Vulnerability scans in plain English
In a vulnerability scan, a specialized program – the scanner – examines your servers, workstations, and network devices. It determines which software is running in which version and compares this against databases of known vulnerabilities. If it finds an outdated version with a known vulnerability or an insecure setting, it reports it.
An everyday comparison: a vulnerability scan is similar to a car’s periodic safety inspection. The inspector works through a fixed checklist – brakes, lights, tires, rust. Anything on the list is reliably caught. Whether a skilled thief could still open the car in seconds isn’t part of the inspection. Finding that out is the job of a penetration test.
It’s also important to distinguish a scan from a vulnerability assessment: the scan delivers raw data. Only when experts review the results, weed out false positives, and prioritize by real-world risk does it become a vulnerability assessment your IT team can act on in a targeted way.
How a vulnerability scan works
- Discover systems: The scanner determines which devices are reachable in the network range being tested and which services are running on them – such as a web server or a remote maintenance interface.
- Identify software: Based on the services’ responses, it identifies products and versions.
- Compare: It compares what it has found against databases of known vulnerabilities – most of which have a globally unique CVE identifier – and looks for typical misconfigurations such as outdated encryption.
- Rate: Each finding is assigned a severity level, often based on the CVSS scoring system.
- Report: The end result is a list of all findings – which can quickly run to hundreds of entries in larger environments.
External scans look at your systems from the internet; internal scans check the corporate network. Authenticated scans are particularly informative: the scanner signs in to the systems with a dedicated account and reads update levels and settings directly.
A practical example
Here’s a typical scenario: A wholesaler with three locations has an authenticated vulnerability scan performed every month. This time, the scanner reports a critical vulnerability on a file server for which the vendor released an update long ago. The cause: after a server migration, automatic updates had not been turned back on.
At the same time, the scanner reports two supposed vulnerabilities on the firewall. On closer inspection, they turn out to be false positives – the vendor had fixed the flaws without changing the version number. The IT team installs the missing update, turns automatic updates back on, and documents the false positives for the next scan.
Why does this matter for businesses?
Attackers scan the internet automatically for vulnerable systems – often shortly after a vulnerability becomes known. It’s not just deliberately chosen targets that end up in their sights, but anyone whose system happens to be vulnerable at the time. Regular scans help you find and close such gaps before attackers exploit them.
That’s why regulations and standards such as the NIS2 Directive and ISO/IEC 27001:2022 expect a structured approach to handling technical vulnerabilities. Organizations that process payment card data must run internal and external vulnerability scans at least every three months under PCI DSS 4.0.1, the payment card industry’s security standard.
At the same time, a scan has clear limits: it only finds what is already known, produces false positives, and detects neither logic flaws nor the chaining of several minor weaknesses into a dangerous attack path. For that depth, you need a penetration test.
What to look out for
- Scan regularly: Fixed intervals of one to three months have proven effective, plus additional scans after major changes.
- Scan everything: Include all systems – including cloud services, branch locations, and forgotten test servers.
- Scan with credentials: Internal scans should run authenticated so that vulnerabilities in installed software become visible, too.
- Review the results: Have critical findings verified and prioritized by real-world risk instead of working through long lists from top to bottom.
- Assign responsibilities: Make scanning part of your patch management – the structured process for installing updates – with clear responsibilities and deadlines.
- Handle sensitive systems with care: Scan production systems or medical devices only with adjusted settings or after prior agreement.
How Rootsektor can help
With our Vulnerability Assessment, we go beyond a simple scan: we run low-impact scans during agreed time windows, verify relevant results manually, weed out false positives, and prioritize every finding according to its actual risk to your business. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person – not just in the report. After scoping, you’ll receive a fixed-price quote – you can request it via our Pentest Quote page.