What is vulnerability scanning?
Vulnerability scanning is the automated checking of systems against a constantly updated set of checks for known weaknesses: missing patches, vulnerable software versions, weak protocols and ciphers, default credentials, expired certificates and insecure settings. Tools such as Nessus, OpenVAS (Greenbone), Qualys and Rapid7 InsightVM run thousands of these checks and produce a report of findings, each usually tied to a CVE and a CVSS score. Scanning is the identification step of vulnerability management, which continues with analysis and prioritization, remediation, verification and reporting.
Types of vulnerability scans
| Choice | Option | What it shows |
|---|---|---|
| Credentials | Non-credentialed (unauthenticated) | What the network exposes: open ports, banners and TLS settings, with software versions inferred |
| Credentials | Credentialed (authenticated) | Logs in to read software inventories, patch state and settings, so results rely far less on guesswork |
| Delivery | Network-based scanner | Any address in scope, including printers and IoT, from the scanner's vantage point |
| Delivery | Agent-based | Each host from the inside, including laptops that are rarely on the corporate network |
| Location | External | Exposure to anyone on the internet |
| Location | Internal | What an intruder already inside could find |
Many scanners also run compliance scans that compare settings with a benchmark, often using SCAP content, and discovery scans that find hosts nobody listed.
Example: reading a finding
A non-credentialed external scan reports this on a public web server:
203.0.113.40:443 | Apache HTTP Server 2.4.49 Path Traversal (CVE-2021-41773) | Severity: High | Detection: remote version check | Evidence: Server: Apache/2.4.49
The detection line shows that the scanner read a version banner rather than testing the flaw. Here the evidence is strong: 2.4.49 is the only release affected by this CVE, and the flaw was exploited in the wild soon after its disclosure in October 2021, so the finding goes to the top of the queue. On a Linux distribution that backports fixes without changing the version number, the same banner logic can produce a false positive, which is why analysts confirm doubtful findings with a credentialed check or the vendor's advisory before opening tickets.
Scope, schedule and authorization
A scan finds problems only where it looks. Build the target list from the asset inventory and IP address management, document every exclusion with an owner and a reason, and scan fragile systems such as medical devices and industrial controllers only with vendor-approved settings, or monitor them passively instead. Typical rhythms combine always-on agent checks with network scans every week or month, plus an extra scan after significant changes. Warn the SOC before scans start, since scanner traffic looks a lot like reconnaissance, and never scan addresses you do not own or have written permission to test. PCI DSS, for example, requires internal and external scans at least every three months and after significant changes, external scans by an Approved Scanning Vendor and, since March 2025, authenticated internal scans.
Validating and acting on results
Treat every finding as a claim to check. A false positive reports a flaw that is not there, often because a patch was backported or a vulnerable feature is disabled. A false negative is a real flaw the scan missed, because the host was offline, out of scope, not visible without credentials or affected by a flaw that has no check yet. After validation, analysts group findings by the fix that closes them, rank them using CVSS together with evidence of exploitation, exposure and asset value, assign owners and deadlines, and rescan to prove each fix worked.
Vulnerability scanning vs. penetration testing
A scan is automated, broad, repeatable and run often. It reports weaknesses that probably exist but does not try to exploit them or show how they combine. A penetration test uses skilled people, under written authorization, to exploit weaknesses and chain them to prove what an attacker could achieve. Scanning finds routine problems frequently; penetration testing shows how serious they, and less obvious ones, really are.
Vulnerability scanning on the CompTIA Security+ exam
Scanning is central to SY0-801 objective 4.3, which covers carrying out vulnerability management tasks, and vulnerability scanners also appear in objective 4.4 among the tools whose results feed monitoring and alerting. Wording such as improve the accuracy of scan results points to a credentialed scan, view the network as an internet attacker would to an external non-credentialed scan, laptops that rarely connect to the office to agent-based scanning, and confirm the patch worked to a rescan. Find unpatched software on every server weekly is scanning; show the flaw is actually exploitable is a penetration test. Other distractors include a plain port scan, which lists open ports without checking for vulnerabilities, and CSPM, which checks cloud account settings rather than software inside hosts.