# Vulnerability Scanning > Use when running vulnerability scans that find real issues — authenticated scanning, sane scope, and getting results you can act on instead of a raw dump. - Skill: `jihedbfr-art/vulnerability-scanning` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add jihedbfr-art/vulnerability-scanning` - Raw SKILL.md: https://api.skillmd.com/api/skills/jihedbfr-art/vulnerability-scanning/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: jihedbfr-art (https://skillmd.com/u/jihedbfr-art) - Updated: 2026-09-21 - Page: https://skillmd.com/skills/jihedbfr-art/vulnerability-scanning --- ## Prerequisites - Target system, dependencies and environment configured. ## Usage ### Purpose A vulnerability scanner is easy to run and easy to run badly — an unauthenticated scan that misses most of what's there, or a config that buries the real issues under thousands of informational findings. This skill covers scanning so the results reflect what's actually vulnerable and are usable as input to triage, not a raw dump nobody reads. ### When to use it The data-gathering step of a vulnerability-management programme, run continuously rather than once. Everything downstream — triage, prioritisation, remediation — depends on the scan being complete and accurate, which is why doing it right matters more than which tool you pick. ### Procedure 1. **Know your scope first.** You can only scan what you know about — an accurate asset inventory (see that skill) defines what to scan. Scanning a partial list means unscanned assets are silent blind spots. 2. **Use authenticated (credentialed) scanning wherever possible — the single biggest quality lever.** An unauthenticated scan sees a host from the outside and guesses; an authenticated scan logs in and reads actual installed versions and patch levels, finding far more and with fewer false positives: ``` # provide credentials to the scanner (SSH keys / Windows creds / API tokens) # authenticated scan -> reads real package/patch state, not banner guesses ``` 3. **Scan the whole surface** — hosts, web applications, cloud resources, and containers each need appropriate scanning (a network scanner won't find web-app bugs; use the right tool per surface). Combine sources for coverage. 4. **Tune to reduce noise.** Scanners emit large volumes including informational and low-severity items. Configure the scan and downstream filtering so the actionable findings aren't buried — this feeds triage, not overwhelms it. 5. **Schedule it continuously.** New vulnerabilities are disclosed daily against unchanged systems; a point-in-time scan is stale within days. Recurring scans (and, ideally, agent-based continuous assessment) keep the picture current. 6. **Scan safely.** Aggressive scanning can disrupt fragile devices (old systems, OT/IoT, printers). Use safe-check settings on sensitive segments, and coordinate scan windows. 7. **Feed results into the pipeline** — the scan's output goes to deduplication and triage, not straight to a report; a raw scan is data, not findings. ### Cheatsheet ``` quality levers (in order of impact) 1. authenticated scanning reads real versions -> far more found, fewer FPs 2. complete scope scan everything (from an accurate inventory) 3. right tool per surface network / web-app / cloud / container scanners 4. tuning don't drown triage in informational findings 5. continuous cadence daily disclosures -> re-scan; a scan goes stale fast tools by surface network/host Nessus, OpenVAS, Qualys, Rapid7 web app ZAP, Burp, Nuclei cloud Prowler / native CSPM (see cloud domain) container Trivy / Grype (see container domain) safety: safe-checks on fragile/OT segments; coordinate scan windows output -> dedup + triage (raw scan = data, not findings) ``` ### Reading the results - **A big gap between authenticated and unauthenticated results** = the unauthenticated scan was missing most of the picture; authenticated is the truer view. If you're scanning unauthenticated, assume you're under-counting. - **Assets that never appear in scans** = coverage gaps — unscanned hosts are unmonitored risk. Cross-check against the inventory. - **Thousands of informational/low findings drowning the criticals** = a tuning problem; the scan is technically working but unusable. Filter to actionable. - **Findings on fragile devices after an aggressive scan caused an outage** = scan safety wasn't configured; use safe-checks on those segments. - **A one-time scan treated as current** = stale within days; the cadence is the fix. - **Authenticated, complete, tuned, continuous scanning** = the input a real programme needs. ### The fix / best practice - **Authenticate your scans** — the highest-impact change; provide credentials so the scanner reads real state instead of guessing. - **Scan from an accurate inventory** so coverage is complete; unscanned assets are blind spots. - **Use the right scanner per surface** (network, web, cloud, container) and combine them. - **Tune and filter** so actionable findings surface and feed triage cleanly. - **Run continuously** — schedule recurring scans and use agents for continuous assessment where possible. - **Scan safely** on fragile/OT segments, and coordinate windows to avoid disruption. ### Pitfalls - **Unauthenticated scanning.** Sees the outside and guesses — misses most issues and generates false positives. Authenticate wherever you can. - **Scanning a partial asset list.** What you don't scan, you don't see; coverage gaps are silent risk. Scan from a real inventory. - **Dumping raw scanner output as "the findings".** It's data — thousands of items including noise. Dedup and triage before anyone treats it as a work list. - **One-and-done scanning.** Disclosures are continuous; a stale scan misleads. Re-scan on a schedule. - **Aggressive scans on fragile devices.** They can cause outages; use safe-checks and coordinate. ### References - Nessus / OpenVAS / Qualys documentation (authenticated scanning setup) - NIST SP 800-40 (patch and vulnerability management) - The asset-inventory, triage-and-deduplication, and cvss-in-context skills - CIS Controls — continuous vulnerability management ## Inputs - Relevant source code, logs, network traces, or system specifications. ## Outputs - Analysis findings, security audit report, or generated code artifacts.