An asset map is more useful than a universal tool score
A network scanner, application tester, and image scanner observe different things. The selection starts with your assets, their owners, the available access, and the evidence needed to make a repair decision. A broad feature list cannot supply that context.
For an illustrative web product, separate the public portal, its operating host, the database service, and the image used to build it. A clean result for one target does not establish coverage of the others. The category guide and evaluation worksheet help make those distinctions explicit.
Start with the right question
Choose vulnerability assessment tools for the assets you actually run
Understand the method, evidence, limitations, and operating decisions for vulnerability assessment tools.
Assets & methodsOpenVAS: scope and evaluation
The official OpenVAS page describes authenticated and unauthenticated vulnerability scanning across network protocols, with tests supplied through a feed. It identifies the scanner within Greenbone’s wider product and community ecosystem. Do not treat a scanner component, a complete management platform, and a running-application assessment as interchangeable.
Assets & methodsChoose an assessment method for each asset
Choose an assessment method for each asset.
Products and resources
Practical entries
Choose an assessment method for each asset
Choose an assessment method for each asset.
Evidence & prioritySeparate severity, likelihood, and local repair priority
Separate severity, likelihood, and local repair priority.
Evaluation & ownershipFollow one assessment finding through a controlled pilot
Follow one assessment finding through a controlled pilot.
Evaluation & ownershipVulnerability assessment tool evaluation worksheet
Compare methods against the same asset inventory and preserve the demonstration, evidence, gap, and operating owner.
Questions and answers
Which tool is best for every asset?
There is no single comparison until the target class, access, and required evidence are defined. The directory separates infrastructure assessment and running-application testing.
Should severity and repair priority be the same field?
No. Preserve the technical scoring assumptions and add the local exposure, owner, and delivery context needed for the repair decision.
Sources for this entry
OpenVAS; ZAP getting started; FIRST CVSS v4.0; FIRST EPSS FAQ. The source register distinguishes technical guidance, company descriptions, and original illustrations.
Continue this reading path
Related security references
Explore the related guides when the question shifts to another stage of testing, assessment, reporting, or disclosure. They share a publishing project and are not independent endorsements.