March 28, 2025

Not all security assessments are equal.

By Mike · 2 minute read

In this post I explore the key differences between some very common and often misunderstood security assessments. Each have their place in the market, but all too often we see these products miss-sold! An exploitability assessment and a vulnerability assessment is not a penetration test (pentest)!!

Understanding Vulnerability Assessments, Exploitability Assessments, and Penetration Tests:

In the field of cybersecurity, grasping the subtle differences between various security assessments is essential for sustaining a strong defense against possible threats. Three frequently employed techniques are vulnerability scans, exploitability scans, and penetration tests. Each method fulfils a specific role and provides unique perspectives on an organisation’s security status.

Vulnerability Assessments:

A vulnerability assessment is a systematic, automated procedure designed to pinpoint potential weaknesses within an organisation’s IT infrastructure, encompassing networks, systems, applications, and devices. Its main objective is to uncover known vulnerabilities that attackers might exploit. Vulnerability assessment is typically performed using specialised software tools that compare the scanned elements against databases of known vulnerabilities.

Key Characteristics:

Automated: Conducted using automated tools.
Broad Scope: Scans a wide range of assets.
Non-Intrusive: Does not attempt to exploit vulnerabilities.
Regular Frequency: Can be performed regularly (e.g., weekly or monthly).

Benefits:

Provides a high-level overview of potential vulnerabilities.
Helps in maintaining compliance with standards like PCI DSS.
Allows for continuous monitoring and early detection of vulnerabilities

Exploitability Assessments:

An exploitability assessment advances beyond a vulnerability scan by not only detecting vulnerabilities but also evaluating their potential for exploitation. This assessment simulates an attack to ascertain if the identified vulnerabilities can be leveraged to gain unauthorised access or inflict damage.

Key Characteristics:

Semi-Automated: Combines automated tools with manual verification.
Focused Scope: Targets specific vulnerabilities identified in previous scans.
Intrusive: Attempts to exploit vulnerabilities to verify their impact.

Benefits:

Provides a more accurate assessment of the actual risk posed by vulnerabilities.
Helps prioritize remediation efforts based on exploitability.
Offers insights into the potential impact of successful exploits.

Penetration Tests

A penetration test, or pen test, is an in-depth and practical method of security evaluation. It entails mimicking actual cyberattacks to identify vulnerabilities that malicious individuals might exploit. Penetration tests are conducted by skilled professionals who use a combination of automated tools and manual techniques to identify and exploit vulnerabilities.