IT Risk Fundamentals

Vulnerability assessments can produce false-positive findings, so reported vulnerabilities must be validated before remediation resources are committed. Threat mitigation is a response activity, not the primary concern of the assessment itself.