Vulnerability Identification

http://nvd.nist.gov/

If we were simply conducting a risk assessment without conducting a penetration test, this is where we would probably stop