What is vulnerability scanning?
Glossary
The short answer |
|---|
Vulnerability scanning is the automated process of identifying hosts, applications and software components and checking them against databases of known vulnerabilities and misconfigurations. NIST SP 800-115 describes it as a technique to identify hosts, host attributes and associated vulnerabilities. Scans produce a ranked list of potential weaknesses, which teams then validate, prioritize and fix. |
How does vulnerability scanning work?
A scanner discovers what is running, fingerprints versions and configurations, and compares the results with public vulnerability data. Most findings reference a CVE identifier and a CVSS severity score, maintained by MITRE’s CVE program and FIRST respectively. Some scanners also send safe test requests to confirm a weakness responds as expected.
What are the main types of vulnerability scans?
Scan type | What it checks | Example finding |
|---|---|---|
Network and host | Open ports, services and operating systems | An outdated SSH server |
Web application (DAST) | Running web apps and APIs | Reflected cross-site scripting |
Dependency (SCA) | Open source packages in your code | A library with a known critical CVE |
Container image | Packages inside images | A vulnerable base image |
Cloud configuration | Cloud account settings | A public storage bucket |
Secrets | Code and history | A leaked API key |
Why does vulnerability scanning matter for startups?
Many breaches start with a known, already patched flaw that nobody updated. Scanning is the cheapest way to catch those. It also produces the recurring evidence that SOC 2, ISO 27001 and customer questionnaires ask for when they check how you manage technical vulnerabilities. The hard part is not running a scanner, it is triaging the output so the team fixes what matters.
Scanning vs penetration testing
Scanning: automated, broad, frequent, and reports potential weaknesses.
Penetration testing: targeted, attempts exploitation, and proves which weaknesses lead to real impact.
Together: scan continuously, pentest periodically, and use each to check the other.
How NexusVoid handles it
NexusVoid covers scanning in two places. Argus runs SAST, SCA and secrets scanning from the outside in, maps findings to MITRE ATT&CK with attack paths, and retests on merge. Striker runs vulnerability assessment and pentest scans across web, API, cloud and mobile, pay per scan, using more than 20 tools, with a report in under 60 minutes.
Related terms
Penetration testing
VAPT (vulnerability assessment and penetration testing)
ASPM (application security posture management)
Attack surface management
SBOM (software bill of materials)
Frequently asked questions
How often should I run vulnerability scans?
Scan code and dependencies on every pull request or build, and scan internet-facing systems at least weekly. New vulnerabilities are published every day, so a scan from last quarter says little about today. PCI DSS, for example, requires internal and external vulnerability scans at least once every three months, and many teams go well beyond that.
What is the difference between authenticated and unauthenticated scans?
An unauthenticated scan tests a system from the outside with no login, which shows what an anonymous attacker could see. An authenticated scan logs in with credentials and can inspect installed software, settings and pages behind the login. Authenticated scans find more issues. Unauthenticated scans better reflect the view from the internet.
Why do vulnerability scanners report false positives?
Scanners often infer a vulnerability from indirect signals, such as a version number in a header, without confirming the flaw exists. Backported patches, disabled features and unreachable code can all trigger alerts that do not apply. That is why findings need validation, either by a person, by a reachability check, or by a penetration test that tries to exploit them.
Which vulnerabilities should I fix first?
Start with issues that are known to be exploited, reachable from the internet and touching sensitive data. CISA’s Known Exploited Vulnerabilities catalog lists flaws seen in real attacks, which is a strong signal. After that, use CVSS severity together with how exposed the system is and what it would cost the business if it were compromised.
Drowning in scanner output or not scanning at all? Book a call at /contact and we will help you get to a short, ranked list.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.