What is a vulnerability assessment (VA)?

A vulnerability assessment is a systematic examination of an information system to identify, classify, and prioritize technical security weaknesses across networks, operating systems, applications, and cloud infrastructures.

How does a vulnerability assessment differ from penetration testing?

A vulnerability assessment focuses on comprehensive identification and cataloging of potential vulnerabilities without attempting active exploitation. Penetration testing goes further by actively attempting to exploit confirmed flaws to evaluate real-world blast radius.

How does vulnerability assessment align with BNM RMiT and ISO 27001?

BNM RMiT (Paragraph 10.41) mandates regular vulnerability assessments on external and internal network nodes. ISO 27001:2022 (Control A.8.8) similarly requires timely evaluation and mitigation of technical vulnerabilities.

What severity scoring system is used in vulnerability assessments?

Assessments leverage the Common Vulnerability Scoring System (CVSS v3.1 / CVSS v4.0), classifying findings from Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), to Critical (9.0–10.0) alongside remediation SLA targets.

Continuous Security

VulnerabilityAssessment

Automated scanning combined with expert analysis to identify, prioritize, and remediate vulnerabilities across your entire attack surface.

Start Assessment Compare to Pen Testing

Our Assessment Process

Discovery

Comprehensive asset discovery and scope definition

Scanning

Automated scans using industry-leading tools

Analysis

Expert validation and false positive elimination

Reporting

Prioritized findings with remediation guidance

Complete Coverage

Network Infrastructure

Web Applications

Cloud Environments

Databases

APIs & Microservices

Container & Kubernetes

IoT Devices

Mobile Applications

Third-Party Systems

Vulnerability assessment procurement guide

Define coverage, validation and remediation ownership before scanning starts

A vulnerability assessment is useful only when the asset inventory is accurate, credentials work and findings are validated in business context. nCrypt agrees the coverage model, scan safety settings, evidence requirements and remediation workflow before collection begins. The engagement identifies and prioritizes exposure; it does not silently become an exploitation-led penetration test.

External and internal assets

Coverage can include internet-facing hosts, internal network ranges, operating systems, common services and approved cloud workloads. Asset owners and business criticality are recorded so severity is not based on scanner output alone.

Authenticated assessment

Where credentials are provided, assessment checks installed software, missing patches, insecure configuration and local policy with better accuracy than unauthenticated probing. Credential coverage and failures are disclosed in the report.

Validation and prioritization

Analysts remove obvious false positives, confirm exposure safely and combine CVSS with reachability, exploit conditions, asset importance and compensating controls. Active exploitation is performed only under a separately approved pentest scope.

Remediation lifecycle

Findings are assigned owners and target dates using customer policy or an agreed severity SLA. Retesting verifies whether the affected version, configuration or exposure was actually corrected rather than merely marked complete.

What we need before kickoff

Authoritative IP, hostname, cloud-account and asset-owner inventory.
Approved scanner source addresses, credentials and maintenance windows.
Business criticality, data classification and fragile-system exclusions.
Named contacts for operations, security and emergency scan suspension.

What you receive

Coverage statement showing scanned, unreachable, excluded and credentialed assets.
Validated findings with CVSS, business context, evidence and affected inventory.
Prioritized remediation register with owner-ready technical guidance.
Retest results separating fixed, partially fixed, accepted and outstanding risk.

Boundaries and assumptions

A VA identifies breadth of weakness; it does not prove every attack path or business impact.
No denial-of-service, destructive checks or unapproved exploitation.
Application business logic and source code require separate specialist scopes.
Results describe the observed assessment window and should feed continuous patch and exposure management.

Complementary services Malaysian buyers commonly pair with vulnerability assessment.

Know Your Weaknesses Before Attackers Do

Get a comprehensive view of your security vulnerabilities with our expert assessment.

Request Assessment