I am working for a company where vulnerability assessment for infrastructure and applications are being done by different vendors. Sometimes I get confused that assessment should happen on the infrastructure or application side.

E.g. xyz application is hosted on Windows 10.

Should I consider it vulnerability assessment on the infrastructure side or application side?

1 Answer 1


Application vulnerabilities are very different from infrastructure vulnerabilities.

The app needs to be tested, and the machine needs to be tested, too. You choose the best type of testing for what you want to achieve. App testing for apps, infrastructure testing for the infrastructure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .