1. A computer system comprising: a first repository of source definition data describing sources to monitor on one or more computer networks; one or more input collectors, coupled to the one or more computer networks, that are configured to: scan the sources, and identify security assets, wherein the security assets comprise server-side interfaces by which server-based applications interact with client computers over the one or more computer networks; a second repository of security asset data that is configured to receive, from the one or more input collectors, data describing the identified security assets; a security asset analysis component, coupled to the second repository, that is configured to: analyze the security assets described by the security asset data, identify characteristics corresponding to the security assets, and update the second repository to associate each of the security assets with one or more of the corresponding identified characteristics; a query component, coupled to the second repository of security asset data, that is configured to: receive queries for a first set of particular security assets each having one or more particular characteristics, and receive the first set of particular security assets from the second repository of security asset data based in part on comparing the one or more particular characteristics to the identified characteristics, wherein the first set of particular security assets includes a first security asset on a first source and a second security asset on a second source; a prioritization component, coupled to or embedded in the query component, that is configured to generate priority data for sets of particular security assets based on corresponding characteristics of the identified characteristics; one or more monitoring components, coupled to the one or more computer networks, that are configured to: detect, after the updating of the second repository to associate each of the security assets with the corresponding one or more of the identified characteristics, changes to the server-based applications, and identify target assets to be submitted to a test management engine based at least on one of the detected changes to the server-based applications corresponding to a particular target asset of the target, wherein the detected changes to the server-based applications comprise one or more changes made to the server-based applications that indicate a possible new security vulnerability to the server-based applications; the test management engine, coupled to the one or more computer networks, that is configured to: receive requests to execute security tests on the target assets of the security assets, identify security vulnerabilities based on executing the security tests on the target assets, receive the priority data, and test the target assets in orders indicated by the priority data; a third repository of security test data that is configured to receive, from the test management engine, results for the security tests, including vulnerabilities data describing the security vulnerabilities; and a reporting component that is configured to generate reports of the identified security vulnerabilities based on the third repository of security test data.