Vulnerability Discovery and Analysis
Vulnerability Discovery and Analysis
This domain is about finding weaknesses and, more importantly, deciding which ones are real and which ones matter. Discovery methods include vulnerability scanners, web application scanners, manual testing, configuration review, SAST (analyzing source or bytecode without running it), DAST (testing a running application), software composition analysis for dependencies, fuzzing, and threat modeling to map the attack surface.
Understand credentialed vs non-credentialed scanning. Credentialed scans authenticate to hosts and see installed patch levels and missing updates, producing deeper, more accurate results; non-credentialed scans see what an external attacker sees, mostly banners and exposed services. Neither is inherently better - the choice depends on the question being asked.
Learn the scoring vocabulary: CVE identifies a specific vulnerability; CVSS provides a base score plus temporal and environmental modifiers; EPSS estimates the probability of exploitation in the wild; CWE classifies the weakness type. A high base score is not automatically the top finding. Prioritization depends on exploitability, whether the asset is internet-facing, compensating controls, data sensitivity, and evidence of active exploitation.
Traps are numerous. Version-banner matching produces false positives when a vendor backported a patch without changing the version string, and false negatives when the banner is altered. Unvalidated scanner output is not a finding - confirm exploitability where safe. Do not confuse a false positive (reported but not present) with a false negative (present but not reported). Authenticated scans need service accounts with least privilege, and scanning fragile ICS or medical devices can disrupt them.
Rule of thumb: rank by confirmed exploitability plus business context - an exploited, reachable medium beats an unreachable critical.
Reports should carry evidence, affected asset, reproduction steps, and a remediation recommendation.