What Is a Vulnerability Scan? Internal vs External Network Vulnerability Scanning
Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities were the top way into breaches, at 31%. Network vulnerability scanning is how you find those weaknesses first. A vulnerability scan is an automated check of your devices, servers and applications for known flaws, missing patches and risky settings, ranked so you know what to fix.
The Problem: You Cannot Patch What You Have Not Found
Most businesses patch what they know about. Attackers target what was missed: a forgotten test server, an old firewall, a VPN appliance nobody updated. The same Verizon 2026 report found that only 26% of vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) catalog were fully remediated by the organizations studied, and the median time to full fix was 43 days, up from 32 the year before.
That gap is the reason scanning exists. A scan does not fix anything. It gives you an accurate, repeatable list of what is exposed, so patching effort goes where attackers are looking.
What Is a Vulnerability Scan?
A vulnerability scan is an automated test that checks networks, servers, endpoints and applications for known security weaknesses, such as missing patches, open ports and misconfigurations. The scanner compares what it finds against databases of known vulnerabilities, identified by Common Vulnerabilities and Exposures (CVE) numbers, and ranks each issue by severity for remediation.
What a Vulnerability Scanner Checks For
- Missing security updates in operating systems and applications
- Open ports and exposed services, such as remote desktop or old file sharing
- Default or weak credentials on devices
- Misconfigurations, such as weak TLS settings or unnecessary services
- End-of-life software that no longer gets patches
Vulnerability Scan vs Vulnerability Assessment vs Penetration Test
A scan is the automated discovery step. A vulnerability assessment adds human review: validating findings, removing false positives and judging business risk. A penetration test goes further, with a skilled tester trying to exploit weaknesses the way an attacker would. NIST SP 800-115 (2008), the technical guide to security testing, treats scanning and penetration testing as separate techniques. Scans are frequent and cheap. Pen tests are periodic and deep.
How Network Vulnerability Scanning Works
Step 1: Asset Discovery
The scanner sweeps IP ranges to find live hosts. This step often turns up devices nobody listed, which is a finding in itself.
Step 2: Port and Service Enumeration
For each host, the scanner checks which ports are open and which services and versions run behind them.
Step 3: Matching Findings Against CVE Databases
The scanner compares software versions and configurations with known vulnerabilities from sources such as the CVE list and the National Vulnerability Database (NVD).
Step 4: Risk Scoring (CVSS, EPSS, CISA KEV) and Reporting
Each finding gets a Common Vulnerability Scoring System (CVSS) severity score. Better programs add two signals: the Exploit Prediction Scoring System (EPSS) from FIRST, which estimates the chance a flaw will be exploited, and the CISA KEV catalog, which lists flaws already exploited in the wild. A decision rule that cuts noise: fix anything in KEV first, then high EPSS scores, then the rest by CVSS.
Internal vs External Vulnerability Scanning
What Is an Internal Vulnerability Scan?
An internal scan runs from inside your network, behind the firewall. It shows what an attacker who already has a foothold, such as through a phished laptop, could reach and exploit. It covers workstations, internal servers, printers and network gear.
What Is an External Vulnerability Scan?
An external scan runs from the internet against your public IP addresses and domains. It shows what any attacker can see without logging in: websites, VPN gateways, email servers, remote access portals and cloud services with public addresses.
Internal vs External Scans: Comparison Table
| Internal scan | External scan | |
|---|---|---|
| Runs from | Inside the network | The internet |
| Simulates | An attacker with a foothold, or an insider | Any outside attacker |
| Typical targets | Workstations, servers, printers, switches | Websites, VPNs, firewalls, mail servers, cloud IPs |
| Common findings | Missing patches, weak internal services, old protocols | Exposed admin portals, unpatched edge devices, weak TLS |
| PCI DSS requirement | At least every three months (Requirement 11.3.1) | At least every three months by an Approved Scanning Vendor (Requirement 11.3.2) |
Why You Need Both
External scans protect the front door, which matters because Verizon’s 2026 report shows exploitation of internet-facing flaws is now the leading entry point. Internal scans limit the damage after someone gets in. Skipping internal scans assumes nobody will ever click a bad link, which is not a safe assumption.
Other Types of Vulnerability Scans
Authenticated vs Unauthenticated Scans
An unauthenticated scan looks at systems from the outside, as a stranger would. An authenticated (credentialed) scan logs in with a read-only account and checks installed software and settings directly. Because they read installed software directly, authenticated scans can confirm missing patches that an outside view cannot see, so use them for internal scanning wherever possible.
Agent-Based vs Network-Based Scans
Network-based scanners probe devices over the network. Agent-based scanning installs a small program on each device that reports its own state, which suits laptops that are often off the office network. Many businesses use both.
Web Application, Cloud and Container Scans
Web application scanners, also called dynamic application security testing (DAST), test running websites for flaws such as injection. Cloud and container scanners check cloud settings and container images. Network vulnerability scanning does not cover these by default.
How Often Should Systems Be Scanned?
At a minimum, scan internal and external systems every month, and more often for internet-facing systems. Compliance frameworks set floors, not targets. Run extra scans after major changes and whenever a critical flaw affecting your software is announced.
Why Monthly Is a Sensible Minimum
The reasoning comes from patch deadlines. The UK Cyber Essentials scheme requires critical and high-risk updates within 14 days of release. A scan every quarter cannot show whether you met a 14-day window. Monthly scans give at least a monthly check, and weekly external scans close the gap further.
Compliance-Driven Frequency (PCI DSS, Cyber Essentials Plus, CIS Controls)
PCI DSS v4.0 requires internal and external scans at least every three months and after significant changes. The CIS Critical Security Controls v8 (Control 7, Continuous Vulnerability Management) call for automated scans of internal and externally exposed assets at least quarterly. Cyber Essentials Plus includes vulnerability scanning by the certifying assessor as part of the audit.
Continuous and Change-Triggered Scanning
Many scanners can run continuously or start a scan when a new device joins the network. CVE.org recorded 48,244 published CVE records in 2025, so a fixed quarterly schedule falls behind quickly.
Choosing a Security Vulnerability Scanner
Commercial vs Open-Source Scanners
Commercial tools such as Tenable Nessus, Qualys and Rapid7 InsightVM offer large vulnerability libraries, reporting and support. Open-source options such as OpenVAS (Greenbone) are free but need more setup and in-house skill. Nmap discovers hosts and ports but is not a full vulnerability scanner.
Features That Matter for SMBs
- Both internal and external scanning from one console
- Authenticated scanning and agents for remote laptops
- KEV and EPSS data in the prioritization, not only CVSS
- Clear reports a non-specialist can act on
- Integration with your ticketing or patch tool
Limitations of Vulnerability Scanning
False Positives and Alert Overload
Scanners flag issues that are not real, such as a patched service with an old version banner. Thousands of findings with no priority order lead teams to ignore the report.
What Scans Miss (Logic Flaws, Unknown Assets)
Scanners find known flaws in assets they can reach. They miss business logic flaws, stolen credentials, unknown cloud accounts and devices outside the scanned ranges. This is why scanning sits beside asset inventory and penetration testing, not in place of them.
Vulnerability Scanning Best Practices for Small and Midsize Businesses
- Build an asset list first, then scan everything on it.
- Scan external systems at least weekly and internal systems at least monthly.
- Use authenticated scans internally.
- Fix KEV-listed flaws first, then high-EPSS findings.
- Set remediation deadlines by severity, such as 14 days for critical issues, to match Cyber Essentials.
- Rescan after fixing to confirm the issue is closed.
- Schedule disruptive checks outside business hours and test on fragile devices first.
US and UK Guidance (CISA, NIST, PCI DSS, NCSC, Cyber Essentials)
In the US, CISA offers a free Cyber Hygiene Vulnerability Scanning service for eligible organizations, including critical infrastructure, which scans internet-facing systems and sends regular reports. NIST SP 800-40 Revision 4 (2022) covers enterprise patch management. In the UK, the National Cyber Security Centre (NCSC) publishes vulnerability management guidance, and Cyber Essentials sets the 14-day patching baseline. PCI DSS applies to any business that handles card data in either country.
Network Vulnerability Scanning Is a Visibility Habit, Not a Project
Network vulnerability scanning is not something you buy once and finish. It is the regular habit that tells you where you stand before an attacker does. Start with one external scan of your public IP addresses this week, then add monthly authenticated internal scans. If you would like help reading the first report, Cyber Security Solutions Ltd offers a free, no-obligation assessment, which you can request through our contact page.
FAQs
No. A scan finds known weaknesses automatically, while a penetration test uses a skilled person to exploit and chain weaknesses the way an attacker would, including flaws a scanner cannot see. Use scans frequently to keep systems patched, and commission a penetration test periodically or after major changes to test how defenses hold up.
Scanning your own systems, or systems you have written permission to test, is legal. Scanning systems you do not own or control without permission can break laws such as the US Computer Fraud and Abuse Act or the UK Computer Misuse Act 1990. Always get written authorization and agree on scope before scanning third-party or cloud-hosted systems.
It depends on the number of devices, the depth of checks and network speed. A scan of a few public IP addresses may finish in minutes, while an authenticated scan of hundreds of internal devices can take several hours. Schedule large scans outside business hours and split networks into smaller groups.
It can, though it is uncommon with sensible settings. Aggressive checks may slow older devices, crash fragile equipment such as some printers or industrial controllers, or flood log systems. Use safe-check settings, limit scan speed, exclude fragile devices until tested and schedule scans outside peak hours to reduce the risk.
OpenVAS from Greenbone is the best-known open-source vulnerability scanner, and Nmap is widely used for host and port discovery. US organizations may also qualify for CISA's free Cyber Hygiene scanning service for internet-facing systems. Free tools work well but need more setup, tuning and in-house skill than commercial scanners.
An internal scan runs inside your network and shows what an attacker with a foothold could reach, such as unpatched workstations and servers. An external scan runs from the internet and shows what anyone can see, such as websites, VPNs and firewalls. PCI DSS requires both at least every three months.
