After changes, vulnerability testing should be performed.

• A. Yes
• B. No
• C. Only if recommended by vendor
• D. Only during audits

Answer: (A)

Whenever you alter a system, re-running vulnerability testing is essential to confirm the changes haven’t introduced new weaknesses. Changes—like software updates, configuration edits, new integrations, or changes to network policies—can create fresh attack surfaces or reactivate old vulnerabilities in unexpected ways. Even small edits can interact with existing controls and produce risks that weren’t present before, so validating security after modification helps catch issues early.

Vulnerability testing in this context includes automated scanners that look for known weaknesses, checks for configuration drift against baselines, and, when needed, targeted manual testing to verify subtle flaws. Doing this after changes keeps your security posture accurate and reduces the chance of exploitable gaps slipping into production.

It’s not solely about vendor recommendations or audits. Relying only on those occasions can leave you exposed if a change introduces a vulnerability that those processes don’t cover. Treat post-change vulnerability testing as a standard practice in change management, ideally integrated into CI/CD or your deployment workflow, to ensure ongoing resilience.