Vulnerability assessment is one of the most important foundations of cybersecurity. Before an attacker exploits a system, they first look for weaknesses. Vulnerability scanning is the defender's way of doing the same thing , but before the attacker does.

In simple terms, vulnerability assessment is the process of finding security weaknesses in systems, applications, and networks so they can be fixed before they are abused.

What Is Vulnerability Scanning? Vulnerability scanning is the automated process of identifying potential security flaws in a system or network. These flaws can include:

Outdated software Exposed services Misconfigurations Known software vulnerabilities

Security teams and penetration testers use vulnerability scanners to quickly understand the attack surface before moving to deeper manual testing.

How Vulnerability Scanners Actually Work Although different tools exist, most vulnerability scanners follow the same core workflow:

1. Host Discovery First, the scanner checks whether the target system is alive and responding. If a system doesn't respond, there's nothing to scan.

2. Port Scanning Once the host is confirmed alive, the scanner identifies open ports. Each open port usually means a running service, and every service can be a potential entry point. Example: Port 80 → Web server Port 22 → SSH Port 443 → HTTPS

3. Service, Version, and OS Detection Next, the scanner tries to determine: What service is running Which version it is What operating system the target uses

This step is critical because vulnerabilities are usually version-specific.

4. Vulnerability Matching After gathering all this information, the scanner compares it against vulnerability databases such as: CVE (Common Vulnerabilities and Exposures) NVD (National Vulnerability Database)

If a match is found, the scanner reports it as a potential vulnerability.

5. (Optional) Vulnerability Verification Some commercial scanners go a step further by attempting safe checks or partial exploitation to confirm vulnerabilities. This reduces false alerts.

CVE and CVSS , What Do They Mean? CVE is just an identifier (for example, CVE-2023–12345). It tells you what the vulnerability is , but not how dangerous it is. CVSS (Common Vulnerability Scoring System) tells you how severe the vulnerability is.

External vs Internal Scan External scan: Done from the internet; shows what an outside attacker can see (public IPs, open ports, exposed services). Internal scan: Done from inside the network; shows internal weaknesses.

Authenticated vs Unauthenticated Scan Unauthenticated scan: No credentials; limited to exposed services and versions. Authenticated scan: Uses valid credentials; detects missing patches, vulnerable software, and misconfigurations.