Vulnerability scanning

Network vulnerability scanning dates from SATAN (Security Administrator Tool for Analyzing Networks), released by Dan Farmer and Wietse Venema in 1995, followed by Nessus in 1998; when Nessus became proprietary in 2005, the open-source fork became OpenVAS, today maintained by Greenbone. A scan runs in stages: host discovery (ICMP, TCP and ARP probes), port scanning, service and version fingerprinting from banners and protocol behaviour, and then vulnerability checks, which are either version-based (the detected product and version are matched to CVE records, typically via CPE identifiers from the NVD) or active (a benign probe that tests for the flaw directly, such as a specific request that a vulnerable server answers differently).

The distinction between unauthenticated and authenticated (credentialed) scans is fundamental. An unauthenticated scan sees only what an attacker on the network sees and must infer versions from banners, which produces both false positives - Linux distributions such as RHEL backport security fixes without changing the upstream version string - and false negatives for client-side software that exposes no port. An authenticated scan logs in over SSH, SMB/WinRM or an agent and reads installed package lists, registry keys and configuration directly, which is far more accurate and also enables configuration compliance checks against CIS Benchmarks via SCAP content. Agent-based scanning covers laptops that are rarely on the corporate network. Further variants are external attack-surface scanning of internet-facing assets, web application scanning (DAST), container image and registry scanning, and cloud configuration scanning.

Frequencies are commonly set by frameworks: CIS Controls v8 Safeguard 7.5 asks for authenticated and unauthenticated scans of internal assets at least quarterly and 7.6 for scans of externally exposed assets at least monthly; PCI DSS v4.x requirement 11.3 requires internal and external scans at least every three months, with external scans performed by an Approved Scanning Vendor (ASV). Leading programmes scan continuously and trigger ad-hoc scans when a high-profile CVE is published.

Findings carry CVSS scores (v3.1 is still the most common, v4.0 was published by FIRST in November 2023), but CVSS measures severity, not risk. Scanners are only as current as their plugin feeds and the vulnerability data behind them; the NVD enrichment backlog that began in 2024 showed how dependent version matching is on upstream CPE data. Scans can also disrupt fragile systems - older printers, medical devices and OT controllers can crash under aggressive probing - so scan policies, windows and exclusions must be agreed with system owners. Scanning is one input to a vulnerability assessment, which adds validation, context and prioritisation, and it is distinct from a penetration test, which exploits and chains findings to prove impact.