<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-vulnerability-assessment
description: >-
  Scan endpoints for vulnerabilities, prioritize findings by exploitability
  and business impact, and track remediation progress. Covers authenticated
  scanning, risk-based prioritization using CVSS/EPSS/KEV, and reporting.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - vulnerability-assessment
  - scanning
  - cvss
  - epss
  - risk-prioritization
  - remediation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1190
    - T1203
    - T1068
    - T1211
---

# Performing Endpoint Vulnerability Assessment

## Overview

Endpoint vulnerability assessment identifies security weaknesses before
attackers can exploit them. Effective assessment combines authenticated scanning
for accuracy, risk-based prioritization (CISA KEV > EPSS > CVSS), and SLA-driven
remediation tracking. Regular scanning cadence ensures continuous visibility.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Nessus / OpenVAS / Qualys | Vulnerability scanner with authenticated scanning |
| Credentials | Service account for authenticated endpoint scanning |
| CISA KEV catalog | Known exploited vulnerabilities feed |
| EPSS data | Exploit prediction scoring for prioritization |

## Workflow

1. **Define scan scope** — Identify target endpoints and scan windows
2. **Configure credentials** — Set up service accounts for authenticated scanning
3. **Run baseline scan** — Full authenticated scan of all endpoints
4. **Analyze findings** — Review vulnerabilities by severity and exploitability
5. **Prioritize remediation** — CISA KEV → EPSS > 0.5 → Critical CVSS → High CVSS
6. **Assign remediation** — Route findings to asset owners with SLAs
7. **Verify remediation** — Rescan to confirm vulnerabilities resolved
8. **Report compliance** — Track mean-time-to-remediate and open vulnerability trends

## Key Commands

```bash
# Nmap vulnerability scan
nmap --script vuln -sV -oX vuln_scan.xml <target>

# OpenVAS CLI scan
gvm-cli --gmp-username admin --gmp-password <pass> socket --xml \
  "<create_task><name>Endpoint Scan</name><config id='full-and-fast'/><target id='<id>'/></create_task>"

# Nessus CLI export
nessuscli scan --export --format csv --output scan_results.csv

# Linux vulnerability check
apt list --installed 2>/dev/null | while read pkg; do
  dpkg-query -W -f='${Package} ${Version}\n' "${pkg%%/*}" 2>/dev/null
done

# Check for known vulnerable packages
grep-available -F Package -s Package,Version -n linux-image | head

# EPSS lookup for CVE
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234"

# CISA KEV check
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d['vulnerabilities']))"
```

## Verification

| Check | Method |
|---|---|
| Scan completed | Scanner reports successful completion with finding count |
| Authenticated scan | Scan results include OS patch level and installed software |
| KEV items flagged | All CISA KEV vulnerabilities prioritized as critical |
| Remediation tracked | Open findings have assigned owners and SLA dates |
| Rescan validates fix | Remediated vulnerabilities no longer appear in rescan |

## References

- [NIST SP 800-40 — Patch and Vulnerability Management](https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final)
- [FIRST EPSS](https://www.first.org/epss/)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---
v1.0 | Validated: 2026-03-18
