Vulnerability scanning is the automated process of checking systems against databases of known weaknesses, producing a list of what may be vulnerable and where.
The short answer
A vulnerability scanner inspects hosts, applications, containers and cloud accounts, compares what it finds against published vulnerability databases such as the CVE list, and reports anything that matches. It runs in minutes or hours, repeats on a schedule, and produces raw output that still needs review.
Scanning is the engine underneath most security testing. A vulnerability assessment uses a scan and then interprets it. A managed vulnerability programme runs scans continuously. On its own, a scan tells you what might be wrong, not what matters.
On this page
How a scanner works
Authenticated and unauthenticated scans
The single biggest factor in scan quality is whether the scanner has credentials. Without them it sees only what an outsider sees. With them it can read installed package versions and configuration directly.
Types of scan
| Scan | What it inspects | Typical cadence |
|---|---|---|
| External network | Internet-facing hosts, exposed services, TLS configuration | Weekly |
| Internal network | Hosts inside the perimeter, patch level, service configuration | Monthly |
| Web application (DAST) | A running application, tested through its interface as a user would reach it | Per release |
| Container image | Base image and packaged libraries, before the image ships | Every build |
| Cloud configuration | IAM, storage exposure, security groups, encryption and logging settings | Continuous |
| Dependency (SCA) | Open-source libraries declared in the codebase | Every commit |
What scanning is best at
Scanning does one thing extremely well, and it is the thing manual testing cannot do.
Complete coverage
Every host, image and cloud account checked, including the ones nobody would think to test by hand.
Repeatable on a schedule
The same checks run daily or weekly, so new exposure surfaces within days rather than at the next audit.
Fast, early warning
A newly published vulnerability can be matched against your estate the day it lands.
Where it hands over to a human
Scanning matches against published records, so it will not find business logic flaws and it does not prove exploitability. That is the job of a penetration test. Used together, scanning holds the coverage between tests and testing supplies the proof.
How Osto scans
Osto scans web applications, mobile applications, code dependencies and cloud accounts from one platform, on a schedule rather than on request. Findings are rated by severity and mapped to affected endpoints, and because the same platform holds the WAF and cloud posture data, a finding can be reviewed alongside whether anything is already blocking it.
Free security assessment
Scanning that runs without being asked
Applications, APIs, dependencies and cloud accounts scanned on a schedule, with findings ranked and mapped to the endpoints they affect.
Get a free security assessment Book a platform walkthroughScheduled scanning · Web, mobile, code and cloud · One platform, everything
Frequently asked questions
What is vulnerability scanning?
Vulnerability scanning is the automated process of inspecting hosts, applications, containers and cloud accounts, then comparing what is found against databases of published vulnerabilities such as the CVE list. It reports potential weaknesses along with a severity rating.
What is the difference between an authenticated and an unauthenticated scan?
An unauthenticated scan runs without credentials and sees only what is externally reachable, which produces more guesswork and more false positives. An authenticated scan uses credentials to read installed package versions and local configuration directly, producing a fuller and more accurate result.
How often should scanning run?
Continuously where possible. External scans weekly, internal scans monthly, container images on every build and dependencies on every commit is a workable pattern. Cloud configuration should be monitored continuously rather than scanned periodically.
Is a vulnerability scan the same as a penetration test?
No. A scan is automated and reports potential issues matched against a database. A penetration test is performed by a person who exploits findings to prove what an attacker could achieve. An auditor asking for a penetration test will not accept scanner output.
Why do scanners report false positives?
A scanner often infers a vulnerability from a version number rather than confirming the vulnerable code path is reachable. Backported patches, unused components and compensating controls all produce findings that are technically matched but not exploitable in practice.