Physical Security

What Is a Security Vulnerability Assessment? A Plain Guide

By the FASC editorial team Updated Nov 4, 2026 5 min read

A security vulnerability assessment is a structured review of a facility that identifies weaknesses an adversary could exploit, such as gaps in access control, lighting, surveillance, procedures or staff awareness. A qualified assessor compares those weaknesses against the realistic threats you face and the consequences of an incident, then delivers a prioritized list of practical recommendations.

Key takeaways on a security vulnerability assessment

A security vulnerability assessment looks at people, procedures and physical measures together.
Vulnerabilities only matter in context: the threats you face and what is at stake.
Expect a site visit, interviews, document review and a written, prioritized report.
Price depends on the number of sites, their complexity and the depth of the work.
Choose an independent assessor who does not profit from selling the fixes.

What is a security vulnerability assessment?

Security professionals usually think about risk in three parts. A threat is someone or something that could cause harm, such as a thief, a disgruntled former employee or an intruder. A vulnerability is a weakness that threat could use, such as an unmonitored loading dock or a door that does not latch. The consequence is what you would lose if it happened: people hurt, operations stopped, data or property gone, reputation damaged.

A security vulnerability assessment focuses on the middle part. It answers a practical question: if someone wanted to cause harm here, where would our protections fail? Good assessors never look at vulnerabilities in isolation, though. A weak door on an empty storage shed and a weak door on a server room are not the same finding.

Organizations usually commission a security vulnerability assessment at a clear turning point: after a break in, theft or threatening incident, before moving into or renovating a building, when an insurer or board asks for it, after a merger or major change in operations, or simply because nobody has looked with fresh eyes in years. An assessment done before a construction project is especially valuable, since changes cost far less on paper than after the walls go up.

How is it different from a risk assessment or threat assessment?

These terms are often mixed up, and some firms use them interchangeably. Here is how they are generally understood.

Assessment	Main question	Typical output
Vulnerability assessment	Where are our protections weak?	List of weaknesses with recommendations
Threat assessment (facility)	Who or what might target us, and how?	Profile of likely threats and scenarios
Behavioral threat assessment	Is this specific person on a path toward violence?	Case management plan for an individual
Risk assessment	Which combinations of threat, vulnerability and consequence matter most?	Prioritized risk register
Physical penetration test	Can a tester actually get in?	Evidence of what was bypassed and how

In practice, most commercial engagements combine threat and vulnerability work, sometimes called a threat and vulnerability assessment. If you are weighing a hands on test, see our comparison of a physical security assessment vs penetration test.

What does a security vulnerability assessment cover?

Assessors usually work from the outside in, following the layers an intruder would have to pass.

Site and perimeter: boundaries, fencing, vehicle access, parking, landscaping and sight lines.
Building envelope: doors, windows, roof access, loading docks and utility entry points.
Access control: locks, keys, card systems, visitor management and how credentials are issued and revoked.
Video surveillance and alarms: camera coverage and image quality, who monitors them, and how alarms are answered.
Lighting: coverage and condition after dark.
Policies and procedures: opening and closing routines, deliveries, terminations, incident reporting and emergency plans.
People: training, awareness, and whether staff actually follow procedures.
Response: how quickly staff, security officers and police can respond, and how they communicate.

Many assessors also apply Crime Prevention Through Environmental Design (CPTED), which looks at natural surveillance, natural access control, territorial reinforcement and maintenance to find low cost design improvements.

How does the security vulnerability assessment process work?

Kickoff and scoping. Agree on the sites, concerns, deliverables and who the assessor should talk to.
Document review. Floor plans, existing security policies, emergency plans, incident logs and prior reports.
Threat review. Your incident history, local crime patterns, industry specific risks and any known concerns.
Interviews. Leadership, facilities, front desk, security staff and the people who open and close the building.
Site survey. A physical walkthrough, ideally during business hours and after dark, testing doors, checking cameras and watching how people actually behave.
Analysis and report. Findings are compared against threats and consequences and ranked.
Debrief. The assessor walks your team through the results and answers questions.

Timelines for a security vulnerability assessment vary. Published guidance from consulting firms suggests a first draft report often arrives around a month after the site visit, depending on the size of the job.

What should a security vulnerability assessment report include?

A useful report reads like advice, not a shopping list. Look for:

A short executive summary that leadership can read in a few minutes.
Each finding with a location, a photo where appropriate, why it matters and a specific recommendation.
Priorities tied to risk, not just a long list in walkthrough order.
Low cost and procedural fixes listed alongside equipment and construction options.
Rough cost ranges or effort levels so you can plan budgets.
Clear handling instructions, since the report is a map of your weaknesses and should be protected.

How much does a security vulnerability assessment cost?

Price depends on the number of sites, their size and complexity, travel and how deep the work goes. Published price guides from security firms put a single site commercial assessment roughly in the range of $3,500 to $8,500 at the simpler end, and up to about $5,000 to $25,000 for a full assessment of a single commercial facility. Multi site programs can run from $15,000 to $75,000 or more. One firm estimates 20 to 50 hours of work per site.

Those same guides warn that a very cheap “assessment” is often little more than a camera count or a sales visit. For a full breakdown, see our physical security assessment cost guide.

Who should conduct a security vulnerability assessment?

For a security vulnerability assessment, look for an assessor with relevant experience in facilities like yours and a recognized credential. ASIS International awards the Physical Security Professional (PSP) certification, which focuses on physical security assessment and design, and the Certified Protection Professional (CPP), which covers security management more broadly.

Independence matters as much as credentials. An assessor who sells or installs the equipment they recommend has a conflict of interest, even if they act in good faith. Ask every candidate whether they receive commissions or referral fees from vendors, and ask for a redacted sample report. Our guide to the security consultant vs security integrator explains why separating advice from installation pays off.

You can browse physical security assessment consultants by state and compare their backgrounds before you reach out.

Get proposals for a security vulnerability assessment

Describe your facilities and concerns, and we will match you with vetted, independent physical security consultants who can scope and price the work, at no cost to you.

Request free proposals

Frequently asked questions

How long does a security vulnerability assessment take?

For a single facility, the site visit often takes one to a few days, depending on size and complexity, plus time for interviews and document review. Report writing usually takes several more weeks, and some firms cite about a month from site visit to first draft. Multi site assessments take longer, so ask for a written timeline.

How often should a facility have a vulnerability assessment?

Many organizations repeat a security vulnerability assessment every few years, and also after a serious incident, a move or major renovation, a significant change in operations or a change in the threats they face. Between formal assessments, use the last report as a baseline and review progress on its recommendations at least once a year.

Is a vulnerability assessment the same as a risk assessment?

Not exactly. A security vulnerability assessment identifies weaknesses in your protections. A risk assessment combines those weaknesses with the threats you face and the consequences of an incident to decide which risks matter most. In practice, many consultants deliver both together, so read the proposal carefully to see what is included.

What credentials should a vulnerability assessor have?

The ASIS International Physical Security Professional (PSP) certification is the most directly relevant, since it focuses on assessment and physical security design. The Certified Protection Professional (CPP) shows broad security management knowledge. Also look for experience with facilities like yours, a redacted sample report and independence from product vendors.