Simple explanation
Before you can manage vulnerabilities, you have to actually find them systematically — starting with knowing what exists to scan in the first place.
Technical explanation
- Asset discovery — you can't scan (or protect) what you don't know exists; discovery is the prerequisite step to any scanning program.
- Scheduling — how often scans run, balancing thoroughness against system load and change frequency.
- Scope — exactly what's included/excluded from a given scan.
- Credentialed vs. non-credentialed — credentialed scans log in with valid credentials, seeing far more (missing patches, local misconfigurations); non-credentialed scans see only what's visible from outside, like an external attacker would.
- Trusted vs. untrusted — whether the scanning source is treated as a trusted internal actor or an untrusted external one, affecting what a firewall/IDS allows through.
- Types of data collected — vulnerabilities, configuration data, compliance data, and more, depending on scan type.
- Technical constraints — some systems (fragile legacy equipment, ICS/SCADA) may not tolerate active scanning well, requiring passive alternatives.
- Workflow — how findings flow from scan to remediation to validation, as a repeatable process, not a one-off event.
- SCAP (Security Content Automation Protocol) — a standardized way to check systems against security configuration benchmarks automatically.
- API-based scanning — using an API to pull configuration/vulnerability data directly, useful in cloud environments.
- Internal vs. external scanning — internal reveals what's visible from inside the network; external reveals what an outside attacker would see.
- Agent-based vs. agentless — agent-based installs lightweight software on each host for continuous, detailed visibility even off-network; agentless scans from a central point without installing anything locally, simpler to deploy but less continuous.
Industry frameworks informing scanning scope/priorities: PCI DSS (Payment Card Industry Data Security Standard — mandates specific scanning requirements for cardholder data environments), MITRE ATT&CK, OWASP (Open Worldwide Application Security Project — web application security focus), and the ISO 27000 series (international information security management standards).
Synonyms / related terms
| Term | Means | |---|---| | SCAP | Security Content Automation Protocol | | PCI DSS | Payment Card Industry Data Security Standard | | Credentialed scan | Authenticated scan |
Concept Check
"A vulnerability scan run without any login credentials reports far fewer findings on a Windows server than expected, missing several known-missing patches." This isn't a scanner malfunction — it's the expected limitation of a non-credentialed scan, which can only see what's visible externally, not what a credentialed (authenticated) scan would reveal from inside the system.
Interview-style Q&A
Q: When would you choose agent-based scanning over agentless, given the extra deployment overhead? A: "When devices spend significant time off the corporate network — laptops that travel, remote workers — an agentless scan simply can't reach them on its own schedule. An agent travels with the device and reports back whenever it has connectivity, giving continuous visibility agentless scanning structurally can't provide for that population."
Memory trick
"Discover, Decide Scope, Choose Credentials, Choose Method" — the four decisions, in order, before running any vulnerability scan.