What Is a Vulnerability Scan? How Vulnerability Scanning Works

A vulnerability scan is an automated check of your systems against known security weaknesses, such as missing patches, outdated software, weak encryption and services that are exposed when they should not be. It is quick, repeatable and broad, which makes it the routine layer of security testing that runs between less frequent manual tests. This guide explains how vulnerability scanning works, the main types of scan, how long a scan takes, whether it is legal and how it compares with a vulnerability assessment and a penetration test.

What is a vulnerability scan?

A vulnerability scan uses software, called a vulnerability scanner, to examine each system in scope and compare what it finds with databases of published vulnerabilities and common misconfigurations. In cyber security terms, vulnerability scanning is the discovery step of vulnerability management: it finds candidate weaknesses so that someone can confirm, prioritise and fix them.

Each finding usually comes with an identifier such as a CVE number, a severity score based on CVSS, the affected system and a suggested fix. A scan checks for what is already known. It cannot judge business logic, spot a flaw nobody has published, or prove that a weakness can actually be exploited.

What does a vulnerability scan do?

A typical network scan works in four stages:

1. Discovery. The scanner finds live hosts in the address ranges you give it, and the ports and services each one exposes.
2. Fingerprinting. It identifies the operating system, software and versions behind each service, either from outside or, in an authenticated scan, by logging in and reading them directly.
3. Matching. It compares what it found with its library of checks: missing security updates, known CVEs, weak TLS settings, default passwords and risky configurations.
4. Reporting. It lists each possible weakness with a severity rating and remediation advice, ready for a person to review.

Web application scanners work in a similar way, but they crawl pages and forms and send test inputs to look for issues such as injection flaws and missing security headers. Cloud scanners read your account configuration through the provider’s interfaces and compare it with recognised benchmarks.

What does a vulnerability scanner do?

A vulnerability scanner is the software that runs a vulnerability scan: it finds hosts, services and software versions, compares them with databases of known vulnerabilities (CVEs) and misconfigurations, and reports each match with a severity rating, usually based on CVSS. Scanners come in network, web application, cloud and container versions, both open-source and commercial, and the list of common scanners below gives examples of each.

Types of vulnerability scan

Scans are described by where they run from, how much access they have and what they target:

Most programmes combine several, for example authenticated internal network scans every month, external scans every week and, if you take card payments, a quarterly ASV scan.

How long does a vulnerability scan take?

Anything from a few minutes to many hours. A single host or a handful of internet-facing addresses can finish in minutes, a large internal network can take several hours, and the first scan of a new environment usually takes the longest. These are the main factors:

The analysis takes time too. Removing false positives and prioritising the results is often a bigger job than running the scan.

Why is vulnerability scanning important?

Because new vulnerabilities are published every day, and attackers scan the internet for them too. Regular scanning matters for five reasons:

• It finds known weaknesses early, often within days of a vulnerability being published or a system changing.
• It covers everything in scope every time, which no manual test can do at the same frequency.
• It confirms fixes: a rescan shows whether a patch or configuration change actually closed the issue.
• It provides evidence that standards such as PCI DSS, Cyber Essentials Plus and ISO 27001 expect to see.
• It shows the trend: comparing scans over time tells you whether your exposure is shrinking.

Is vulnerability scanning legal?

Yes, when you scan systems you own or have the owner’s written permission to scan. In the UK, accessing or trying to access a computer without authorisation can be an offence under the Computer Misuse Act 1990, so scanning someone else’s systems without permission is a risk you should not take. Good intentions are no defence: a white hat hacker only tests with the owner’s written authorisation.

In practice that means three things. Scan only the address ranges and applications you are responsible for. Check that your cloud and hosting providers allow scanning of the services you use, because their terms set the rules for shared infrastructure. And when a third party scans for you, give them written authorisation that lists the targets and the dates.

Vulnerability scan vs vulnerability assessment vs penetration test

The three are often confused, but they answer different questions:

The three build on each other: a scan feeds an assessment, and a penetration test shows what an attacker could actually do with what the assessment found. Our comparison of penetration testing vs vulnerability scanning goes into more detail.

Which vulnerability scanners are used?

Scanners fall into a few categories, each with open-source and commercial options:

The examples illustrate each category; they are not recommendations. How a scanner is configured (authenticated or not, safe checks, accurate scope) and how carefully the results are reviewed matter more than which product you choose. The NCSC’s guidance on vulnerability scanning tools and services sets out what to look for when you choose a scanner or a scanning service.

What do PCI DSS 11.3, Cyber Essentials Plus and ISO 27001 A.8.8 expect?

Each framework treats scanning slightly differently:

Only the quarterly external scans for PCI DSS 11.3.2 have to be run by an ASV. Sovereign Secure is a QSA company, not an ASV: we deliver PCI ASV scans through our PCI SSC Approved Scanning Vendor partner. The requirements are in the PCI DSS standard, free from the PCI SSC document library, and the NCSC’s vulnerability management guidance explains how scanning fits into a wider programme.

Why Sovereign Secure

• A PCI SSC Qualified Security Assessor company, so scan cycles and reports are set up the way an assessor checks PCI DSS 11.3.
• An IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates, so we know what the CE+ scans look for.
• ISO 27001 certified, so scan data is handled under an independently certified information security management system.
• Scanning and penetration testing from one provider, with PCI ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.

Next step

Our vulnerability scanning services cover internal, external, cloud and web application scans, with false positives removed, findings prioritised and rescans after fixes. Send us a rough list of your systems through the penetration testing quote form, or call +44 161 523 5276.