Your company has decided that the risk of performing a penetration test Is too great. You would like to figure out other ways to find vulnerabilities on their systems, which of the following is MOST…

Network scope analysis passively inventories all systems, services, and open ports visible on the network to map the attack surface without triggering exploits or disrupting operations. It reveals misconfigurations, unnecessary service exposures, and network segmentation gaps in a way that closely mirrors pen test reconnaissance but without the execution risk that prompted the alternative search.

Baseline data reviews compare current system state to a prior snapshot to detect drift, but they do not proactively surface unknown vulnerabilities or new misconfigurations the way an active assessment would.

Patch policy review evaluates the organization's process for applying updates and identifies procedural gaps, but does not directly enumerate specific technical vulnerabilities present on live systems.

Configuration reviews check systems against benchmarks such as CIS or DISA STIG and are a valid technique, but the question asks for the alternative most likely to surface network-wide vulnerabilities broadly, which network scope analysis addresses more completely.