What is a credentialed scan?
A credentialed scan, also called an authenticated scan, is a vulnerability scan in which the scanner signs in to each target with an account the administrators supply. Once signed in, it inspects the system from the inside: installed packages and their exact versions, missing operating system and application updates, registry values, file permissions, local password policy and service settings. A non-credentialed scan sees only what a host reveals over the network, such as open ports and service banners.
How the scanner signs in
- Windows: an account with local administrator rights, used over SMB, with remote registry and WMI access to read installed software and hotfixes.
- Linux, Unix and many network devices: SSH with a key or password, often with sudo rights so the scanner can read package databases and protected configuration files.
- Databases, hypervisors and appliances: their own accounts or APIs, for checks such as default users and weak settings.
Because the account usually holds administrative access on every host in scope, it is one of the most powerful credentials in the environment, and it should be handled that way: a dedicated account per platform, a long random password or key kept in the scanner's vault or a PAM system, sign-in allowed only from the scanner's addresses, regular rotation, and an alert whenever it is used from anywhere else.
Why the results are better
Credentials cut both kinds of error. False positives drop because the scanner reads the installed package version instead of inferring it from a banner, so a Linux server with a backported fix stops being reported as vulnerable. False negatives drop because the scanner can now see software that never listens on the network. Browsers, PDF readers, Java runtimes and office suites are among the most exploited code on a workstation, and an unauthenticated scan cannot see any of them. Configuration and benchmark checks also need a signed-in view. PCI DSS v4.0.1 reflects all of this by requiring authenticated scanning for internal vulnerability scans of in-scope systems that accept credentials.
Example: a scan that quietly lost its credentials
A monthly credentialed scan reports far fewer findings on one Linux subnet than the month before. It looks like progress until the analyst opens a host's scan details. In Nessus, the scan information output for that host shows Credentialed checks : no, and the authentication report lists a rejected SSH login for the scan account. An administrator had replaced the account's key on those servers without updating the scanner, so every host fell back to network-only checks. Mature programs track the share of hosts where authentication succeeded and alert when it drops, because a failed login looks like good news in a findings report.
Credentialed vs. non-credentialed vs. agent-based
| Credentialed | Non-credentialed | Agent-based | |
|---|---|---|---|
| Viewpoint | Inside the host, through a network logon | Outside, like an attacker on the network | Inside the host, from local software |
| Accuracy | High | Lower; versions are inferred | High |
| Main weakness | A powerful scan account stored centrally | Blind to client-side software | Hosts without the agent are invisible |
Most programs use all three: credentialed scans for depth, non-credentialed and external scans to measure real exposure, and agents for laptops that rarely connect to the corporate network.
Credentialed scan on the CompTIA Security+ exam
Credentialed scanning is part of SY0-801 objective 4.3, which covers carrying out vulnerability management tasks. Wording such as "improve the accuracy of scan results," "reduce false positives," "find missing patches on workstations" or "check local configuration settings" points to a credentialed scan. "See the network the way an outside attacker would" points to a non-credentialed scan run from outside. A tempting wrong answer is running the same unauthenticated scan more often, which only repeats its blind spots. Another is a penetration test, which proves that a flaw can be exploited but is not the routine fix for inaccurate scan results.