Vulnerability Assessment (VA) is the process of measuring and prioritizing risks associated with IT infrastructure to enable rational planning of technologies and activities that manage corporate risks.

The Vulnerability Assessment takes a snapshot of the infrastructure and checks for any gaps in its configuration, allowing an evaluation of the state of security systems implemented on corporate networks, machines, or applications, where present, with the aim of detecting any protection deficiencies compared to known lists of technological vulnerabilities.

Assessments are conducted using scanning tools, which provide configurable detection depth and granularity, based on the needs of the computer system under analysis. Vulnerability assessment tools allow for the customization of security policy, automated vulnerability analysis, and the creation of reports that effectively communicate security vulnerability findings and corrective actions to all levels of an organization.

The main objectives of a Vulnerability Assessment are: