Vulnerability scanning is an automated inspection of computers, networks and applications to identify security weaknesses that an attacker could exploit.

What a network vulnerability scan does

A network vulnerability scanner checks systems and network devices against a database of known weaknesses: open ports, outdated or unpatched services, weak configurations and default credentials. It then classifies what it finds by severity so the most serious issues can be fixed first.

Scans may be run by an organisation's own IT or security team, or by an external provider. Some standards require them: under PCI DSS, for example, external scans of systems that handle payment card data must be performed by an Approved Scanning Vendor (ASV). Attackers also run scans, looking for points of entry.

Authenticated and unauthenticated scans

• Unauthenticated scan: the scanner has no credentials, so it sees what an outside attacker would see.
• Authenticated scan: the scanner logs in, so it also finds weaknesses that are visible to a trusted user, or to an attacker who has obtained a user's access.

Running both gives the most complete picture.

Things to keep in mind

• Scanning can be intrusive. Some checks can cause errors or restarts on fragile systems, so schedule scans carefully and tell system owners in advance.
• A scan is a point-in-time result. Scan regularly, and after significant changes.
• Network scanning does not test the logic of your web applications. Flaws such as SQL injection or broken access control need a web application scanner.

How Vooki Pro helps

• Vooki Pro is a web application and API scanner: it tests the application layer that network scanners do not reach.
• Also checks TLS configuration, certificates and outdated server software on your web hosts.
• Use it alongside your network scanner for full coverage.

Frequently asked questions

Is a network scan enough for a website?

No. Network scanners find open ports and outdated services, but not flaws in your application's own logic, such as SQL injection or IDOR.

Do I need both?

Yes. Network scanning covers infrastructure; DAST covers the web application and APIs.

Related: What is DAST (dynamic application security testing)? · HTTPS done right: HSTS and TLS configuration