Consists of an automated vulnerability scan followed by manual remediation of scan results to remove false positives and provide a guide for prioritizing remediation efforts. This type of assessment will help to identify immediate risks but lacks the breadth/depth of a full-scope penetration test. A vulnerability assessment can be performed against external or internal infrastructure and from an unauthenticated or authenticated standpoint. These assessments can be performed against the internal or external network or web applications, as an unauthenticated attacker or authenticated.