What is Vulnerability Assessment (VA) ?

Vulnerability Assessment (VA) Identifies, analyzes, and reports known vulnerabilities without exploiting them. This stage aims to list potential security gaps.

Penetration Testing (PT) attempts to exploit the identified vulnerabilities to determine their impact, giving insight into how an attacker might use them in real-world scenarios.

Scoping and Planning, Scanning and Vulnerability Assessment, Enumeration and Exploitation (Penetration Testing), Post-Exploitation, Analysis and Reporting, Remediation and Retesting and Continuous Monitoring and Improvement.

  • Use automated tools (e.g., Nessus, OpenVAS, Qualys) to scan for known vulnerabilities.
  • Analyze potential security issues, such as outdated software, configuration errors, and exposed services.
  • Attempt to exploit identified vulnerabilities, simulating an attacker’s behavior.
  • Use exploitation tools (e.g., Metasploit) to gain access, escalate privileges, or move laterally within the system.
  • Record successful exploits and any achieved objectives (e.g., accessing restricted data).
  • Review findings and compile a detailed report with identified vulnerabilities, the level of risk, and remediation recommendations.
  • Include an executive summary for management and a technical section with details on affected systems, exploited vulnerabilities, and mitigations.