BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving Toronto and organizations across North America  ·  Last updated August 21, 2026

Key Takeaways

• A vulnerability assessment is a periodic, structured evaluation that produces auditor-ready findings and a remediation roadmap. Its limitation is that it reflects the environment only on the day it was conducted. Anything introduced the day after does not appear until the next cycle.
• Vulnerability management closes the gap between cycles: frequent scanning catches new vulnerabilities as they appear, tracked remediation keeps findings moving to closure within SLA, and trend reporting shows whether posture is improving or slipping.
• New vulnerabilities arrive continuously through software updates, configuration changes, new deployments, and newly disclosed CVEs. An organization that assesses annually but scans nothing in between has an unknown exposure for up to eleven months a year, and that window is where a large share of real breaches happen.
• Compliance frameworks differ. PCI DSS explicitly requires quarterly external scanning; SOC 2, ISO 27001, and HIPAA expect regular scanning but let the cadence follow your risk assessment. Knowing which applies to you decides the right mix.
• The strongest programs pair continuous automated scanning with periodic manual assessment: scanning maintains current visibility, and assessment validates findings, strips false positives, applies business context, and produces the deliverables auditors and leadership need.

What a Vulnerability Assessment Delivers

A vulnerability assessment is a structured engagement conducted over a defined period against a defined scope. It produces a comprehensive, validated inventory of the vulnerabilities present in the environment at the time of the assessment, scored and prioritized by business risk, with remediation guidance and compliance mapping included. The output is a set of structured deliverables: an executive summary, a detailed finding inventory, a prioritized remediation roadmap, and methodology documentation that satisfies audit requirements.

The value of an assessment is in its structure and validation. It covers the full defined scope systematically, not just the assets that are easy to scan. It validates findings manually to remove false positives before the report is delivered. It applies business context to scoring rather than presenting raw CVSS numbers. And it produces deliverables formatted for executives, engineers, and auditors, not just for the security team that runs the scan. Those qualities make the assessment the right tool for compliance documentation, pre-audit preparation, baseline establishment, and periodic deep-dive evaluation of specific environments.

The limitation is temporal scope. It tells you what the environment looked like during the assessment window. The day after it concludes, new vulnerabilities appear as software is updated, new systems are deployed, configurations drift, and new CVEs are disclosed against software you already run. The assessment does not maintain visibility into those changes. The management program does.

What Vulnerability Management Delivers

Vulnerability management is the operational program that maintains continuous or high-frequency visibility into your vulnerability posture between and beyond assessment cycles. It covers automated scanning on a defined cadence (weekly, monthly, or continuous depending on the environment and compliance requirements), tracked remediation that follows every open finding through to closure or formal acceptance, SLA management that flags overdue findings and escalates them, and trend reporting that shows whether posture is improving over time.

The operational cadence means your posture is never more than a scan cycle out of date. When a critical CVE is disclosed for software in your environment, the next scheduled scan identifies the affected systems within days. When a new system is deployed, it is scanned before or immediately after going into production. When a remediation is completed, the next scan confirms closure and updates the record. This continuous cycle keeps the vulnerability window, the period between when a weakness is present and when it is identified and remediated, as short as possible.

Vulnerability management also produces the trend data that assessment-only programs cannot. A program running across multiple scan cycles shows whether the critical finding count is falling, whether remediation SLAs are being met, whether certain asset classes or business units consistently carry higher vulnerability density, and whether specific vulnerability classes recur despite prior remediation, which points to a systemic gap. That trend data informs security investment, surfaces process improvements, and gives leadership a real view of program effectiveness over time.

Why the Window Between Assessments Matters

The case for a management program is not theoretical. According to the IBM Cost of a Data Breach Report 2025, the global average breach costs USD 4.44 million, the United States average reaches USD 10.22 million, and organizations take an average of 241 days to identify and contain a breach. A vulnerability that lands the day after an annual assessment can sit unseen for most of that identification window if nothing is scanning in between. Continuous scanning is what compresses that exposure from months to a single scan cycle.

What Compliance Frameworks Actually Require

Different frameworks impose different requirements, and the distinction matters for program design. PCI DSS is the most prescriptive. Under PCI DSS v4.0.1, Requirement 11.3 covers vulnerability scanning, including quarterly external scans by an Approved Scanning Vendor and scanning after significant changes, and Requirement 11.4 covers penetration testing on at least an annual cadence. (The numbering moved in version 4.0: under the retired v3.2.1, Requirement 11.3 was penetration testing, so older audit notes may reference it that way.) The quarterly scanning cadence is a continuous-program obligation that stands regardless of whether a deeper assessment is also conducted, so PCI DSS effectively requires both a continuous scanning program and periodic deeper testing.

SOC 2 CC7.1 requires the entity to use detection and monitoring procedures to identify vulnerabilities, but the Trust Services Criteria do not fix a scanning cadence. Auditors typically expect evidence of regular scanning and remediation tracking, with the frequency driven by the organization’s risk assessment and environment rather than a set number. ISO 27001 Annex A 8.8 similarly calls for management of technical vulnerabilities without naming a cadence, again leaving frequency to the risk assessment. HIPAA does not name vulnerability scanning outright; most advisors read the Security Rule’s risk-analysis and evaluation standards as requiring regular scanning with documented remediation, but the cadence is not defined in the regulation itself.

Designing the Right Combination for Your Organization

Most mid-market organizations do best with a layered approach: periodic assessments plus a continuous management program. The assessment, run annually or quarterly depending on compliance and risk, provides the structured, validated, auditor-ready deliverables the management program alone does not produce at the same depth. The management program, running continuously or monthly in between, keeps current visibility into the landscape and makes sure vulnerabilities introduced after the last assessment are caught and tracked before the next one.

The right combination depends on size, environment complexity, compliance requirements, and remediation capacity. A 50-person professional services firm with a light technology footprint may satisfy its obligations with quarterly assessments and monthly scanning and no full-time vulnerability management function. A 500-person financial services organization under PCI DSS and OSFI guidance, running a complex multi-cloud environment with active development, needs a continuous program with dedicated ownership and tooling, supplemented by periodic deeper assessments.

Across the 260+ organizations Armour Cybersecurity protects in 52+ industries, the pattern that separates a program that holds up under audit from one that does not is rarely tooling. It is whether someone owns the window between assessments. The organizations that get breached in that window almost always had a recent clean assessment on file and nothing watching the environment in the eleven months that followed.

Armour provides both vulnerability assessment engagements and ongoing management support, scaled to your environment and compliance requirements. The point is not to choose one over the other. It is to size the combination to the risk you actually carry.

Frequently Asked Questions

Can we run our own scans internally and have you assess the results?

Yes. Organizations with internal scanning tools can engage Armour Cybersecurity to perform the analysis, validation, and reporting layer on top of their existing scanner output. This is especially useful for teams that already run regular scans but struggle with false positive volume, prioritization, or the structured deliverables that compliance and governance audiences require. The engagement takes the raw scanner output, applies manual validation to critical findings, correlates across scanner sources, applies risk-based prioritization with business context, and produces the structured assessment deliverables that scanner dashboards do not generate.

What is the difference between a managed vulnerability management service and a vulnerability assessment?

A vulnerability assessment is a defined engagement with a scope, a timeline, and a set of deliverables: it begins, runs for several weeks, produces a report, and concludes. A managed vulnerability management service is an ongoing retainer where the provider runs the scanning program, manages the findings inventory, tracks remediation, produces periodic reporting, and maintains the function on your behalf continuously. The managed service fits organizations that want the function without building the internal team and tooling to run it. The assessment fits organizations that need a structured, point-in-time evaluation for compliance or baseline purposes, or that run their own program but want periodic deeper assessment alongside it.

How does vulnerability management relate to patch management?

Vulnerability management identifies what needs to be patched; patch management applies the patches. They are distinct but tightly coupled. A program that finds critical vulnerabilities but has no connection to the patch process that closes them just grows a stale tracking list. The integration is what makes it work: findings feed the patch queue with priority indicators, the patch process updates the tracking record when patches land, and the next scan confirms the vulnerability is gone. Organizations where the two functions sit with different teams and no shared workflow are among the most likely to carry persistent high-severity vulnerabilities.

What metrics should we track to know if our vulnerability management program is working?

Five metrics tell a coherent story: mean time to remediate by severity (how fast critical, high, medium, and low findings close on average), SLA compliance rate (what share of findings close within their target), critical and high finding trend (is the open count falling or growing), repeat finding rate (what share of this cycle’s findings also appeared last cycle, which signals remediations that are not sticking), and time to detection for newly disclosed critical CVEs (how fast scanning flags affected systems). These are also the metrics compliance auditors and cyber insurance underwriters most often ask about when judging program maturity.

Should we conduct a vulnerability assessment before a penetration test?

Running a vulnerability assessment before a penetration testing engagement is common and productive sequencing. The assessment maps the known vulnerability landscape, so the testing team can focus manual adversarial work on the most significant findings rather than on discovery the scanner has already done. The pen test then shows which items from the inventory are actually exploitable in your specific environment, how they chain into attack paths, and what business impact they produce. The combined output gives a more complete picture than either alone: the assessment provides breadth of identification, and the pen test provides depth of adversarial validation.

The Bottom Line

A vulnerability assessment tells you what is exposed today; vulnerability management makes sure you find out about tomorrow’s exposure before an attacker does. The assessment is the snapshot, the program is the film. For most organizations the question is not which one, but how to combine a periodic vulnerability assessment with continuous scanning so the picture never goes stale between cycles. Size that combination to your compliance requirements, your environment, and your remediation capacity, and you close the window where most real breaches actually happen.