Kevin Leverett

This vulnerability assessment demonstrates how I discover, validate, and prioritize technical security weaknesses across an organization's systems — converting raw scanner output into verified, severity-ranked findings paired with practical remediation steps.

Built for:

• Identifying and validating exploitable weaknesses before an attacker does
• Turning noisy scan data into verified, prioritized, remediation-ready findings
• Supporting patch management, system hardening, and compliance efforts

‍

Methodology

The assessment follows a structured, NIST-aligned testing lifecycle:

• Planning & Scoping — Define targets, rules of engagement, and assessment boundaries.
• Discovery & Enumeration — Identify live hosts, open ports, running services, and software versions.
• Vulnerability Identification — Map services and configurations to known vulnerabilities using automated scanning and manual review.
• Validation & False-Positive Reduction — Manually verify findings to confirm real exposure and eliminate scanner noise.
• Severity Scoring — Rate each confirmed vulnerability using CVSS v3.1 base metrics (attack vector, complexity, and impact to confidentiality, integrity, and availability).
• Remediation Guidance — Provide prioritized, actionable fixes such as patching, configuration changes, and compensating controls.
• Reporting — Deliver findings in both technical detail and an executive-ready summary.

‍

Tools & Techniques

• Nmap — host discovery, port scanning, and service/version detection
• Vulnerability scanning — automated identification of known CVEs
• Manual verification — confirming exploitability and reducing false positives
• CVSS v3.1 — standardized severity scoring

‍

Frameworks & Standards Applied

• NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
• CVSS v3.1 — Common Vulnerability Scoring System
• CIS Benchmarks — secure configuration baselines

‍

Skills demonstrated: network and service enumeration, vulnerability identification and validation, CVSS-based severity scoring, remediation planning, and clear technical reporting for both engineers and leadership.

The attached report applies this methodology end-to-end as a working sample of the deliverable.