Vulnerability Scanning

Prerequisites

• Target system, dependencies and environment configured.

Usage

Purpose

A vulnerability scanner is easy to run and easy to run badly — an unauthenticated scan that misses most of what's there, or a config that buries the real issues under thousands of informational findings. This skill covers scanning so the results reflect what's actually vulnerable and are usable as input to triage, not a raw dump nobody reads.

When to use it

The data-gathering step of a vulnerability-management programme, run continuously rather than once. Everything downstream — triage, prioritisation, remediation — depends on the scan being complete and accurate, which is why doing it right matters more than which tool you pick.

Procedure

1. Know your scope first. You can only scan what you know about — an accurate asset inventory (see that skill) defines what to scan. Scanning a partial list means unscanned assets are silent blind spots.
2. Use authenticated (credentialed) scanning wherever possible — the single biggest quality lever. An unauthenticated scan sees a host from the outside and guesses; an authenticated scan logs in and reads actual installed versions and patch levels, finding far more and with fewer false positives:

   # provide credentials to the scanner (SSH keys / Windows creds / API tokens)
   # authenticated scan -> reads real package/patch state, not banner guesses
   

3. Scan the whole surface — hosts, web applications, cloud resources, and containers each need appropriate scanning (a network scanner won't find web-app bugs; use the right tool per surface). Combine sources for coverage.
4. Tune to reduce noise. Scanners emit large volumes including informational and low-severity items. Configure the scan and downstream filtering so the actionable findings aren't buried — this feeds triage, not overwhelms it.
5. Schedule it continuously. New vulnerabilities are disclosed daily against unchanged systems; a point-in-time scan is stale within days. Recurring scans (and, ideally, agent-based continuous assessment) keep the picture current.
6. Scan safely. Aggressive scanning can disrupt fragile devices (old systems, OT/IoT, printers). Use safe-check settings on sensitive segments, and coordinate scan windows.
7. Feed results into the pipeline — the scan's output goes to deduplication and triage, not straight to a report; a raw scan is data, not findings.

Cheatsheet

quality levers (in order of impact)
  1. authenticated scanning     reads real versions -> far more found, fewer FPs
  2. complete scope             scan everything (from an accurate inventory)
  3. right tool per surface     network / web-app / cloud / container scanners
  4. tuning                     don't drown triage in informational findings
  5. continuous cadence         daily disclosures -> re-scan; a scan goes stale fast

tools by surface
  network/host   Nessus, OpenVAS, Qualys, Rapid7
  web app        ZAP, Burp, Nuclei
  cloud          Prowler / native CSPM (see cloud domain)
  container      Trivy / Grype (see container domain)

safety: safe-checks on fragile/OT segments; coordinate scan windows
output -> dedup + triage (raw scan = data, not findings)

Reading the results

• A big gap between authenticated and unauthenticated results = the unauthenticated scan was missing most of the picture; authenticated is the truer view. If you're scanning unauthenticated, assume you're under-counting.
• Assets that never appear in scans = coverage gaps — unscanned hosts are unmonitored risk. Cross-check against the inventory.
• Thousands of informational/low findings drowning the criticals = a tuning problem; the scan is technically working but unusable. Filter to actionable.
• Findings on fragile devices after an aggressive scan caused an outage = scan safety wasn't configured; use safe-checks on those segments.
• A one-time scan treated as current = stale within days; the cadence is the fix.
• Authenticated, complete, tuned, continuous scanning = the input a real programme needs.

The fix / best practice

• Authenticate your scans — the highest-impact change; provide credentials so the scanner reads real state instead of guessing.
• Scan from an accurate inventory so coverage is complete; unscanned assets are blind spots.
• Use the right scanner per surface (network, web, cloud, container) and combine them.
• Tune and filter so actionable findings surface and feed triage cleanly.
• Run continuously — schedule recurring scans and use agents for continuous assessment where possible.
• Scan safely on fragile/OT segments, and coordinate windows to avoid disruption.

Pitfalls

• Unauthenticated scanning. Sees the outside and guesses — misses most issues and generates false positives. Authenticate wherever you can.
• Scanning a partial asset list. What you don't scan, you don't see; coverage gaps are silent risk. Scan from a real inventory.
• Dumping raw scanner output as "the findings". It's data — thousands of items including noise. Dedup and triage before anyone treats it as a work list.
• One-and-done scanning. Disclosures are continuous; a stale scan misleads. Re-scan on a schedule.
• Aggressive scans on fragile devices. They can cause outages; use safe-checks and coordinate.

References

• Nessus / OpenVAS / Qualys documentation (authenticated scanning setup)
• NIST SP 800-40 (patch and vulnerability management)
• The asset-inventory, triage-and-deduplication, and cvss-in-context skills
• CIS Controls — continuous vulnerability management

Inputs

• Relevant source code, logs, network traces, or system specifications.

Outputs

• Analysis findings, security audit report, or generated code artifacts.