Vulnerability Scanning¶

Audience: All client users (with access to the assessment) · Where: the Vulnerability Scanning tab inside an assessment.

Overview¶

Vulnerability scanning is the automated, breadth-first sweep of your targets — it enumerates known vulnerabilities (CVEs, outdated software, insecure configurations) across everything in scope. It complements the deeper, human-guided penetration testing that produces Findings: the scan tells you what weaknesses exist everywhere, while the pentest proves which ones are actually exploitable.

The results appear on the Vulnerability Scanning tab of an assessment.

What the tab shows¶

At the top, two summary cards:

Scanned Vulnerabilities — the total number the scan detected.
A severity breakdown — a segmented bar with the per-severity counts (Critical / High / Medium / Low / Info). Click a severity to filter the list to it; click the total to clear.

Below that, a filter row sits above a sortable table of results.

Filters¶

Control	What it does
Search title…	Free-text box to match on the vulnerability title.
Severity	Dropdown to filter by severity (All severities by default).
Status	Dropdown (All statuses by default): Open / Fixed / Accepted risk / False positive.
Export CSV	Downloads the list.

Columns¶

The list is a sortable table:

Column	What it shows
Severity	The vulnerability's severity.
Vulnerability	Title, with any CVE IDs underneath.
Affected	Host / port.
CVSS	The CVSS score.
Status	Open / Fixed / Accepted risk / False positive.
First seen	When it was first detected.
Last seen	Most recent detection.
Correlated	A count of pentest findings this scanned vulnerability was matched to.

Vulnerability detail¶

Click any row's title to open its detail. The detail page carries the description, remediation, and a Correlated findings panel, alongside a sidebar:

Detail field	Description
Affected	The affected host / port, linking through to the asset in your Asset Library.
Source	The scan source.
CVEs	CVE references.
NVT OID	The scanner's test identifier.
Last seen	The most recent detection.
Pillar	The pillar the result belongs to.

The header shows the severity, CVSS score, status, and when the result was first seen (with the number of days it has been open). Description and remediation text is reflowed from the scanner's output so it reads as normal paragraphs.

When results appear¶

Results populate once a scan completes

If you see "No scan data yet," either no vulnerability scan has run for this engagement yet, or the engagement was scanned before this feature was enabled — in that case results populate on its next run.

Scan-only assessments¶

Scan-only mode

Some assessments can run in a scan-only mode — a pure vulnerability sweep without the full penetration-testing phases. These are lighter and faster, useful for routine posture checks between full pentests. A scan-only assessment surfaces its results here on the Vulnerability Scanning tab rather than as exploited findings.

How broad and how fast an internal scan runs¶

For Internal Network assessments, two settings chosen when you create the assessment control the sweep:

Port range — how many ports each host is checked on. Top 1,000 is the default; wider presets (up to All ports or a custom range) find more but take much longer on large networks.
Scan intensity — Stealth, Normal, or Aggressive. Lower intensity is gentler on fragile or monitored networks; higher intensity finishes faster.

You can review the values an assessment ran with on its Config tab (Assessment Overview).

Scan vs. pentest findings¶

Scanned vulnerabilities (this tab) = automated, broad, "these could be exploitable."
Findings (guide) = tester-validated, "these were exploited or confirmed."

When a scanned vulnerability is confirmed during the pentest, it's promoted into a Finding with evidence attached — so don't be alarmed if the two counts differ; they're measuring different things.

Tips¶

Tip

Click Critical (then High) in the severity breakdown to triage the scan the same way you triage findings; use the Correlated column to spot which scan results the pentest has already matched to a confirmed finding.
A high scanned-vulnerability count with few confirmed findings usually means broad hygiene issues (patching, configuration) rather than an active breach path — still worth fixing.