SecNet.Work · Security field guide

Internal and external vulnerability scanning

Turn a scan output into decisions and remediation. Understand the observation point, what was actually tested and how findings are closed.

Download guide · PDFv1.0 · Sources checked: 2026-10-20

Internal viewEvidence → decision → remediationExternal view

What are we looking for, and from where?

Vulnerability scanning systematically checks scoped assets for known software weaknesses, missing patches, risky services and security configuration issues. Its output is a set of candidate findings to validate. It provides a point-in-time view; it is not, by itself, a penetration test, proof of compromise or a guarantee of security.

Internal scanning

From an internal network or approved VPN / scanning sensor

Internal sensor
Network segment
Server / endpoint
Local checks

Purpose: Assess weaknesses in servers, endpoints and network devices visible from an internal access point. Separate network segments need distinct viewpoints.
Scope: Server VLANs, endpoints, directory services, virtual infrastructure and management interfaces. OT assets require a separate plan.
What can it reveal?: Missing patches, unsupported versions, unnecessary services, weak configurations and reachability boundaries. Credentialed checks can inspect local state more deeply.
Visibility limit: One sensor does not represent the entire network. Assets blocked by firewalls or failed authentication cannot be interpreted as having no vulnerabilities.

From scope to verified closure

This is a practical guide; it does not connect to targets or launch scans. A real engagement defines written asset-owner authorization, explicit scope, a maintenance window and stop conditions.

Stage 1 / 7

Define scope and engagement rules

Record the owner, IP/CIDR and domain list, exclusions, schedule, source IP, request limits and emergency contact. Confirm third-party assets separately.

Execution note

Verify segment reachability internally and DNS, CDN and asset ownership externally. Separate critical services from the small pilot group.

Stage deliverable

Approved scope inventory + rules of engagement

Common pitfall: A domain using an organization’s name may not belong to it.

Choose a tool for its purpose

Discovery, network vulnerability scanning, web analysis and software-component inspection are different jobs. Links lead directly to publishers/projects; check their current versions and licence terms there.

Discovery / service inventory

Nmap

Inventory visible ports and services to narrow the next scanning profile.

Limit: Not a complete patch or vulnerability assessment; validate service identification.

Source available; review its custom licence terms.

Official download / setup Documentation

Network vulnerability scanning

Greenbone / OpenVAS

Assess known weaknesses and supported authenticated local checks.

Limit: Feed freshness and profiles matter. The community container guide is for learning/testing; assess production design separately.

Community and commercial options

Official download / setup Documentation

Network / local checks

Tenable Nessus

Server and device checks, including local patch and configuration review with credentials.

Limit: Verify that credentialed checks actually ran. Check licence scope before downloading.

Commercial; edition and usage terms vary.

Official download / setup Documentation

Enterprise vulnerability management

Qualys VMDR

Manage sensor/agent coverage, finding tracking and remediation workflows across distributed assets.

Limit: Not a single downloadable desktop scanner; plan sensor placement and subscription scope.

Commercial platform / trial request

Official trial request Documentation

Web / API dynamic analysis

ZAP

Passive alerts in web traffic and separately enabled active application tests.

Limit: The baseline spider makes HTTP requests; passive analysis is not zero traffic. Active testing needs separate scope and test accounts.

Free, open source

Official download / setup Documentation

Web validation / dynamic analysis

Burp Suite

Validate candidate findings with a proxy and manual inspection; automated scanning in eligible paid editions.

Limit: Community does not include automated Burp Scanner. Sessions, object permissions and business logic need separate attention.

Community and paid editions

Official download / setup Documentation

Template-based checks

Nuclei

Repeat specific checks on authorized targets with selected, reviewed templates.

Limit: Template impact varies. Pin scope, request limits and template version; do not blindly execute every template.

Open source

Official download / setup Documentation

Container / dependency / IaC

Trivy

Inspect component vulnerabilities and misconfigurations in images, filesystems and configuration artifacts.

Limit: Not a network port scanner. Assess fixed-version availability, package reachability and runtime context separately.

Open source

Official download / setup Documentation

What does a finding actually mean?

The records below are fictional teaching examples. The same tool alert can require different decisions depending on asset context and evidence.

Public management service

Observation

An external sensor reaches an unexpected management port on 203.0.113.20. The address is fictional.

Interpretation

First confirm ownership and that the service really is a management interface. Do not label an open port as a breach or confirmed CVE.

Action & closure

Restrict internet reachability to required sources, and review strong authentication and patch status. Retest from the external sensor.

CVSS

Technical severity; retain the version and vector.

KEV

Known exploitation; absence is not assurance.

EPSS

Estimated probability of a CVE being exploited in the wild in the next 30 days; not your organization’s risk score.

Business context

Exposure, critical services, data, existing controls and remediation cost.

What should management see?

Coverage: successfully assessed / approved assets. Show unreachable assets separately.
Authentication: targets with successful local checks / targets intended for credentialed scanning.
Risk: validated open findings that are internet-reachable and business-critical.
Time: elapsed time from first validation to technical closure; track reopened findings separately.
Tracking: overdue work, temporary mitigations and expiry dates for accepted risks.
Zero findings: not positive assurance without verified scope, profiles, feeds and access success.

Downloadable workpapers

Original SecNet materials in Turkish and English. CSV files open in spreadsheet applications; Markdown templates open in a text editor. Example rows are fictional; complete the fields for your approved scope.

Download complete pack · ZIP

PDFComplete field guide CSVScope & asset inventory CSVFinding & remediation tracker MDPre/post-scan checklist MDExecutive & technical report template CSVOfficial tool & source catalogue

Common questions

How does scanning differ from penetration testing?

Scanning mainly checks known patterns and configurations systematically. A penetration test may also investigate manual validation, business logic and attack chains against an authorized objective. A clean automated result does not rule these out.

How often should scans run?

There is no single universal interval. Build a schedule around criticality, change rate, internet exposure and applicable contractual/standard requirements. Significant changes and remediation retests are separate triggers.

Can OT / ICS be scanned in the same way?

Do not directly apply a generic IT scanning profile. Involve production and safety owners, vendor support, a suitable maintenance window and a separate risk assessment. Passive inventory may be preferable initially; active testing must be controlled and approved.

Official sources & edition

SecNet authored the educational explanations and examples; they are not publications or endorsements by the organizations below. Use publisher documentation for tool capabilities and applicable assessment criteria.

v1.0 · 2026-10-20