A vulnerability assessment is a point-in-time review that finds known weaknesses across your systems, confirms which ones are real, and ranks them so the team knows what to fix first.
The short answer
A vulnerability assessment identifies and rates known weaknesses across applications, networks and cloud infrastructure. It combines automated scanning with human review to remove false positives and to rate each finding by the risk it presents in your environment. It does not attempt to exploit what it finds.
The distinction that matters is intent. An assessment aims for coverage: it looks at everything in scope and produces a ranked list. A penetration test aims for proof: it takes a smaller scope and demonstrates what an attacker could actually achieve.
On this page
How an assessment runs
Four stages. The third is where the value sits: tools produce volume, a person decides what that volume means.
Assessment or penetration test?
If a customer or auditor has asked for evidence that weaknesses were exploited, they want a penetration test. An assessment answers a different question: how exposed are we across everything we own, right now.
Rating what you find
CVSS measures severity in the abstract and knows nothing about your environment. A critical on an internal tool with no data is less urgent than a medium on a public payment service.
So rate every finding on two questions. How likely is it to be exploited? That covers whether the asset is reachable and whether an exploit exists. What does the business lose if it is? That covers the data and the revenue behind the asset. Plot the answers on a grid and the order to fix things becomes obvious: the top right corner first, the bottom left last.
Types of assessment
| Type | What it examines |
|---|---|
| Network | Exposed services, open ports, outdated software and weak protocols across internal and external hosts |
| Application | Web and API surfaces, checked against known vulnerability classes and misconfigurations |
| Cloud configuration | IAM permissions, storage exposure, security groups, encryption and logging coverage |
| Host and endpoint | Operating system patch level, installed packages, local configuration and security agents |
| Database | Access rights, default credentials, encryption at rest and patch status |
What you should receive
Ranked findings
Ordered by risk in your environment, not by raw CVSS score alone.
Affected assets
The specific host, endpoint or service each finding applies to.
Named remediation
The version to upgrade to or the setting to change, not general advice.
Several hundred unfiltered findings means the triage was handed to your team. Ask how false positives are handled before engaging anyone.
How Osto runs assessments
Osto’s scanner rates findings by severity, maps them to affected endpoints and produces remediation reports on a schedule. Because assessment sits in the same platform as the WAF, CSPM and code security, a finding can be read alongside whether a control is already blocking it, which changes how urgent it is.
Free security assessment
See your exposure across everything you own
Scheduled assessment across applications, APIs, endpoints and cloud, with findings ranked by what they actually put at risk.
Get a free security assessment Book a platform walkthroughRuns on a schedule · Findings ranked in context · One platform, everything
Frequently asked questions
What is a vulnerability assessment?
A vulnerability assessment is a point-in-time review that identifies known weaknesses across applications, networks and cloud infrastructure, removes false positives, and rates each finding by the risk it presents. It does not attempt to exploit the weaknesses it finds.
How is it different from a penetration test?
An assessment prioritises coverage and produces a ranked list across everything in scope. A penetration test prioritises proof, taking a narrower scope and demonstrating what an attacker could achieve. Auditors asking for a penetration test will not accept an assessment report.
How is it different from a vulnerability scan?
A scan is the automated step that produces raw output. An assessment is the wider exercise that includes the scan, then validates the results, removes false positives and rates the remaining findings in context.
How often should an assessment be run?
Continuously or at least monthly for scanning-driven assessment, and after any significant infrastructure change. Annual assessment alone leaves too long a window for a product that ships frequently.
Is CVSS enough to prioritise fixes?
No. CVSS rates severity in the abstract and knows nothing about your environment. Prioritisation needs a second input: whether the affected asset is exposed, whether it holds sensitive data, and whether an existing control already limits the risk.