1. A method for passively and automatically assigning a vulnerability to a network device on a network, comprising: predefining a vulnerability of an operating system in a vulnerability data structure that lists vulnerabilities mapped to one record for each corresponding operating system and lists operating system fingerprints mapped to the one record for the each corresponding operating system; passively determining that the network device is using one of plural operating systems by reading a packet transmitted on the network, decoding the packet, first mapping the operating system fingerprint based on fields in the decoded packet to the plural operating systems listed in the vulnerability data structure, and then second mapping each of the plural operating systems listed in the vulnerability data structure to a corresponding vulnerability listed in the vulnerability data structure, wherein the second mapping is responsive to the first mapping, wherein the packet is in traffic passively moving across the network; and assigning the corresponding vulnerabilities of the plural operating systems from the vulnerability data structure to the network device.