Vulnerability Scanner
Also known as:
- Vulnerability management
What problem does it target?
VM solutions address the need to identify, assess, prioritize, and remediate vulnerabilities across IT assets to reduce risk and prevent exploitation. However, traditional scanning often produces many false positives—vulnerabilities that are present but not actually exploitable in the environment.
What does this solution do?
VM platforms:
- Scan systems, applications, and networks for vulnerabilities
- Prioritize findings based on risk and exploitability, with a growing emphasis on reachability (whether a vulnerability can actually be exploited)
- Track remediation and verify fixes
- Integrate with patch management and ticketing systems
Reachability and False Positives
The main goal of vulnerability scanning should be to identify exploitable software, not just the presence of vulnerable components. False positives often occur when vulnerabilities are present but not exploitable due to environmental factors or lack of exposure. Reachability analysis helps prioritize vulnerabilities by focusing on those that are actually exploitable, improving the efficiency of remediation efforts.
- Static reachability analysis can quickly provide feedback but may still flag non-exploitable vulnerabilities (e.g., dead code, unused test files).
- Runtime reachability analysis offers more certainty by observing which components are actually executed in a live environment, reducing false positives further.
Compliance and Prioritization
Compliance requirements have traditionally driven patching of all vulnerabilities, but there is a shift toward justifying non-patching of non-exploitable findings using tools like VEX statements for SBOMs.
Who is this for?
- Security and IT operations teams
- Organizations with diverse IT environments
- Enterprises subject to compliance requirements
Who might not benefit from this?
- Small businesses with minimal infrastructure
- Teams with manual or ad hoc vulnerability tracking
Pitfalls and remedies
| Pitfall | Remedy |
|---|---|
| Too many low-risk findings | Use risk-based prioritization and reachability analysis |
| Missed assets or blind spots | Ensure comprehensive asset inventory |
| Delayed remediation | Automate ticketing and follow-up |
Sample products
- Tenable Nessus
- Qualys VMDR
- Rapid7 InsightVM
- Microsoft Defender Vulnerability Management
- OpenVAS