[Atomic Glue](atomicglue.co)
SECURITY
Home › Glossary › Security· 445 ·

Vulnerability Scanning

vul-ner-a-bil-i-tee skan-ingnoun
Filed underSecurityDevopsInfrastructure
In brief · quick answer

Vulnerability scanning is the automated process of identifying security weaknesses in applications, systems, and networks. It checks for known vulnerabilities, misconfigurations, and compliance gaps before attackers can exploit them.

§ 1 Definition

Vulnerability scanning uses automated tools to systematically examine systems, applications, and networks for known security vulnerabilities, misconfigurations, and exposures. Scanners reference databases of known vulnerabilities (CVE/NVD), check for missing patches, test for common weaknesses (XSS, SQL injection, exposed services), and validate compliance with security standards (OWASP Top 10, CIS Benchmarks). Scans can be internal (inside the network), external (from the internet), or authenticated (with credentials for deeper analysis). Regular scanning is a requirement in most compliance frameworks (PCI DSS, SOC 2, HIPAA) and is an essential component of a vulnerability management program.

§ 2 Types of Vulnerability Scanners

Network scanners (Nessus, Qualys, OpenVAS): Scan IP ranges for open ports, running services, missing patches, and known vulnerabilities in network infrastructure. Web application scanners (Burp Suite, OWASP ZAP, Acunetix, Snyk): Crawl and test web applications for XSS, SQL injection, CSRF, and other OWASP Top 10 vulnerabilities. Container/image scanners (Trivy, Snyk, Docker Scout, Grype): Scan container images for vulnerable dependencies and misconfigurations. SAST (Static Application Security Testing): Analyzes source code for vulnerabilities without executing it (SonarQube, Semgrep, CodeQL). DAST (Dynamic Application Security Testing): Tests running applications by sending requests and analyzing responses (OWASP ZAP, Burp Suite). SCA (Software Composition Analysis): Identifies vulnerabilities in open-source dependencies (Dependabot, Snyk, Renovate).

§ 3 Scanning Frequency and CI/CD Integration

Daily/Weekly: Infrastructure and network scans (scheduled). On every commit: SCA (dependency scanning) and SAST (static analysis) in CI/CD pipelines. On every deployment: DAST on staging environments. Quarterly/Annually: Comprehensive penetration testing (manual, not just automated scanning). The most mature approach is scanning at every stage of the SDLC: code commit (SAST) -> dependency audit (SCA) -> build (container scan) -> deploy (DAST) -> production (continuous monitoring).

§ 4 Scanning vs Penetration Testing

Vulnerability scanning is automated, broad, and frequent. It identifies known vulnerabilities and misconfigurations but can produce false positives and misses complex, multi-step, or business logic vulnerabilities. Penetration testing is manual, deep, and infrequent. A skilled tester probes for vulnerabilities that automated tools miss, chains exploits together, and tests business logic. Both are necessary. Scanning catches the low-hanging fruit continuously; pen testing finds the deep vulnerabilities that scanning misses.

§ 5 Note

False positives are a significant challenge in vulnerability scanning. Every finding must be triaged, validated, and either remediated or documented as an accepted risk. A scan that produces 1000 alerts that nobody reviews is worse than no scan at all it creates alert fatigue that hides real problems.

§ 6 Common questions

Q. How often should I run vulnerability scans?
A. At minimum: weekly external scans for internet-facing systems, SCA on every pull request, SAST on every commit, and quarterly authenticated internal scans. Compliance frameworks (PCI DSS) require quarterly external and internal scans plus after significant changes.
Q. What is the difference between SAST and DAST?
A. SAST (Static) analyzes source code without running it. It finds vulnerabilities early in development but has higher false positive rates. DAST (Dynamic) tests running applications and finds vulnerabilities in the runtime configuration and live behavior. Both are complementary.
Q. Are free vulnerability scanners any good?
A. OpenVAS, OWASP ZAP, and Trivy are excellent free tools. They are suitable for small to medium organizations. Enterprise tools (Nessus, Qualys, Snyk) offer better reporting, integrations, and support but at a cost.
Key takeaways
  • Vulnerability scanning automates the detection of known security weaknesses.
  • Types: Network scanning, web app scanning, container scanning, SAST, DAST, SCA.
  • Scan at every SDLC stage: code, build, deploy, production.
  • Automated scanning complements manual penetration testing. Both are needed.
How Atomic Glue helps

Atomic Glue implements continuous vulnerability scanning across your entire stack: SAST in CI/CD, SCA for dependencies, DAST on staging, and periodic penetration testing. We triage and remediate findings. Trust & Security.

Get in touch
Written by Atomic Glue Security Team, Atomic Glue · Last updated December 2024
# Vulnerability Scanning

Vulnerability scanning is the automated process of identifying security weaknesses in applications, systems, and networks. It checks for known vulnerabilities, misconfigurations, and compliance gaps before attackers can exploit them.

Category: Security (also: Devops, Infrastructure)

Author: Atomic Glue Security Team

## Definition

Vulnerability scanning uses automated tools to systematically examine systems, applications, and networks for known security vulnerabilities, misconfigurations, and exposures. Scanners reference databases of known vulnerabilities (CVE/NVD), check for missing patches, test for common weaknesses (XSS, SQL injection, exposed services), and validate compliance with security standards (OWASP Top 10, CIS Benchmarks). Scans can be internal (inside the network), external (from the internet), or authenticated (with credentials for deeper analysis). Regular scanning is a requirement in most compliance frameworks (PCI DSS, SOC 2, HIPAA) and is an essential component of a vulnerability management program.

## Types of Vulnerability Scanners

**Network scanners** (Nessus, Qualys, OpenVAS): Scan IP ranges for open ports, running services, missing patches, and known vulnerabilities in network infrastructure. **Web application scanners** (Burp Suite, OWASP ZAP, Acunetix, Snyk): Crawl and test web applications for XSS, SQL injection, CSRF, and other OWASP Top 10 vulnerabilities. **Container/image scanners** (Trivy, Snyk, Docker Scout, Grype): Scan container images for vulnerable dependencies and misconfigurations. **SAST** (Static Application Security Testing): Analyzes source code for vulnerabilities without executing it (SonarQube, Semgrep, CodeQL). **DAST** (Dynamic Application Security Testing): Tests running applications by sending requests and analyzing responses (OWASP ZAP, Burp Suite). **SCA** (Software Composition Analysis): Identifies vulnerabilities in open-source dependencies (Dependabot, Snyk, Renovate).

## Scanning Frequency and CI/CD Integration

**Daily/Weekly**: Infrastructure and network scans (scheduled). **On every commit**: SCA (dependency scanning) and SAST (static analysis) in CI/CD pipelines. **On every deployment**: DAST on staging environments. **Quarterly/Annually**: Comprehensive penetration testing (manual, not just automated scanning). The most mature approach is scanning at every stage of the SDLC: code commit (SAST) -> dependency audit (SCA) -> build (container scan) -> deploy (DAST) -> production (continuous monitoring).

## Scanning vs Penetration Testing

Vulnerability scanning is automated, broad, and frequent. It identifies known vulnerabilities and misconfigurations but can produce false positives and misses complex, multi-step, or business logic vulnerabilities. Penetration testing is manual, deep, and infrequent. A skilled tester probes for vulnerabilities that automated tools miss, chains exploits together, and tests business logic. Both are necessary. Scanning catches the low-hanging fruit continuously; pen testing finds the deep vulnerabilities that scanning misses.

## Note

False positives are a significant challenge in vulnerability scanning. Every finding must be triaged, validated, and either remediated or documented as an accepted risk. A scan that produces 1000 alerts that nobody reviews is worse than no scan at all it creates alert fatigue that hides real problems.

## Common questions

Q: How often should I run vulnerability scans?

A: At minimum: weekly external scans for internet-facing systems, SCA on every pull request, SAST on every commit, and quarterly authenticated internal scans. Compliance frameworks (PCI DSS) require quarterly external and internal scans plus after significant changes.

Q: What is the difference between SAST and DAST?

A: SAST (Static) analyzes source code without running it. It finds vulnerabilities early in development but has higher false positive rates. DAST (Dynamic) tests running applications and finds vulnerabilities in the runtime configuration and live behavior. Both are complementary.

Q: Are free vulnerability scanners any good?

A: OpenVAS, OWASP ZAP, and Trivy are excellent free tools. They are suitable for small to medium organizations. Enterprise tools (Nessus, Qualys, Snyk) offer better reporting, integrations, and support but at a cost.

## Key takeaways

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/vulnerability-scanning

Schedule a call

30 min · Video call

1
Date
2
Time
3
Details