A vulnerability test on an Information System (IS) is conducted to

Exploiting security weaknesses is the objective of penetration testing, not a vulnerability test, which only identifies and assesses weaknesses without actively exploiting them.

Vulnerability testing focuses on security control gaps and risk exposure, not on benchmarking or measuring system performance metrics under weak security conditions.

A vulnerability test is a structured assessment designed to evaluate the effectiveness of security controls by identifying weaknesses, misconfigurations, or gaps in defenses within an Information System. The goal is to determine whether controls such as patching, access controls, and configurations are functioning as intended, providing actionable findings to improve the security posture without necessarily exploiting those vulnerabilities.

Disaster Recovery planning involves business continuity strategies and recovery time objectives, which are separate from vulnerability assessments that focus on security control evaluation.