Vulnerability Scanning

• Scans are the cheapest way to find the famous 90%: unpatched CVEs, default creds, weak TLS, missing headers.
• A scan report is a prioritization tool — the ranking (severity x exploitability x reachability) is the actual product.
• Every mature org scans continuously; knowing how to run and read a scan is table stakes for red and blue alike.

The tests flag the markers; your job is to sort which markers need the specialist this week.

• The scanner fingerprints hosts and services, then matches against its check/plugin database (CVE feeds, config rules).
• Each finding carries CVE/CWE references, CVSS severity, evidence, and a remediation recommendation.
• Credentialed scans reach deeper (config, patch level) versus uncredentialed surface scans.
• Triage converts raw findings to actions: verify, dedupe, rank by reachability, assign an owner.

• An org runs weekly credential scans against its own fleet and patches the top CVEs within an SLA.
• A responder reconciles a scan report with a breach: 'was this CVE on the host?' answers in one query.
• A pentest uses scan output as the roadmap, then verifies manually to separate truth from false positive.

• Scan on a cadence with consistent scope; trend the finding count to see progress.
• Credential where possible for config-depth reality; uncredentialed only proves what strangers see.
• Triage the false positives: verify a sample of every family before trusting the count.
• Store scan evidence with retention; the 'was we clean then' question recurs.

• Treating every scan hit as proof — tools report, humans verify.
• Scheduling scans that hammer production at 3am with no rate limit, degrading the service you're protecting.
• Skipping the credential upgrade, so the report misses config-level flaws that matter most.
• Deduping by severity alone and burying reachable high-risk items under 'many highs, slowly'.

• When a finding won't reproduce, run the manual check yourself (nc banner, openssl cipher) before judging it.
• Compare credentialed vs uncredentialed scan results on one host to size the gap.
• Check the scanner's 'last scanned' date before trusting a stale report.

• Scans of other people's systems without consent are intrusion attempts, full stop.
• A scanner reading credentials is a sensitive process: keep scan credentials minimal-scope and rotated.