Introduction
Security teams often sit on two disconnected piles of data. Scanners produce backlogs of tens of thousands of findings.
Threat intelligence and business teams know what attackers are likely to target and what the company can't afford to lose. Neither view works alone.
This guide covers a combined threat and vulnerability assessment: a review that connects threat activity, technical weaknesses, asset criticality, exploitability, and operational impact.
Cyentia's 2024 study found exploitation observed for only about 6% of published CVEs, so counting findings tells you little about real danger.
Below, you'll find the core concepts, a step-by-step process, ways to prioritize and operationalize results, and the situations that call for an assessment.
Key Takeaways
- A combined assessment links threats to specific vulnerabilities and the assets they could affect.
- Prioritize with exploitability, threat intelligence, asset criticality, and business impact, not scanner severity alone.
- The deliverable is an owned action plan, not a findings list.
- Reassess after major changes, not only on a calendar.
What Is a Combined Threat and Vulnerability Assessment?
A combined threat and vulnerability assessment is a structured review of the threats an organization faces and the weaknesses that could let those threats cause harm. The goal is a realistic view of exposure, so you can decide what to fix first.
What threats, vulnerabilities, and risks mean
- Threat: an actor, event, or condition that could cause harm, such as ransomware, insider activity, third-party compromise, or a physical hazard.
- Vulnerability: a weakness in technology, configuration, identity, process, facility, or human behavior that a threat could exploit.
- Risk: the likelihood and impact of a threat exploiting a vulnerability.
The same flaw carries different risk depending on where it sits. A missing patch on an isolated lab server is a nuisance. The same patch gap on an internet-facing file transfer server holding customer data is a crisis.
DeepSeas threat researchers tracked suspected worldwide exploitation of a MOVEit Transfer zero-day, a reminder that exposed file-transfer software draws attackers fast.
Why combining the assessments produces better decisions
FIRST's CVSS v4.0 guide states plainly that the Base score measures severity, not risk. Threat and environmental context fill the gap. Threat intelligence separates theoretical weaknesses from exposures that are reachable, actively targeted, and tied to critical operations.
A critical-severity flaw on an isolated internal system can rank below a medium-severity issue on an internet-facing asset that an industry-active group is exploiting.
Related activities fit together like this:
- Risk assessment supplies business context.
- Vulnerability assessment finds weaknesses.
- Penetration testing validates selected attack paths. A missing patch can lead from a foothold to reused service-account credentials, a file server, and backups, details a scanner won't show.
- Vulnerability management tracks remediation over time.
How to Conduct a Combined Threat and Vulnerability Assessment
Define objectives, scope, and criteria
Set the purpose before testing starts. Common drivers include:
- Audit readiness
- Cyber insurance requirements
- Annual planning
- M&A due diligence
- Incident follow-up
- A new environment
Then list what's in scope:
- Systems, applications, and cloud services
- Identities and third parties
- Facilities, OT, data, and business processes
Agree on safe-testing rules and evidence handling.
Build an asset and business-process inventory
You can't assess what you don't know exists. Record for each asset:
- Owner and location or hosting model
- Dependencies and data sensitivity
- Exposure and business criticality
Bring in operations and business stakeholders. They know what downtime, data loss, safety events, or regulatory failure would actually cost. In one DeepSeas engagement, asking whether affected systems and data were mission critical cut 50,000 remaining alerts to 30,000.
Identify relevant threats
Organize threats by source and attack path:
- Ransomware and phishing
- Credential abuse and insider risk
- Supply-chain compromise and cloud abuse
- Application attacks and sector-specific activity
Map current intelligence to your industry, technology stack, and exposed services. Useful sources include MITRE ATT&CK, CISA's #StopRansomware resources, and sector ISACs such as Health-ISAC, REN-ISAC, MS-ISAC, and FS-ISAC. In January 2025, DeepSeas reported rising ransomware, phishing, and credential theft against colleges and universities.
Discover and validate vulnerabilities
Combine authenticated and unauthenticated scanning with configuration reviews, cloud and identity assessments, application testing, and asset discovery. Validate manually where it matters.
Know the limits. NIST SP 800-115 notes scanners produce false positives, miss combinations of weaknesses, and can disrupt systems. They also miss unknown assets, business-logic flaws, and insecure processes.
Correlate findings and evaluate risk
Map each threat to the vulnerabilities and assets it could hit. Then weigh likelihood, exploitability, existing controls, and business impact.
Keep scoring transparent. Document assumptions and separate technical severity from business risk. Don't invent a formula; use an established method:
- NIST SP 800-30 for likelihood and impact
- FAIR v3.0 for probable loss frequency and magnitude
- CISA SSVC for exploitation, technical impact, and mission prevalence
- CISA's KEV catalog for confirmed exploitation, and EPSS for 30-day exploitation probability
KEV and EPSS measure different things, so a low EPSS score doesn't contradict a KEV listing.
Report findings and build an action plan
A strong report includes:
- Executive summary and technical findings
- Threat-to-asset relationships
- Prioritized risk register with evidence
- Recommended controls, owners, and target dates
- Accepted risks and validation steps
Route actively exploited findings into incident response immediately. After fixes, retest. NIST SP 800-115 says verification can mirror the original test, which confirms the exposure actually shrank.
How to Turn Assessment Findings Into a Security Program
Prioritize by exposure and business context
Rank findings using these factors:
- Asset criticality
- Internet exposure
- Exploitability
- Threat activity
- Privilege implications
- Data sensitivity, safety, and dependencies
DeepSeas uses KEVs as its first filter because attackers are already exploiting them. In a sample assessment, 38 critical vulnerabilities were given a 30-day remediation window aligned to a change window.
Separate urgent containment or compensating controls from longer-term fixes. Document risk acceptance and get approval from the right owner.
Connect results to remediation and incident response
Prioritized findings become tickets, patching work, configuration changes, segmentation decisions, identity safeguards, or updated procedures.
The same data sharpens detection rules, incident response playbooks, tabletop exercises, backup planning, and monitoring for attempted exploitation. CISA publishes customizable tabletop exercise packages as a starting point.
Use complementary tools
Each tool offers different evidence:
- Asset inventories and scanners
- Configuration and cloud-security tools
- Threat intelligence and SIEM detection data
- Penetration testing and attack-surface management
- GRC workflows
Choose by scope, environment, integration, reporting, validation, and operational safety. Tools don't replace expert analysis.
Set a reassessment cadence
Reassess after new internet-facing services, cloud migrations, acquisitions, major releases, identity changes, incidents, newly disclosed vulnerabilities, or regulatory shifts. NIST SP 800-137 likewise ties monitoring frequency to emerging threats, incidents, and significant changes.
Continuous monitoring can fill the gaps between formal reviews, but keep periodic human-led reviews for business context, control effectiveness, and governance.
Make findings useful to leadership and auditors
Translate technical results into operational disruption, financial exposure, compliance implications, and stakeholder impact. Track measures such as:
- Asset coverage
- Time to validate findings
- Remediation completion
- Recurring findings
- Exception age and control effectiveness
Set targets from your own baseline. Verizon's 2026 DBIR reports a median of 43 days for full KEV remediation, which is observed performance, not a standard to adopt.
For organizations that need findings turned into remediation and audit-ready improvements, DeepSeas combines offensive security, threat intelligence, and practitioner-led GRC support, including ISO Lead Auditor-certified specialists.
Where Combined Assessments Add the Most Value
Regulated environments
Healthcare, higher education, public-sector, and financial or payment organizations use combined assessments to tie technical findings to compliance controls, audit evidence, and continuity.
Common frameworks set clear assessment expectations:
- HIPAA requires an accurate and thorough assessment of risks and vulnerabilities to ePHI
- PCI DSS 4.0.1 requires scans at least quarterly and penetration tests at least every 12 months
- FTC Safeguards Rule sets similar cadences for covered institutions
Verify current requirements and applicability before committing to a schedule.
Complex environments
OT, cloud and hybrid infrastructure, remote workforces, third-party ecosystems, and thin security teams gain the most from a combined approach. In OT, NIST SP 800-82 warns that active scanning and patching can interfere with safety and operations. Remediation may mean compensating controls rather than an immediate patch.
Practical triggers
Consider an assessment when you face:
- A major audit or a failed assessment
- Cyber insurance renewal
- A merger or acquisition
- A new application or cloud deployment
- A significant architecture change
- A security leader's departure
- A suspected incident
- Preparation for an annual penetration test
Conclusion
Vulnerability data becomes useful when you connect it to credible threats, asset importance, exploitability, and business consequences.
Start here:
- Confirm your asset inventory.
- Identify your most important business processes.
- Map current threats and vulnerabilities to them.
- Assign accountable owners.
- Set a repeatable cycle for remediation and validation.
Frequently Asked Questions
What is a threat and vulnerability assessment?
A structured process that connects threats, vulnerabilities, assets, likelihood, exploitability, and business impact. It exists to prioritize security action.
What are the 5 steps to the hazard vulnerability analysis model?
Common stages are identify hazards, assess vulnerability, estimate impact, prioritize risks, and plan mitigation. Step counts and terminology vary by framework; FEMA's THIRA, for example, uses three stages.
What works best alongside vulnerability assessments?
No single tool is best. Threat intelligence, asset criticality, risk analysis, and penetration testing all complement them. The right mix depends on your objectives and environment.
How is a threat assessment different from a vulnerability assessment?
A threat assessment evaluates harmful actors or events and their likelihood or impact. A vulnerability assessment finds exploitable weaknesses. Together they give a more realistic risk picture.
How often should a combined assessment be performed?
Frequency should reflect asset criticality, exposure, threat activity, and regulatory obligations. Add assessments after incidents, new deployments, acquisitions, or major architecture changes.
