How to Conduct a Vulnerability Assessment

A vulnerability assessment is a structured review of the software, systems and services in your environment to identify known weaknesses (CVEs), rate their real-world risk, and decide what to patch, mitigate, or accept. Unlike a one-off penetration test, it's a continuous process — new CVEs land every day and your inventory shifts every week.

You cannot assess what you cannot see. Start by listing the assets in scope: internet-facing hosts, internal servers, endpoints, containers, and SaaS with sensitive data. Capture vendor, product and version for each — that's what maps a CVE to your environment.

Run an authenticated or agent-based scan to enumerate installed software and expose CVEs. VulnMonitor ships a lightweight PC and network agent from the Scans page — the results flow straight into your organization's dashboards.

A raw CVE list is noise. Filter and rank with:

• CISA KEV — actively exploited in the wild.
• EPSS — probability of exploitation in the next 30 days.
• CVSS — theoretical severity, mostly to break ties.
• Exposure — is the vulnerable service reachable from the internet?
• Asset criticality — crown-jewel or isolated?

The Priority Action Matrix combines these into four action buckets so a team of any size knows what to touch first.

Every prioritized item gets an owner and an SLA proportional to risk: KEV/critical exposed within 72 hours, high within a week, medium within a month. Track the SLA — not the ticket count — on the Remediation Momentum dashboard.

A vulnerability assessment isn't done when the report ships — it's done when the loop keeps running. Rescan on a cadence, feed new CVEs in daily, and review CWE trends monthly to fix categories of bugs rather than instances. See the CVE & CVSS Basics guide for the underlying data model.