Several manuals and automated techniques and procedures are utilised to evaluate and rank security vulnerabilities in a system. A VA may attack servers or other underpinning infrastructure, apps, or both. Additionally, conducting a VA aids in determining the environment's security posture and the degree of threat exposure. VA can discover vulnerabilities by selecting if the system has the appropriate controls as intended to be deployed.

A significant chunk of the security and IT profession is involved in vulnerability assessment and management. There are positions in incident response, security operation centres, individual analyst teams, on-premises and cloud IT infrastructure, senior management, reporting directly to the CISO or CEO, and incident response. The job level often determines the technical depth. However, each role is crucial to the vulnerability assessment and management process.

Here are some scenarios that call for a Vulnerability Assessment.
● Before the launch of a new system or application.
● When an existing system or application is updated.
● When the demands for remote access or the user base of a system or application change.
● following the remediation of previously discovered vulnerabilities

You can find variable degrees of severity of vulnerabilities during a vulnerability assessment. Additionally, it may attest to the conformity of your IT environment to governmental and commercial norms. Here are a few such vulnerabilities that were discovered during an evaluation.
● Weak passwords that are easily guessed.
● Attackers can use SQL injection or XSS attacks to exploit code injection vulnerabilities.
● unpatched operating systems or software.
● Misconfigurations, such as unmodified default settings or open ports that are vulnerable.