7.1.1. Assessment Types and Scoping

💡 First Principle: A vulnerability scanner is a tool; vulnerability assessment is a process. The scanner identifies potential vulnerabilities; the assessment validates findings, eliminates false positives, contextualizes risk, and produces actionable prioritized remediation plans. Raw scanner output is not an assessment — it is input to an assessment.

Scan types and their characteristics:

CVSS v3.1 score groups:

CVSS severity bands:

False positives vs. false negatives:

• False positive: Scanner reports a vulnerability that isn't actually present or exploitable. Cause: version detection errors, outdated signatures, missing context. Effect: wastes remediation effort; erodes trust.
• False negative: Scanner misses a real vulnerability. Cause: insufficient signatures, encrypted traffic, coverage gaps. Effect: false assurance.
• A clean scan never outweighs indicators of compromise. Scanners look for known vulnerabilities, not attacker activity. Unexplained behavior (e.g., unusual outbound traffic) on a "clean" host calls for threat hunting, plus a check that the scan actually had authenticated access.

Authenticated scans have significantly fewer false positives than unauthenticated scans because they read actual installed versions rather than guessing from service banners.

Assessment strategy — layer by risk, not by calendar: continuous or frequent automated scanning everywhere, with frequency calibrated to criticality and exposure (e.g., internet-facing weekly or continuous; internal systems monthly; fragile OT less often, plus scans triggered by change); penetration tests focused on high-value scope such as payment systems; independent third-party assessment where compliance demands it (PCI DSS v4.0 minimums: quarterly internal and ASV external scans, and penetration tests at least every 12 months and after significant change). Results feed the risk register and executive reporting. Giving every system the same annual assessment is a compliance-checkbox pattern.

Vulnerability management lifecycle:

⚠️ Exam Trap: A penetration test and a vulnerability assessment are not interchangeable. A vulnerability assessment identifies and reports potential vulnerabilities — it does not exploit them. A penetration test actively exploits vulnerabilities to confirm they are real, chains them together, and demonstrates actual impact. VA provides coverage breadth; pentest provides confirmed exploitability and business impact. Scanners match known signatures, so only a human tester finds business logic flaws and novel multi-step attack chains, which is why continuous scanning cannot replace penetration testing.

Reflection Question: An organization runs quarterly authenticated vulnerability scans and achieves 92% patch compliance within SLA. The CISO presents this as evidence of a mature vulnerability management program. A penetration tester then compromises the organization through a business logic flaw in the web application and an unpatched legacy system not in the asset inventory. What three gaps does this reveal about the vulnerability management program?