Method and apparatus for detecting events pertaining to potential change in vulnerability status

An apparatus comprising:

• a target having at least one of a deployed server network service, or a deployed client network service;
• and
• an agent, deployed on the target, to detect an event on the target in real time or at periodic intervals,
• wherein at least one of the agent or a vulnerability assessment (VA) server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, or a port,
• wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed, and
• wherein the VA server comprises at least one of a vulnerability assessment (VA) scanner or a port scanner, the VA server operably coupled with the target.

A non-transitory computer readable storage medium for storing computer instructions that, when executed by at least one processor cause the at least one processor to perform a method comprising:

• detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, or an API,
• the event comprising a change in status of at least one of a network interface, a server network service, a client network service, or a port;
• and
• conducting a test from at least one of a vulnerability assessment (VA) scanner, or a port scanner on the target based on the detecting,
• wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed.