What is vulnerability scanning?
January 18, 2023

What is vulnerability scanning?

Vulnerability scanning is the action of conducting an automated review of your system to look for potential risks and vulnerabilities. For budding information security professionals (or even those who have worked in the field for years), there is always something new to learn. Not only is it a highly intricate and advanced field but, on a daily basis, there is a cat-and-mouse game happening between security engineers and hackers. Engineers look for new ways to secure their systems, hackers look for new ways to break those security measures, and the cycle goes on and on.

You don’t have to know every vulnerability or risk out there, though, because there are tools that do it for you. This is the magic of vulnerability scanning.

What does vulnerability scanning mean?

Think of it as a scan to check for any unlocked doors that a thief could use to get in or to get access to your confidential data. Vulnerability scanning is a vital part of a strong security posture, and it’s even required for compliance with certain security standards and certifications.

What is a vulnerability scanner?

A vulnerability scanner is a tool that performs an automated vulnerability scan for your system. There are numerous different vulnerability scanners on the market, and each one has its own processes and covers different digital assets. It’s important to understand what your system entails so you can examine various vulnerability scanners to find the best fit.

What is a vulnerability scan?

The term “vulnerability scan” can be used in a few different ways. It can refer to the process of scanning for vulnerabilities, such as, “We’re running a vulnerability scan today.” Or, it can refer to the report you receive as a result of the scan, such as, “According to our vulnerability scan, these are the issues we need to address.”

Types of vulnerability scans

Vulnerability scanning doesn’t vary from one brand to another. There are different types of scans you can choose to perform based on what you want to know about your system. Most noticeably, you’ll see options for internal vs. external vulnerability scans and authenticated vs. unauthenticated vulnerability scans.

Internal vs. external vulnerability scans

Proper data security involves not only locking down your system from access by unauthorized users but also locking down sensitive, confidential data on a need-to-access basis. Internal and external vulnerability scans assess your security from both of these angles.

An internal vulnerability scan is conducted from within your network. The goal is to find any vulnerabilities that could be exploited by an internal user like an employee. An external vulnerability scan, on the other hand, is conducted from outside your network to find vulnerabilities that could be exploited from outside the network.

The most comprehensive choice, of course, is to perform both internal and external scans. In fact, this is required for some security standards like PCI DSS.

Authenticated vs. unauthenticated vulnerability scans

Another distinction that can be made between vulnerability scans is authenticated vs. unauthenticated vulnerability scans. An authorized vulnerability scan is a scan conducted using valid log-in credentials for your system to see what a logged-in user could access and how they could move through your system. An unauthorized vulnerability scan, on the other hand, evaluates what a person could access if they weren’t able to get valid log-in credentials.

Note that you might also see the terms “credentialed vulnerability scan” and “non-credentialed vulnerability scan.” These are used interchangeably with authenticated and unauthenticated vulnerability scans.

How is vulnerability scanning different from penetration testing?

Vulnerability scanning may sound similar to another type of security evaluation technique called penetration testing. After all, they are both ways to assess your security posture and identify missing pieces and opportunities for problems. They work in different ways, though.

In vulnerability scanning, an automated tool performs a scan of your system to look for known vulnerabilities from its database. It’s all about finding security gaps that a hacker could hypothetically exploit.

In penetration testing, on the other hand, a hired expert runs through operations to try to hack into your system and access confidential data.

How does vulnerability scanning work?

A vulnerability scanner works by using a database of known vulnerabilities and looking for these vulnerabilities in your system. It checks various interfaces and runs various scenarios within your system to identify any potential risks. The best part is that this is all done on an automated basis, so it’s hands-off for your team.

Is vulnerability scanning a requirement?

For most organizations, vulnerability scanning is a voluntary way to keep your data and your infrastructure secure. It is, however, a requirement for compliance with certain security standards like PCI DSS.

In addition to this, there are other standards that don’t necessarily require vulnerability scanning by name, but they do require you to have a process in place for identifying vulnerabilities. Vulnerability scanning is an efficient and reliable way to meet that requirement.

Why is vulnerability scanning important?

Protecting your organization and your clients’ data needs to be an ongoing effort, and there are always new vulnerabilities that may arise. To keep your data secure, you need to have a way to detect these vulnerabilities when they appear and resolve them promptly.

A vulnerability scanner doesn’t only give you a reliable way to do this but it also takes the manual work off your hands. It’s always a good idea to stay on top of the latest news about discovered vulnerabilities, but a vulnerability scanner ensures that you don’t need to check your system manually; if there is an opportunity for hackers, it will alert you.

Find the ideal vulnerability scanner for your organization

Finding a vulnerability scanner that works for your organization comes down to understanding your system and finding a vulnerability scanner that suits it well. Learn more about security and how to protect your data through vulnerability scanning and more on our information security blog and explore how Vanta’s automated compliance software can empower your security.

Written by
No items found.
Access Review Stage Content / Functionality
Across all stages
  • Easily create and save a new access review at a point in time
  • View detailed audit evidence of historical access reviews
Setup access review procedures
  • Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews
  • Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems
  • Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta.
  • Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS)
  • Upload access files from non-integrated systems
  • View and select systems in-scope for the review
Review, approve, and deny user access
  • Select the appropriate systems reviewer and due date
  • Get automatic notifications and reminders to systems reviewer of deadlines
  • Automatic flagging of “risky” employee accounts that have been terminated or switched departments
  • Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section
  • Track progress of individual systems access reviews and see accounts that need to be removed or have access modified
  • Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners
  • Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests
  • Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access
  • Focused view of accounts flagged for access changes for easy tracking and management
  • Automated evidence of remediation completion displayed for integrated systems
  • Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results
  • Auditor can log into Vanta to see history of all completed access reviews
  • Internals can see status of reviews in progress and also historical review detail

PCI Compliance Selection Guide

Determine Your PCI Compliance Level

If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.

When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.

Answer a few short questions and we’ll help identify your compliance level.


Does your business offer services to customers who are interested in your level of PCI compliance?


Identify your PCI SAQ or ROC level

The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.

Good news! Vanta supports all of the following compliance levels:


A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.

Get PCI DSS certified


A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

Learn more about eCommerce PCI

for service providers

A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.

Use our PCI checklist

Level 1 for service providers

A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).

Automate your ROC and AOC

Download this checklist for easy reference


Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes