During an incident review, a team learns that the web server an attacker used to get in had carried a critical, internet-reachable flaw for eight months. It never appeared in a single scan report. The server sat on a subnet created after the scanner's target list was written, so the scanner had never looked at it.
Vulnerability management is the ongoing cycle of finding weaknesses, ranking them, fixing them, proving the fix and reporting on progress, and every later step depends on the first. On the CompTIA Security+ SY0-801 exam this sits under objective 4.3, which expects you to carry out vulnerability management tasks in realistic scenarios, not just define them. This lesson covers the identification step: how scans differ by credentials, method and location, how to judge false positives and false negatives, and how IP address management, cloud security posture management and source code review close the gaps scans leave.
Credentialed scans see what an unauthenticated scan can only guess
A vulnerability scanner checks systems against a regularly updated library of tests for known flaws and misconfigurations. How much it can see depends first on whether it can log in.
A non-credentialed scan, also called unauthenticated, probes a host from the network the way an outsider would: open ports, service banners, TLS settings and safe tests against exposed services. It shows your attack surface, but it has to infer software versions from what services reveal, misses anything that doesn't listen on the network, and guesses wrong when a banner misleads.
A credentialed scan, also called authenticated, logs in to each host, usually over SSH for Linux and network devices or over SMB and WMI for Windows, and reads installed packages, patch levels, registry values and configuration files directly. It finds missing updates in browsers, PDF readers and other client software that never open a port, and it produces far fewer false positives because it reads the real version instead of guessing. Since March 2025, PCI DSS has required internal scans of in-scope systems to be authenticated.
The scan account is a risk of its own, because it usually needs administrator-level access on every host. Use a dedicated account, keep its password in the scanner's vault or a privileged access management tool, restrict where it can sign in from, and alert on any use from an address that isn't a scanner.
On the exam, a question about getting the most accurate results or reducing false positives points to a credentialed scan. A question about seeing what an outside attacker sees points to a non-credentialed scan run from outside.
Agents and network scanners cover different blind spots
There are two ways to deliver the checks. A network-based scanner is an appliance or virtual machine that reaches across the network to every target in its scope. An agent-based approach installs a small program on each host that runs the checks locally and sends results to a central console.
| Network-based scanner | Agent-based scanning | |
|---|---|---|
| Coverage | Any address in scope, including printers, switches and IoT | Only hosts that can run the agent |
| Laptops off the network | Missed unless connected during the scan | Checked anywhere, results sent when online |
| Credentials | Stored on the scanner and used across the network | No network logon needed |
| Network view | Sees open ports and exposure from its vantage point | Sees the host only from inside |
Most organizations use both: agents on servers and laptops, and network scans for devices that can't take an agent and to measure what is actually reachable. Agents matter most for remote staff, whose laptops may never be in the office when the weekly network scan runs.