I am working for a company where vulnerability assessment for infrastructure and applications are being done by different vendors. Sometimes I get confused that assessment should happen on the infrastructure or application side.
E.g. xyz application is hosted on Windows 10.
Should I consider it vulnerability assessment on the infrastructure side or application side?