Types of Vulnerability Assessment: Network, Web App, Host, Wireless

Verizon's 2026 Data Breach Investigations Report found that 31 percent of breaches began with exploitation of software vulnerabilities. The finding shows why organizations need a repeatable way to identify weaknesses before attackers use them.

A single assessment method cannot examine every technology in the same way. Routers and firewalls expose different weaknesses from web applications. A server operating system requires different checks from a wireless network. That is why security programs use several types of vulnerability assessment rather than one scan for the entire environment.

The four common categories are network, web application, host, and wireless assessments. Each looks at a different part of the environment, uses different testing methods, and produces findings for different owners.

Why organizations use different assessment types

The purpose of vulnerability assessment is to identify weaknesses that could affect systems, applications, devices, or communications. Scope determines what the assessment can see.

CISA's 2025 vulnerability analysis training separates network and system assessment from web application testing. Its network and system material covers network scanning, operating system weaknesses, configuration review, and CVSS-based prioritization. Its web application material covers automated and manual application testing, client-side and server-side weaknesses, and OWASP-related issues.

The separation reflects how the technology works. A network assessment may identify an exposed management service on a router, while a web application assessment may find broken access control in an application running behind that router.

Understanding the types of vulnerability assessment helps teams choose the right method for the asset being tested instead of assuming that one scanner provides complete coverage.

Network vulnerability assessment

A network vulnerability assessment examines devices and services reachable across a network. Typical targets include routers, switches, firewalls, VPN gateways, network appliances, servers, and other systems that expose network services.

The assessment usually begins with asset and service identification. Scanning can identify open ports, running services, device information, software versions, missing updates, insecure protocols, weak configurations, and known vulnerabilities associated with the detected technology.

Microsoft documents authenticated network scans as an agentless method for assessing infrastructure devices such as switches, routers, WLAN controllers, firewalls, and VPN gateways. Once identified and classified, those devices can be included in vulnerability management workflows.

Network assessment can be performed from different positions. An external assessment looks at systems reachable from outside the organization. An internal assessment looks at systems accessible from inside the network. The findings can differ because internal systems may expose services that are not available from the internet.

Among the types of vulnerability assessment, network assessment is useful for identifying weaknesses in shared infrastructure and services that connect multiple parts of the organization.

Teams should still validate findings before remediation. Device fingerprinting can be incomplete, network segmentation can affect what a scanner sees, and a detected software version does not always provide enough context to determine practical risk.

Web application vulnerability assessment

Web application assessment focuses on the application layer rather than the underlying host alone.

Testing may examine authentication, authorization, session handling, input processing, application configuration, APIs, business logic, and the way the application handles data. Automated scanners can identify many known patterns, but manual review may be needed for weaknesses that depend on application behavior or user roles.

CISA's 2025 vulnerability analysis curriculum includes automated and manual web application testing, client-side and server-side analysis, cloud-based application testing, and assessment against OWASP-related weaknesses.

The OWASP Top 10 2025 lists broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions among major web application risk categories.

Those categories also show why web testing cannot be replaced with a basic network scan. A port scanner may confirm that HTTPS is available. It cannot, on its own, determine whether one user can access another user's records because of an authorization flaw.

The distinction between the types of vulnerability assessment becomes especially important for internet-facing applications because infrastructure and application weaknesses can exist at the same time.

Host vulnerability assessment

A host vulnerability assessment examines an individual endpoint or server and the software, operating system, configuration, and local security settings present on it.

Typical checks can include missing operating system updates, vulnerable installed software, insecure local configuration, weak services, outdated components, firmware issues, and configuration deviations.

Microsoft Defender Vulnerability Management currently gathers vulnerability information across supported Windows, macOS, and Linux systems. Depending on the platform, its assessments can include operating system vulnerabilities, software vulnerabilities, operating system configuration, software configuration, and security-control configuration.

Host assessments may use an installed agent, local telemetry, authenticated access, or another method that provides more information about the device than a remote unauthenticated scan can obtain.

That deeper visibility matters. A network scan may see a service listening on a port, but host-level data can identify installed software that is not listening on the network, local package versions, configuration state, and other device-specific information.

Host assessment is therefore one of the types of vulnerability assessment used when teams need device-level evidence rather than only information visible across the network.

A host assessment should also account for the asset's role. The same software weakness can have different business consequences on a test workstation and a production server that handles sensitive transactions.

Wireless vulnerability assessment

Wireless assessment examines the security of Wi-Fi infrastructure and the controls governing wireless access.

Targets can include access points, wireless LAN controllers, SSIDs, authentication settings, encryption methods, connected clients, and unauthorized wireless devices.

A wireless assessment may look for rogue access points, unauthorized clients, weak authentication settings, outdated encryption choices, insecure wireless configurations, and gaps between the wireless network and the wired environment.

CISA recommends wireless intrusion detection and prevention capabilities that can identify rogue clients, rogue wireless access points, and unauthorized connections. Its current material also recommends combining over-the-air and wired-network techniques when detecting rogue wireless devices.

Cisco's 2026 wireless documentation covers WPA3 Enterprise, authentication controls, Protected Management Frames, and newer encryption options used in current enterprise wireless deployments.

Wireless testing differs from the other types of vulnerability assessment because physical proximity and radio communication affect what can be observed. A device does not need to expose a service to the public internet for a nearby attacker to interact with its wireless interface.

Assessment scope should therefore include where wireless signals can be reached, which networks are approved, how users and devices authenticate, and whether unauthorized access points can connect to company infrastructure.

How the four assessment types compare

The types of vulnerability assessment overlap, but they are not interchangeable. A host assessment can identify vulnerable software on a server while a web application assessment identifies an authorization error in the application running on it. A network assessment may find the server is reachable through an unnecessary service, while a wireless assessment may identify an unauthorized access path into the same network.

Credentialed and noncredentialed assessments provide different views

Assessment method also changes the amount of information available.

A noncredentialed scan examines a target without logging into it. It is useful for understanding what an unauthenticated system can observe from the selected network position.

Credentialed or agent-based assessment can inspect local software, configuration, package information, and other details that may not be visible remotely.

Microsoft's current documentation shows that device vulnerability information can be gathered from onboarded systems, while authenticated network scanning is used for network infrastructure that generally cannot run endpoint sensors.

Neither approach should automatically replace the other. External visibility matters because it reflects what is reachable from that position. Internal or authenticated visibility can provide more detailed information about what exists on the asset.

The choice should follow the assessment objective.

Choosing the right assessment type

Organizations should choose among the types of vulnerability assessment based on what they need to understand.

Network assessment fits questions about exposed services, network infrastructure, segmentation, and reachable devices.

Web application assessment fits questions about application behavior, authentication, authorization, APIs, and user-controlled input.

Host assessment fits questions about operating systems, installed software, local configuration, and device state.

Wireless assessment fits questions about Wi-Fi access, authentication, encryption, rogue devices, and wireless infrastructure.

Most organizations will need more than one. A public web application, for example, can involve a web application, a host operating system, network infrastructure, and wireless administration systems used by internal teams. Testing only one layer leaves other weaknesses outside that assessment's scope.

A broader vulnerability assessment program should define which assets belong to each assessment category, how often each assessment runs, how findings are validated, who receives them, and how remediation is verified.

Frequency should follow how quickly the environment changes

The types of vulnerability assessment do not all need to run on the same schedule.

Internet-accessible assets can change frequently as services are deployed or removed. Web applications change when code, dependencies, APIs, or configuration change. Hosts change as software and operating system updates are installed. Wireless networks change when access points, clients, SSIDs, or authentication settings are modified.

CISA's June 2025 internet exposure recommendations call for routine assessments of internet-accessible assets as IT environments change. The agency recommends regularly reviewing those assets to identify newly exposed systems and weaknesses.

Assessment schedules should account for asset importance, rate of change, internet exposure, compliance requirements, and the organization's remediation process.

A scan that runs frequently but leaves findings unresolved does not reduce vulnerability exposure on its own. Assessment needs to connect to prioritization, remediation, and follow-up testing.

Common gaps when assessment scope is too narrow

Problems appear when teams assume one assessment method covers everything.

Running only network scans can miss application logic weaknesses and local host conditions.

Testing only web applications can leave routers, VPN gateways, operating systems, and wireless infrastructure outside the assessment.

Running only host assessments can miss unauthorized network services or rogue wireless devices.

Wireless assessment alone cannot determine whether the applications and servers reached through the network contain their own weaknesses.

The types of vulnerability assessment work best as complementary views of the same environment. Each identifies a different class of conditions, and findings from one assessment can change how teams interpret another.

A network scan that identifies an exposed administrative interface may lead to a host assessment of the device behind it. A web assessment that identifies an outdated component may lead teams to check other hosts for the same software. A wireless finding may trigger a wider review of network access and segmentation.

Assessment coverage should follow the technology being protected

No single assessment can provide complete information about every asset.

Network assessments examine what devices and services expose across network paths. Web application assessments test the behavior of applications and APIs. Host assessments inspect device-level software and configuration. Wireless assessments examine Wi-Fi infrastructure and access controls.

Understanding the types of vulnerability assessment helps security teams match the testing method to the technology, interpret findings within the correct scope, and avoid treating one scanner as proof that the entire environment has been assessed.

The goal is not to run more scans for the sake of volume. The goal is to use the right assessment for each asset, validate what is found, and move confirmed weaknesses into remediation.