Systematic process of identifying, classifying, and prioritizing vulnerabilities in IT systems, networks, applications, and infrastructures. Includes automated scanning, manual analysis, correlation with CVE and CVSS databases, and production of technical reports with remediation plans. Essential for regulatory compliance (NIS2, DORA, ISO 27001), cyber risk management, and reducing the attack surface before vulnerabilities are exploited.