Thousands of new vulnerabilities are reported in software every year, and many stay open for weeks or even years while organisations struggle to manage them. These are some of the most common mistakes made during web vulnerability assessments, and how to avoid them.

1. Not testing from every angle

Test the application both with and without authentication, and understand how controls such as firewalls, WAFs and intrusion prevention systems affect the results. A scan that only sees the public pages, or one that is silently blocked, gives a false sense of security.

2. Relying on old technology

It is tempting to put off updates and patches. Outdated software that stays in place for long periods becomes a serious vulnerability and raises business risk significantly.

3. Assuming one scan finds everything

Issues can remain undetected after a complete scan. Combine tools with manual testing, and repeat assessments regularly.

4. Not using the tools available

Many good tools exist to simplify and automate vulnerability management. Use them, so your team's time goes on analysis and fixing rather than repetitive checks.

5. Treating it as a side task

Vulnerability management cannot simply be added to someone's existing responsibilities. It is a complex, constantly changing, business-critical process, and it needs clear ownership and enough resources.

6. Not training developers

Assuming developers will learn only from their mistakes is not enough. Give your team regular training and real case studies, so the same kinds of vulnerability stop appearing in new code.

7. Missing the big picture

People running assessments do not always have a full view of the network: where internal firewalls, IDS/IPS sensors and other controls sit. Without it, they can misread results or miss whole areas.

It comes down to planning

Avoiding these mistakes is mostly a matter of planning. A process that is well planned, well resourced and well documented keeps problems to a minimum, and puts you in a strong position when something does go wrong. If one of those elements is missing, fix the process now; it is much easier than continually dealing with the consequences later.

How Vooki Pro helps

• Warns when a scan's login session looks invalid.
• Detects WAF blocking and shows it on the scan.
• Shows scan coverage and a Scope view of what was and was not scanned.

Frequently asked questions

What is the most common mistake?

Scanning without authentication, which leaves most of the application untested.

How do I know my scan covered enough?

Check the discovered URLs and requests scanned, and compare with the size of the application.

Related: Authenticated scanning: why you must scan behind the login · Scanning applications behind a WAF or rate limits