A key component in the identifying and managing of security risks by hospitals is a vulnerability assessment. In this article, the authors explain the differences between asset-based and threat-based vulnerability assessments, and provide guidance in designing meaningful security surveys. The steps to be taken once the final risk assessment report is ready are reviewed to assist the security decision maker in assimilating the data into a meaningful security plan that will address the weaknesses and exemplify the strengths of the organization.