Vulnerability AssessmentCyber SecurityBeginner

Types of vulnerability assessment and how they differ from penetration tests

By Mohamed Fayas 8 min readUpdated 11 October 2026

In short: A vulnerability assessment systematically finds, ranks and reports security weaknesses. Assessments are grouped by target: network, host, wireless, application and database. They are broad and frequent, while penetration tests are deeper and prove impact, and vulnerability management is the ongoing programme that ties them together.

What a vulnerability assessment is

A vulnerability assessment is a structured review that finds security weaknesses in a defined set of systems, rates how serious they are and recommends fixes. It produces a snapshot: this is what was weak on this date. Repeated regularly and connected to fixing, those snapshots become a vulnerability management programme.

Figure 1. Assessments are usually grouped by the kind of target they look at.

The main types

Network-based: scans IP ranges to find live hosts, open ports and vulnerable services, internally or from the internet.
Host-based: looks inside individual servers and workstations, usually with credentials or an agent, to check patches, installed software and local settings.
Wireless: checks Wi-Fi encryption, authentication, rogue access points and guest separation. See wireless security testing.
Application: examines web applications and APIs for flaws such as injection and broken access control, using dynamic scanners (DAST), code analysis (SAST) and manual checks.
Database: reviews database servers for weak accounts, excessive privileges, missing patches, unencrypted sensitive data and unsafe settings.

Some organisations also run cloud assessments of account settings and permissions, and container assessments of images and clusters. The technical side of scanning is covered in vulnerability scanning types.

Credentials, agents and timing

Host and database assessments see far more when they log in, so plan for read-only service accounts and protect those credentials carefully. Agree when scans run, because some older devices, printers and industrial systems can slow down or fail under heavy scanning. Tell the service desk and the security operations team beforehand, so a scan is not mistaken for an attack.

A simple assessment process

Plan: agree scope, timing, credentials and who to contact if something breaks.
Discover: confirm which assets are actually present, as inventories are often out of date.
Scan and review: run tools and add manual checks where tools are weak.
Analyse: remove false positives and rank findings by real risk.
Report: give clear findings, owners and fixes, then rescan to confirm.

Assessment, penetration test and management

Figure 2. Assessments answer "what is weak?"; penetration tests answer "what could an attacker actually do?".

The three terms are often mixed up. A vulnerability assessment is broad and mostly automated; it finds as many weaknesses as possible across many systems. A penetration test is narrower and mostly manual; a tester tries to exploit weaknesses to show what an attacker could reach. Vulnerability management is the continuous process that schedules assessments, tracks fixes and reports progress. Most organisations need frequent assessments and occasional penetration tests, both feeding one management process.

Some standards and contracts require both. For example, organisations that handle payment cards under PCI DSS must run regular internal and external vulnerability scans and also carry out penetration tests. Knowing the difference helps you buy the right service and read the results correctly.

Real-world example: a university department

A fictional university engineering department has a mix of lab PCs, a research database and a student project website. The central security team runs a monthly network and host assessment using an agent on staff PCs and credentials for the servers. The application assessment of the student website finds a page that reveals detailed error messages, and the database review finds a shared account with full rights used by three research scripts. The department fixes the error handling, gives each script its own limited account, and books a penetration test of the research database for the following term.

Practice

Which type of assessment would check a SQL Server for excessive user privileges?

A database assessment.

A client wants to know whether an attacker could reach payroll data from the internet. Is an assessment or a penetration test better?

A penetration test, because it tries to exploit weaknesses and prove real impact along a path, rather than just listing weaknesses.

Why does the process start with discovery rather than scanning a known list?

Asset inventories are often incomplete. Unknown systems are frequently the most vulnerable, so you must find what really exists first.

Key takeaways

A vulnerability assessment finds, ranks and reports weaknesses.
Main types: network, host, wireless, application and database.
Assessments are broad and frequent; penetration tests are deep and prove impact.
Vulnerability management is the ongoing programme around both.
Always confirm the asset list before you scan.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author