Vulnerability Assessment and Risk Management: From Scanning to Risk Response
Get the vocabulary straight
A vulnerability is a weakness; a threat is who or what could exploit it; an exploit is the tool or technique used; risk combines likelihood and impact in the context of the business. Severity is not risk: a critical CVSS score on an isolated lab host may matter less than a medium score on an internet-facing payment server.
Assessment tools
A vulnerability scan is automated, broad, and finds known issues by version and configuration; a penetration test is manual, scoped, and chains weaknesses the way a real attacker would. Credentialed (authenticated) scans reach deeper and produce fewer false positives than uncredentialed ones. A false positive reports a problem that isn't there; a false negative misses one that is - false negatives are the dangerous error. CVE identifies a specific vulnerability, CVSS scores its severity, CWE classifies the weakness type.
Risk math and responses
Quantitative analysis uses SLE = asset value × exposure factor and ALE = SLE × annualized rate of occurrence. Responses are: avoid (stop the activity), mitigate (apply controls), transfer (insurance, contract), and accept (documented, with sign-off). What remains after treatment is residual risk.
Treating findings
Patch, reconfigure, isolate, or add a compensating control when patching is impossible (a zero-day has no fix, so you compensate). Track findings to closure; you cannot protect assets you never inventoried, and a baseline tells you what 'normal' looks like. Responsible disclosure and bug bounty programs route findings to the vendor instead of the public.
Worked example. A $2,000 laptop with a 50% exposure factor has SLE = $1,000. Two thefts per year gives ALE = $2,000. A $500/year control that halves the occurrence rate drops ALE to $1,000, saving $1,000 against a $500 cost - worth it.