Vulnerability scanning
A vulnerability scanner probes systems to identify known weaknesses: unpatched software, misconfigured services, default credentials, unnecessary open ports. It checks findings against a database of known vulnerabilities and reports them with severity ratings. Critically, a scanner does not exploit the vulnerabilities it finds. It identifies potential exposure, not confirmed exploitability.
Credentialed scans log into target systems with valid credentials and see what an authenticated user sees: installed software versions, service configurations, patch levels, user accounts. They find far more issues than unauthenticated scans. Non-credentialed scans see only what an external attacker without credentials would see: open ports, banner information, detectable services. They are faster and require less access but miss most internal vulnerabilities.
Active scanning sends probes directly to targets and can be detected. Passive scanning observes existing network traffic without sending probes, creating no detection risk but missing vulnerabilities not visible in traffic. Common scanning tools include Nessus, Qualys, Rapid7 InsightVM, and the open-source OpenVAS.
CVSS scoring and prioritization
CVSS (Common Vulnerability Scoring System) provides a standardized 0-10 scale for rating vulnerability severity. The score ranges: 0 is None, 0.1 to 3.9 is Low, 4.0 to 6.9 is Medium, 7.0 to 8.9 is High, and 9.0 to 10.0 is Critical. A CVE-2021-44228 (Log4Shell) scored 10.0 because it was remotely exploitable, required no authentication, no user interaction, and had full impact on confidentiality, integrity, and availability.
CVSS base score factors include Attack Vector (Network is worse than Local), Attack Complexity (Low is worse than High), Privileges Required, User Interaction, and the Confidentiality, Integrity, and Availability impact ratings. A vulnerability exploitable over the network with no authentication and full system impact will always score higher than a local privilege escalation requiring an existing user account.
CVSS scores alone are insufficient for prioritization. A Critical-rated vulnerability on an isolated test server is less urgent than a High-rated one on your internet-facing payment processing system. Real prioritization adds asset criticality, network exposure, presence of a known public exploit, and whether compensating controls already reduce the risk.
How to choose the correct answer
Vulnerability scan vs penetration test: scan = automated, non-exploiting, identifies potential weaknesses, run frequently. Pen test = human tester actively exploits vulnerabilities, demonstrates actual impact, run periodically. Knowing that a vulnerability exists is different from proving it is exploitable and knowing what an attacker could do with it.
Credentialed vs non-credentialed: credentialed finds more internal weaknesses, shows what a compromised insider could see. Non-credentialed shows external attacker view. For a comprehensive assessment, both are used.
CVE: the unique identifier for a specific known vulnerability. NVD: the database (National Vulnerability Database) that hosts CVE details including CVSS scores. They are different things.
Remediation prioritization: Critical CVSS + internet-facing + known exploit = highest priority. Low CVSS + isolated internal system + no exploit available = can wait.