulnerability assessment (VA) is the systematic identification and prioritisation of known weaknesses in your systems. It uses automated scanners (Nessus, Qualys, Nuclei, Burp active, Trivy, Semgrep) augmented with manual review, and produces a prioritised list of findings with CVSS scores.
It is not the same as penetration testing. VA tells you what's weak; penetration testing tells you whether those weaknesses can actually be used to compromise you.
VA vs Penetration Testing
| Vulnerability Assessment | Penetration Testing | |
|---|---|---|
| Primary question | What weaknesses exist? | Can those weaknesses be exploited? |
| Approach | Broad, scan-driven | Depth-focused, attacker-simulated |
| Typical output | Prioritised list with CVSS | Exploit-chain narrative + business impact |
| Automation | Heavy | Light (a tester drives it) |
| Required cadence | Monthly or quarterly | Annual (minimum) |
Buyers of security services in India often ask for them as a combined VAPT engagement; that's a packaging choice, not a methodology one.
When Vulnerability Assessment Is Required
- PCI DSS Requirement 11.2 — internal and external vulnerability scans at least quarterly and after significant change.
- ISO 27001 Annex A.12.6.1 — technical vulnerability management; evidence is typically scan reports plus a tracked remediation workflow.
- SOC 2 CC7.1 — monitoring for vulnerabilities and threats. Scans are the expected evidence.
- RBI Cybersecurity Framework — periodic VAPT for all banks, with scope defined by criticality.
See VAPT for the paired penetration-testing side.
What a Credible VA Report Includes
- Scope: targets scanned (CIDR ranges, hostnames, URLs), tooling, time window, credentialed vs non-credentialed.
- Findings: each with CVSS, affected asset, remediation guidance, and evidence (payload, request, screenshot).
- Prioritisation: not just CVSS — grouping by asset criticality and exploitability.
- False-positive handling: documented exclusions with justification.
- Delta from previous scan: new findings vs resolved findings.
Red flag: a VA report that is a 500-page scanner PDF export with no triage. That's data, not analysis.
Internal vs External VA
- External VA: run from outside your perimeter. What an attacker sees. Required by PCI DSS and most other frameworks.
- Internal VA: run from inside your network. What an attacker sees after initial access. Catches lateral-movement opportunities and should be run with privileged credentials.
Both are expected in a mature program.
Common Pitfalls
- Scans with no remediation workflow. Finding things you don't fix is worse than not scanning.
- Credentialed scans without credentials. Non-credentialed scans miss ~70% of real issues in authenticated applications.
- Compliance-only cadence. Quarterly scans for PCI don't catch issues introduced on a Monday after a Friday scan. Pair with continuous monitoring where cost allows.