Vulnerability scanning: authenticated, agent, internal and external
In short: Vulnerability scanners compare what they find against known weaknesses. Authenticated and agent-based scans see much more than unauthenticated network scans, and internal and external scans answer different questions. Every result needs checking for false positives and gaps.
What a vulnerability scanner does
A vulnerability scanner discovers systems, works out what software and settings they have, and compares that against a database of known vulnerabilities and misconfigurations. It produces findings with severity ratings, usually linked to CVE IDs. Scanners find known problems; they do not replace penetration testing, which looks for chains of weaknesses and logic flaws. Only scan systems you own or are authorised to scan.
Authenticated and unauthenticated
An unauthenticated scan looks at a system from the network without logging in. It sees open ports, service banners and responses, which is what an outside attacker would see. It often has to guess versions, which leads to mistakes.
An authenticated (credentialed) scan logs in with a dedicated account, then reads installed packages, registry keys, patch levels and configuration files. It finds missing patches, weak local settings and vulnerable client software such as browsers, and it produces far fewer false positives.
Protect scan credentials carefully: use a dedicated account with the least privilege that works, store it in the scanner's vault, restrict where it can log in from, and monitor its use. A stolen scan account that can log in to every server is a gift to an attacker.
Agent, network, internal and external
| Type | Strengths | Weaknesses |
|---|---|---|
| Network-based | No software to install; finds unknown devices | Misses laptops off the network; needs credentials for depth |
| Agent-based | Works anywhere, even off-network; very detailed | Agents must be deployed and kept healthy; cannot run on many network devices |
| Internal | Shows what an attacker inside could reach | Large result sets need prioritising |
| External | Shows what the internet sees; often required for compliance (for example PCI DSS) | Limited view of internal weaknesses |
| Cloud posture | Reads cloud settings through APIs | Covers configuration rather than software flaws |
A mature programme uses agents on servers and laptops, authenticated network scans for everything else, regular external scans of public addresses, and cloud posture checks.
False positives, false negatives and safe scanning
A false positive is a reported flaw that is not really there. A classic cause is backporting: a Linux distribution fixes a flaw but keeps the old version number, so an unauthenticated scan matching on the banner reports it as vulnerable. A false negative is a real flaw the scanner missed, perhaps because a host was offline, credentials failed or a plugin was missing. False negatives are more dangerous, because nobody looks for them.
- Check scan coverage: how many known assets were scanned, and how many logins succeeded?
- Validate surprising findings by checking the installed package or configuration directly.
- Record confirmed false positives so they are suppressed with a reason, not deleted silently.
- Schedule scans in agreed windows, and use safe settings for fragile devices such as printers and industrial controllers.
Tip: watch the "authentication failed" count on every scan report. A credentialed scan that silently fell back to unauthenticated mode hides many vulnerabilities.
Practice
Why does an authenticated scan produce fewer false positives?
Give one advantage of agent-based scanning for a company with many remote workers.
Which is more dangerous, a false positive or a false negative, and why?
Key takeaways
- Scanners find known vulnerabilities; they do not replace penetration tests.
- Authenticated and agent scans see far more than unauthenticated scans.
- Combine internal, external, agent and cloud posture scanning for coverage.
- Protect scan credentials with least privilege and monitoring.
- Validate findings and watch coverage to catch false positives and negatives.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.