1. A computer system comprising: a first repository of source definition data describing sources to monitor on one or more computer networks; one or more input collectors, coupled to the one or more computer networks, that are configured to scan the sources to identify security assets, wherein the security assets comprise server-side interfaces by which server-based applications interact with client computers over the one or more computer networks; a second repository of security asset data that is configured to receive, from the one or more input collectors, data describing the identified security assets; a security asset analysis component, coupled to the second repository, that is configured to analyze the security assets described by the security asset data to identify characteristics of the security assets, and that is configured to update the repository to associate each of the security assets with a corresponding one or more of the identified characteristics; a query component, coupled to the repository of security asset data, that is configured to receive queries for particular security assets having one or more particular characteristics, and that is configured to receive the particular security assets from the repository of security asset data based in part on comparing the one or more particular characteristics to the identified characteristics; a test management engine, coupled to the one or more computer networks, that is configured to receive requests to execute security tests on target assets of the security assets, and is configured to identify security vulnerabilities based on executing the security tests on the target assets; a third repository of security test data that is configured to receive, from the test management engine, results for the security tests, including vulnerabilities data describing the security vulnerabilities; a reporting component that is configured to generate reports of the identified security vulnerabilities based on the repository of security test data.