What Is a Vulnerability Scan and How Often Should You Run One?
A vulnerability scan is one of the most practical things a business can do to understand its security exposure. It's not complicated, it doesn't require deep technical knowledge to initiate, and the results it produces are directly actionable. Yet many businesses either don't scan at all, or scan occasionally and don't act on what they find.
This guide explains what a vulnerability scan is, what it finds, and how to use the results meaningfully.
What a Vulnerability Scan Does
A vulnerability scanner probes your systems — servers, workstations, network devices, web applications — looking for known security weaknesses. These weaknesses fall into several categories:
Missing patches and outdated software are the most common findings. Known vulnerabilities in operating systems, applications, and firmware are catalogued in databases including the National Vulnerability Database (NVD). Scanners check your system versions against this database and flag anything that hasn't been patched against known vulnerabilities.
Misconfigurations are the second major category. Default credentials that haven't been changed. Services and ports that are open and unnecessary. Network shares with excessive permissions. Authentication weaknesses. These are configuration choices that create exploitable weaknesses, distinct from software vulnerabilities.
Weak encryption and authentication findings cover outdated cryptographic protocols, insecure cipher suites, and authentication mechanisms that fall below current standards.
Known exploitable vulnerabilities are flagged with severity ratings — typically Critical, High, Medium, and Low — based on factors including how exploitable the vulnerability is, what an attacker could do if they exploited it, and whether working exploits are known to exist in the wild.
External vs Internal Scanning
Vulnerability scanning can be conducted from outside your network or inside it.
External scanning simulates what an attacker sees from the internet. It scans your internet-facing infrastructure — web servers, mail servers, VPN gateways, publicly accessible applications — for vulnerabilities that could be exploited without any prior access. This is the most directly relevant scan for understanding your perimeter exposure.
Internal scanning connects to your network and assesses systems that aren't internet-facing. Internal scanning typically reveals more findings because it can access systems that aren't visible externally. It's particularly important for understanding what an attacker could do once inside your network — whether through a phishing attack, a compromised external system, or a supply chain compromise.
Both types are valuable and serve different purposes. Cyber Essentials Plus requires both external and internal vulnerability assessment as part of the certification process.
Interpreting the Results
Vulnerability scan reports can be overwhelming. A scan of a modest network environment might produce dozens or hundreds of findings. The key to making the results useful is prioritisation.
Critical and High severity findings require immediate attention. These are vulnerabilities that are reliably exploitable, where working exploits are known, or where the potential impact of successful exploitation is severe. Unpatched systems with critical vulnerabilities that are internet-facing should be treated as an emergency.
Medium severity findings represent meaningful risk and should be addressed within a defined remediation window — typically 30 to 90 days depending on your risk tolerance.
Low severity findings can be tracked and addressed as part of normal maintenance cycles, though they shouldn't be ignored indefinitely.
Context matters. A critical vulnerability on a server that holds sensitive customer data is a higher priority than the same vulnerability on an isolated test system. Prioritisation should account for what the affected system holds and what an attacker could do if they compromised it.
How Often to Scan
There's no single right answer, but there are informed principles.
External scanning should happen at minimum quarterly. Your external attack surface changes more often than you might think — new services are deployed, configurations change, and new vulnerabilities affecting your software are discovered continuously. Quarterly external scanning provides a regular view of your perimeter exposure.
After significant changes, scan immediately. Deploying a new internet-facing service, making significant network changes, implementing new software — any of these warrant a targeted scan to ensure the change hasn't introduced new vulnerabilities.
Internal scanning should happen at minimum twice yearly for most businesses, quarterly for environments with regulatory obligations or particularly sensitive data. Internal scanning is more disruptive (it generates more network traffic and some scanners can cause instability in very old systems) but provides essential insight into your internal posture.
Continuous vulnerability management is the gold standard for organisations with significant security maturity. Rather than point-in-time scans, continuous monitoring identifies new vulnerabilities as they're disclosed and tracks remediation in real time.
Acting on Results
A scan that produces a report that nobody reads is worthless. The value comes from action: fixing the critical findings, tracking the others, and verifying that remediation has worked.
Remediation verification — re-scanning after fixes have been applied — confirms that the vulnerability has actually been addressed and hasn't been reintroduced. This is a step that many organisations skip but shouldn't.
If you've never run a vulnerability scan, or if your last one was more than a year ago, the place to start is an external scan of your internet-facing infrastructure. We offer vulnerability scanning as part of our security assessment process, and we'll help you interpret the results and prioritise remediation. Get in touch if you'd like to understand where your current exposure lies.