Choose an assessment method for each asset

Build a small asset record

Give each relevant asset a stable identifier, an operating owner, its environment, and the way it can be assessed. A hostname can change while the underlying application remains the same. An image can be rebuilt while a vulnerable deployed workload still runs. Record enough context to follow the actual object through those changes.

For an illustrative team running a web portal, the inventory might distinguish the portal, its host, its database service, and the built image. One scanner's clean result for the portal URL does not establish the condition of the other three assets.

Match the question to the method

OpenVAS describes authenticated and unauthenticated vulnerability scanning across network protocols and assets. A dynamic application scanner such as ZAP exercises a running web application. Trivy's documentation describes other artifact and configuration assessment contexts. Read each method's actual scope before treating the outputs as comparable.

The directory includes products for different target classes. A broad infrastructure assessment and a role-dependent application check may both matter, but they do not share a universal coverage denominator.

Record access as part of the result

Identify whether assessment requires a reachable network service, a credentialed host session, source or image access, or a test identity in the application. A tool can be configured with a credential that did not actually work. Preserve the evidence that the intended access was available while the relevant checks ran.

A failed login should not become a clean host assessment. An application session that expired should not become a claim that protected routes passed. Those conditions need their own status and an owner for the access problem.

Make the coverage gap actionable

For each unassessed asset or workflow, name the missing method, access, or operating decision. Assign it to a person rather than only marking it in a dashboard. That makes the inventory useful for both procurement and the team's next assessment cycle.