Vulnerability scanning uses automated tools to probe systems for known flaws and unsafe settings and to report what those probes found.
It discovers candidates, while an assessment ranks them and management drives the fixes.
How it works
A scanner compares what it sees with known flaws, missing patches, and risky configurations.
It can miss a broken business process that no signature describes.
A probe with credentials usually sees more than a touch of the outside only.
Analysts still have to mark findings that do not apply because a risky feature is turned off.
Concrete examples
- A weekly scan lists missing patches on a group of servers.
- An external scan finds an old protocol still offered on a public site.
- An analyst marks a reported flaw as not applicable because the risky feature is disabled.
Protective measures
- Scan on a schedule and again after major changes.
- Use credentials where policy allows so the result is deeper than an outside glance.
- Record why a finding is a false positive, with evidence.
- Send confirmed findings into the management queue instead of leaving them in the scanner.
Related articles
What is a vulnerability assessment? takes scan output and ranks it in the context of the business.
What is vulnerability management? owns the fixes after a scanner has reported a confirmed weakness.
What is a vulnerability? defines the weakness a scanner is trying to detect automatically.