Vulnerability Scanning¶

Audience: All client users (with access to the assessment) · Where: the Vulnerability Scanning tab inside an assessment.

Overview¶

Vulnerability scanning is the automated, breadth-first sweep of your targets — it enumerates known vulnerabilities (CVEs, outdated software, insecure configurations) across everything in scope. It complements the deeper, human-guided penetration testing that produces Findings: the scan tells you what weaknesses exist everywhere, while the pentest proves which ones are actually exploitable.

The results appear on the Vulnerability Scanning tab of an assessment.

What the tab shows¶

At the top, two summary cards:

Scanned Vulnerabilities — the total number the scan detected.
A severity breakdown — a segmented bar with the per-severity counts (Critical / High / Medium / Low / Info). Click a severity to filter the list to it; click the total to clear.

Below that, a filter row sits above a sortable table of results.

Filters¶

Control	What it does
Search title	Free-text box to match on the vulnerability title.
Severity	Dropdown to filter by severity.
Status	Dropdown: Open / Fixed / Accepted risk / False positive.
Export CSV	Downloads the list.

Columns¶

The list is a sortable table:

Column	What it shows
Severity	The vulnerability's severity.
Vulnerability	Title, with any CVE IDs underneath.
Affected	Host / port.
CVSS	The CVSS score.
Status	Open / Fixed / Accepted risk / False positive.
First seen	When it was first detected.
Last seen	Most recent detection.
Correlated	A count of pentest findings this scanned vulnerability was matched to.

Vulnerability detail¶

Click any row's title to open its detail. The detail page carries the description, remediation, and a Correlated findings panel, alongside a sidebar:

Detail field	Description
Affected asset	The asset, as a link through to it.
Source	The scan source.
CVE	CVE references.
NVT OID	The scanner's test identifier.
Pillar	The pillar the result belongs to.
Severity / CVSS / status / first-seen	The scoring and lifecycle dates.

When results appear¶

Results populate once a scan completes

If you see "No scan data yet," either no vulnerability scan has run for this engagement yet, or the engagement was scanned before this feature was enabled — in that case results populate on its next run.

Scan-only assessments¶

Scan-only mode

Some assessments can run in a scan-only mode — a pure vulnerability sweep without the full penetration-testing phases. These are lighter and faster, useful for routine posture checks between full pentests. A scan-only assessment surfaces its results here on the Vulnerability Scanning tab rather than as exploited findings.

Scan vs. pentest findings¶

Scanned vulnerabilities (this tab) = automated, broad, "these could be exploitable."
Findings (guide) = tester-validated, "these were exploited or confirmed."

When a scanned vulnerability is confirmed during the pentest, it's promoted into a Finding with evidence attached — so don't be alarmed if the two counts differ; they're measuring different things.

Tips¶

Tip

Click Critical (then High) in the severity breakdown to triage the scan the same way you triage findings; use the Correlated column to spot which scan results the pentest has already matched to a confirmed finding.
A high scanned-vulnerability count with few confirmed findings usually means broad hygiene issues (patching, configuration) rather than an active breach path — still worth fixing.