Vulnerability Scanning
An automated process of identifying security weaknesses in computer systems, networks, or applications.
Detailed Explanation
Vulnerability scanners look for known issues like outdated software, misconfigured firewalls, or common coding errors (like XSS or SQLi). Regular scanning is a requirement for many compliance standards (like SOC2 or PCI-DSS). It helps security teams prioritize patches and fixes before attackers can exploit the weaknesses.
Quick Summary
Vulnerability scanning is automated, recurring detection of known weaknesses, outdated packages, misconfigurations, exposed services. It's the baseline hygiene that lets pentesters and humans focus on the interesting bugs.
Key Takeaways
- Categories: SAST (code), DAST (running app), SCA (dependencies), infrastructure scans (cloud, network).
- Output is noisy by design, triage by exploitability and exposure, not just CVE score.
- Integrate into CI: fail builds on critical findings, alert on high; otherwise findings get ignored.
- Authenticated scans find far more than anonymous ones, give the scanner a real account.
- Scanners only find *known* vulnerabilities; zero-days and logic bugs need pentesting and code review.
When to use it
- Continuous SCA via Dependabot, Snyk, or Renovate for npm/pip/cargo dependencies.
- Container image scanning (Trivy, Grype) in CI before pushing to a registry.
- Cloud posture management (AWS Inspector, Wiz, Prisma) for misconfigurations.
- Compliance evidence: SOC2 and PCI both expect regular scans with documented remediation.
Common Mistakes
- Treating every CVSS 9.8 as critical regardless of context, most don't apply to your usage.
- Running scans but never fixing findings; the report becomes liability rather than defense.
- Scanning only production while staging hosts the same software with weaker network controls.
- Confusing scan results with a real security assessment, they're a floor, not a ceiling.
Vulnerability Scanning, Frequently Asked
How often should I scan?
Dependency scans on every PR, infrastructure scans daily, full external scans weekly to monthly. Compliance frameworks usually mandate at least quarterly; quarterly is the minimum, not the goal.
Scan vs. pentest?
Scans are automated and find known weaknesses cheaply; pentests are manual and find creative bugs (logic flaws, chained vulns) scanners miss. You need both. Scan continuously; pentest annually or after major changes.