What Is Vulnerability Scanning?
Definition
Vulnerability scanning is the automated checking of computers, network devices, websites, and cloud services for known security weaknesses, such as missing patches, outdated software, and risky settings. A scanner compares what it finds against a database of known flaws, usually identified by CVE, and produces a list of issues to fix.
How It Works
NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment, describes how scanners work and where they fall short:
- External scans look at your systems from the internet, the way an attacker would, and find exposed services and the software versions behind them.
- Internal scans run from inside the network.
- Authenticated (credentialed) scans sign in to each host with an administrator account and read installed software directly, which finds far more than a scan from the outside.
NIST lists three weaknesses. Scanners "rely on a repository of signatures," so they only find known flaws and must be updated often. They can have "a high false positive error rate," so a person must review the results. And they miss things, which is why NIST describes using multiple scanners or other testing. NIST also advises assessors to "not simply accept the risk levels assigned by vulnerability scanners."
Scanning is not penetration testing. A scan lists likely weaknesses. A penetration test has a person try to exploit them. For internet-facing systems, CISA offers free Cyber Hygiene vulnerability scanning to US governments and to public and private critical infrastructure organizations, with weekly reports and alerts on urgent findings such as known exploited vulnerabilities.
Real-World Example
In December 2021, CISA and its partners responded to "active, widespread exploitation" of Log4Shell (CVE-2021-44228), a flaw in Log4j, a logging library built into many products. Because Log4j was buried inside other software, many organizations did not know where they ran it. CISA's guidance told them to enumerate every instance through "scanning (network and host)," to consider "file system scanning scripts" or scanners "that leverage file scanning," and to check installed products against its vulnerable software list. A quick external scan alone could not find every copy.
Why It Matters for a Small Business
Attackers scan the internet constantly for systems with known flaws. Most small businesses have something exposed, such as a firewall, a VPN, a remote desktop port, or a website, and few check it regularly. A routine scan is an inexpensive way to see what an attacker sees and to confirm that patches actually installed. The catch is follow-through. A scan report nobody reads, or one with hundreds of unsorted findings, changes nothing. The value comes from a person sorting results by what is exposed and known to be exploited, then confirming each fix with a rescan.
How to Spot It / How DTS Handles It
Warning signs: no scan in the last quarter, only external scans with no credentialed internal ones, reports nobody reviews, or the same findings repeating month after month.
DTS can help with scheduled external and credentialed internal scans, weeding out false positives, ranking findings by exposure and known exploitation, and rescanning after fixes. See our managed IT service, or our WordPress health check for websites.
Related Terms
- CVE: the IDs scanners report.
- Patch management: fixing what scans find.
- Penetration testing: a person exploiting what a scan finds.
- False positive: a finding that is not real.
- Asset inventory: you can only scan what you know about.
- SBOM: lists the components, like Log4j, hidden inside software.
- Plugin vulnerability: a common website scan finding.
Sources
- NIST, SP 800-115, Technical Guide to Information Security Testing and Assessment (September 2008): https://csrc.nist.gov/pubs/sp/800/115/final
- CISA, Apache Log4j Vulnerability Guidance (archived, last updated April 8, 2022): https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance
- CISA, Cyber Hygiene Services: https://www.cisa.gov/cyber-hygiene-services
Last updated October 14, 2026.