What is a vulnerability scan?

A vulnerability scan is an automated test that inspects systems, networks or applications for known security weaknesses and misconfigurations, producing a report of the issues found.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated and identifies known weaknesses at scale, while a penetration test is a manual, in-depth attempt by a tester to exploit weaknesses and demonstrate real-world impact.

How often should you run vulnerability scans?

Neither ISO 27001 nor SOC 2 prescribes a fixed scan frequency — the schedule should be risk-based — but in practice many organisations scan monthly or quarterly and after any significant change to their systems.

Vulnerability Scan - Glossary

A vulnerability scan is an automated process that uses specialised tools to detect known security weaknesses in systems, networks, applications and configurations. Scanners compare the target environment against databases of known vulnerabilities (such as CVE entries) and misconfigurations, producing reports that detail discovered issues along with severity ratings. Scans can be authenticated (using credentials for deeper inspection) or unauthenticated (simulating an external attacker's view).

Vulnerability scanning is a cost-effective way to maintain continuous visibility into an organisation's security posture and is a required control in many compliance frameworks. Scans should be run on a regular schedule and after significant changes to the environment, with results feeding into the broader vulnerability management process. Interpreting scan results in context is important, as false positives can waste remediation effort whilst false negatives may leave critical weaknesses unaddressed.

Frequently asked questions

What is a vulnerability scan?: A vulnerability scan is an automated test that inspects systems, networks or applications for known security weaknesses and misconfigurations, producing a report of the issues found.
What is the difference between a vulnerability scan and a penetration test?: A vulnerability scan is automated and identifies known weaknesses at scale, while a penetration test is a manual, in-depth attempt by a tester to exploit weaknesses and demonstrate real-world impact.
How often should you run vulnerability scans?: Neither ISO 27001 nor SOC 2 prescribes a fixed scan frequency — the schedule should be risk-based — but in practice many organisations scan monthly or quarterly and after any significant change to their systems.

Vulnerability Scan

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

Z

Frequently asked questions