Vulnerability Assessment is an essential component of an effective security program. VA initially provides discovery and security baseline data, and periodic rescanning provides updated data for vulnerability management, trending and compliance reporting. VA tools provide a bottom-up security baseline for the IT environment from a database of known vulnerabilities. There are three approaches to VA: active network scanning, passive observation of network traffic and persistent agents. The most-accurate scanning requires credentialed access (over the network or via an agent).

IT security organizations require a network-based approach that can accurately discover and evaluate vulnerabilities on managed and unmanaged systems. However, for VA data to be used to improve security and satisfy audit requirements, there must be strong prioritization capabilities and reporting with three orientations: security (vulnerability and threat-focused), operations (remediation-focused) and audit (risk and remediation trending). Organizations also will need to implement the vulnerability management life cycle if they want to use VA to make the environment more secure.