How vulnerability scanning works

  1. Target selection. The scanner is given a list of hosts, IP ranges or web applications, ideally from an up-to-date asset inventory.
  2. Discovery. It identifies open ports, running services and software versions.
  3. Checks. It compares those findings with known vulnerabilities, usually referenced by CVE identifiers, and tests for common misconfigurations.
  4. Reporting. Results are scored, often with CVSS, and grouped so teams can prioritise fixes.

External vs internal scanning

  • External scanning tests what is reachable from the internet, with no credentials. It shows what an attacker sees first.
  • Internal scanning runs inside the network, often with credentials, and finds deeper issues such as missing patches on workstations.
  • Authenticated web scanning logs in to applications to test functionality behind the login page.

Vulnerability scanning vs penetration testing

A scan is automated, broad and repeatable, and it reports likely weaknesses. A penetration test is a human-led exercise that tries to exploit weaknesses and chain them together to show real impact. Scanning should run continuously, while penetration testing is periodic and goes deeper on a defined scope.

Prioritising scan results

Scans often produce more findings than teams can fix. Prioritise internet-facing assets, vulnerabilities listed in the CISA KEV catalogue or otherwise known to be exploited, and issues on systems that hold sensitive data. Then confirm fixes with a re-scan.

How DarkInvader helps

DarkInvader runs multi-engine vulnerability scanning against the assets its discovery finds, so new and forgotten systems are covered automatically. It tracks resolution by re-checking fixed issues and explains each finding with remediation guidance.

Explore Vulnerability Scanning

Frequently asked questions

How often should I run vulnerability scans?

External, internet-facing assets should be scanned continuously or at least weekly, because new vulnerabilities are published every day. Many standards set a minimum, but attackers do not wait for the next quarterly scan.

Is vulnerability scanning safe for production systems?

Most modern scanners are designed to be safe, using non-destructive checks. Fragile or legacy systems can still be affected, so agree scan windows and exclusions with system owners.

Does Cyber Essentials require vulnerability scanning?

Cyber Essentials Plus includes an external vulnerability scan as part of its technical assessment. The basic Cyber Essentials self-assessment focuses on controls such as patching rather than a scan.

Related terms and reading

Sources