Vulnerability scanning means running a program that checks your computers, networks or applications for known security weaknesses, such as misconfigurations and flawed code. NIST calls it a technique for identifying hosts, their attributes and the vulnerabilities attached to them. You can run a scan with login credentials, which is authenticated, or without them, which is unauthenticated.
The key word in that first sentence is known. A scanner goes looking for weaknesses that have already been identified, on the kit you point it at, and tells you where they turn up. That makes it a checking job, and a repeatable one.
What a vulnerability scan looks for
- Hosts and their attributes. The NIST glossary entry puts these first, ahead of the vulnerabilities tied to them.
- Known weaknesses in computers, networks and applications.
- Misconfigurations, where something has been set up in a way that leaves a gap.
- Flawed programming, where the weakness sits in the code.
- Network assets in particular, such as a firewall, a router or a web server.
- Low-level configuration data, which an authenticated scan reaches by logging in.
How a scan runs on a real network
Modern scanners let you run the job in either of two modes, and the mode you pick shapes everything you get back.
An authenticated scan logs in to the system it's checking. It does that over remote administrative protocols such as SSH (secure shell) or RDP (remote desktop protocol), using system credentials someone has provided. Being logged in is what gives it access to low-level configuration data.
An unauthenticated scan goes without those credentials. You've got nothing to hand over, but you also get a thinner picture, for reasons covered in the next section.
So the decision comes down to two questions: how much detail do you need, and who's willing to supply a login for the scanner to use? Whichever you pick, don't treat it as a one-off, because a single scan is a snapshot and not the finished job.
Where a scan without credentials misleads you
Skip the login and two things go wrong. The scan can produce a high number of false positives, meaning alerts about problems that aren't there. It also can't give you detailed operating system and software information.
Those two limits pull in opposite directions, and that's what catches people out. A long list of alerts from an unauthenticated scan isn't a to-do list yet, so check each finding before anybody spends a day chasing it. A short list doesn't prove you're clear either, because that mode couldn't see the operating system and software detail in the first place.
The logged-in route has a condition of its own. It needs system credentials, so someone has to provide them and decide who's allowed to hold them.
How to try a vulnerability scan for yourself
- List what you want checked: computers, networks, applications, and network assets such as your firewall, router or web server.
- Choose a program to run the scan. There's a roundup of vulnerability scanner options if you're starting from nothing.
- Decide whether this run will be authenticated or unauthenticated.
- For an authenticated run, provide the system credentials the scanner needs to log in over a protocol such as SSH or RDP.
- Run the scan.
- Check each finding is real before acting on it, above all after an unauthenticated run.
- Plan to keep scanning, since the CIS controls designate continuous scanning as a critical control.
Who vulnerability scanning suits
It suits anyone answerable for systems that other people depend on. That could be a business owner whose site sits on a web server, or a small IT team looking after a firewall and a handful of routers. If you can name the assets and someone can act on what comes back, you've got what you need to start.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
It's a poorer fit if you're hoping for one report that settles the matter for good. Scanners assess for known weaknesses, so the output is a list to work through and keep repeating.
Scanning means something else entirely if you landed here wanting to turn paper into searchable files. The piece on OCR document scanning for business is the one you're after.
Frequently asked questions
Is a vulnerability scanner the same as a firewall?
No. A firewall is one of the network assets a scanner can assess for misconfigurations and flawed programming.
Can a scan catch weaknesses nobody has documented yet?
Scanners are designed to assess for known weaknesses, so don't count on one for anything outside that.
Which scanning program should I pick?
Start from your own list of computers, networks and applications, then read each program's documentation for what it covers and whether it allows both authenticated and unauthenticated scans.
Does scanning fix the problems it finds?
Its job is to identify and assess weaknesses. Check your chosen program's own documentation for anything beyond that.
Will a scan show what software is installed?
Not in detail without a login, as an unauthenticated scan can't give you detailed operating system and software information. Logging in is what opens up low-level configuration data.
Who offers this for internet-facing systems?
CISA describes its Cyber Hygiene services as helping secure internet-facing systems from weak configurations and known vulnerabilities. Check its page to see whether they apply to you.
