Vulnerability scanning is an automated check that probes your systems for known security weaknesses — unpatched software, open ports, weak configurations — and reports what it finds before an attacker does. Think of it as a security audit that runs itself: the scanner holds a database of known vulnerabilities, checks every device and service it can reach, and produces a list ranked by severity. This guide covers what a scan actually finds, how often a small business should run one, and how the results turn into fixes.
TL;DR
- Vulnerability scanning checks systems automatically for known security weaknesses and ranks them by severity.
- It finds unpatched software, exposed services and misconfigurations — the same gaps attackers scan for.
- A monthly scan of internet-facing systems is the minimum for small business; quarterly for the whole environment.
- A scan is not a pen test: it finds and lists known weaknesses rather than proving how they chain together.
- Scanning earns compliance credit — Essential 8, SMB1001 and cyber insurers all reward it.
What vulnerability scanning means in plain terms
Every piece of software has flaws. Vendors publish fixes, and the flaw becomes publicly known the moment a patch ships — which is exactly when attackers start scanning for systems that never applied it. A vulnerability scanner does the same sweep from your side: it fingerprints your software versions, services and settings, compares them against a database of known vulnerabilities, and flags the matches.
The output is a ranked list. Each finding carries a severity score (the industry-standard CVSS scale, from information to critical), the affected system, and — crucially — whether a fix is already available. That last point separates vulnerability scanning from penetration testing: a scan finds the doors that are unlocked; a pen test attempts to walk through them and see what is actually reachable.
What a scan typically finds
| Finding type | Example | Typical severity |
|---|---|---|
| Missing patches | Server running a version with a published fix available | High to critical |
| Exposed services | Remote desktop, database port, admin panel reachable from the internet | Critical if internet-facing |
| Weak configurations | Default passwords, outdated TLS, missing MFA on admin portals | High |
| End-of-life software | An OS or app the vendor no longer patches | High — replacement only |
| Informational | Software versions, open ports that are intentionally exposed | Low — review for intent |
The exposed-services row is where small businesses get hurt: a remote-desktop port opened for one contractor in 2023 and forgotten is exactly the kind of finding a scan surfaces in minutes.
How often to scan
| Scope | Frequency | Why |
|---|---|---|
| Internet-facing systems (website, VPN, remote access) | Monthly at minimum | These are what attackers scan first |
| Internal servers and infrastructure | Quarterly | Changes are slower, exposure is lower |
| Staff laptops and phones | Quarterly or via endpoint tooling | Follows patch and inventory discipline |
| After any major change | Ad hoc | New system, migration or firewall change — scan before go-live |
Monthly scanning of internet-facing systems is the minimum defensible baseline for a small business. Anything less and the window between a patch shipping and your scan finding the gap grows beyond what the threat justifies.
How to run a scan and act on the results
- Pick a scanner. Free options include OpenVAS, Nessus Essentials and cloud providers' built-in vulnerability assessment (AWS, Azure, GCP all offer one); MSPs and managed security providers often bundle scanning into their monitoring.
- Scan internet-facing systems first. Those are what an attacker sees, and where a finding is actionable immediately.
- Rank by severity and exploitability. A critical finding with a public exploit beats a medium finding on an internal machine. Internet-facing + critical = fix this week.
- Fix in the patching cycle. Findings feed the patch management routine — the scanner tells you what is vulnerable, the patch process closes it, the next scan verifies it closed.
- Verify with a re-scan. A finding is closed when the re-scan says so, not when someone says so.
- Document the cycle. Scan date, findings, fixes applied, re-scan result — a one-page log turns scanning into Essential 8 / SMB1001 / insurer evidence.
Scanning vs penetration testing vs gap assessment
| Vulnerability scan | Penetration test | Security gap assessment | |
|---|---|---|---|
| What it answers | What known flaws exist | Can flaws be exploited to real damage | What controls are missing at the process level |
| Method | Automated | Manual, human-driven | Structured review against a framework |
| Cost | Low — often free tooling | High — specialist engagement | Moderate — one-off, structured |
| Frequency | Monthly/quarterly | Annually or after major change | Annually |
| Best for | Ongoing hygiene | Targeted deep validation | Prioritising the roadmap |
The three complement each other: the scan finds the unlocked doors, the pen test checks whether they actually open, and the gap assessment asks whether the right doors were even part of the building plan. A small business without all three should start with scanning — cheapest, most frequent, most immediately actionable.
Why scanning matters for Australian small business
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with small business self-reporting an average cost of $56,600 per incident. The incidents behind those numbers overwhelmingly start with known, preventable gaps: an unpatched system, an exposed service, a forgotten remote-access port. A monthly scan finds those in minutes.
Scanning covers technical gaps, but the human layer produces the other half of incidents. Cyber Aware's security awareness training runs monthly, pairing simulated phishing with remediation training, while human risk reporting tracks reporting and click behaviour over time. For a checklist view of what is covered and what is missing across controls, a cyber security gap assessment gives the ranked answer.
FAQ
What is vulnerability scanning in simple terms? An automated check that probes systems for known security weaknesses — unpatched software, exposed services, weak settings — and reports them ranked by severity.
How often should a small business run a vulnerability scan? Monthly on internet-facing systems at minimum; quarterly for internal infrastructure; before go-live after any major change.
Is vulnerability scanning the same as penetration testing? No. A scan lists known weaknesses automatically; a pen test manually attempts to exploit them to prove real-world impact. Scanning is cheaper and more frequent; pen testing is deeper and occasional.
What does a scanner actually check? Software versions against known-vulnerable lists, open ports and exposed services, TLS and configuration settings, and end-of-life software with no fix path.
Does vulnerability scanning disrupt operations? Light scans rarely do. Aggressive scans can overwhelm old systems or trip security tools — schedule them in maintenance windows and tell whoever runs your firewall.
Can scanning be free? Yes — OpenVAS is open source, Nessus has a free Essentials tier, and cloud providers bundle vulnerability assessment. The cost is the time to run it and act on results.
One last thing
Run one scan of your public-facing systems this week — a free tool will take an afternoon to set up and under an hour to run. The first scan is always the uncomfortable one, because it lists everything nobody has patched in two years. That list is not a disaster; it is the roadmap, and it shrinks dramatically by scan three.