We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Testing Operations
Free preview: the first 2 parts of this 9-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Testing Operations
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Every month, thousands of new vulnerabilities are published in the National Vulnerability Database (NVD). In 2023 alone, NIST published 28,902 CVEs. Each one is a known weakness in a specific software version, and attackers track these databases as closely as defenders do.
Vulnerability scanners check your systems against these databases. They probe for unpatched software, misconfigurations, default passwords, open ports, and exposed services. The scanner sends probes ( connections, HTTP requests, banner grabs) and matches responses against its vulnerability database.
Nessus has over 140,000 detection plugins. Qualys runs continuous cloud-native monitoring. OpenVAS is the open-source option for budget-constrained teams. All three work the same way: discover what is running, match versions against known CVEs, and report findings ranked by severity.
Equifax was running Apache Struts with a known critical CVE (CVE-2017-5638) for two months before attackers exploited it, exposing 147 million records. A weekly vulnerability scan would have flagged that system in the first pass. The question is never whether attackers will find your unpatched vulnerabilities. The question is whether you find them first.
| Scan Type | Access Level | Coverage | Speed | Finds |
|---|---|---|---|---|
| Network (unauthenticated) | External only | Surface-level | Fast (minutes) | Open ports, service banners, exposed admin panels |
| Authenticated (credentialed) | System credentials | Deep | Moderate (30-60 min per host) | Installed packages, config files, registry keys |
| Agent-based | Installed agent | Deepest | Continuous | Real-time OS patches, running services, config drift |
| Container image | Image layers | Dependencies + OS | Fast (seconds per image) | CVEs in base images and language packages |
Authenticated scans find 3-10x more vulnerabilities than unauthenticated scans. The reason is straightforward: without credentials, the scanner can only check what is visible from the network. With credentials, it logs in via SSH or WinRM and reads the actual package list (dpkg -l, rpm -qa, Windows registry), configuration files, cron jobs, and internal services.
Container scanning (Trivy, Snyk Container, Aqua) is essential for Docker and environments. Each container image contains a full OS and dependency set. A single Dockerfile using node:18-alpine inherits every CVE in the Alpine base image plus every CVE in the Node.js version. Trivy scans an image in 10-15 seconds and reports findings by severity.
Agent-based scanning (Qualys Cloud Agent, Tenable Nessus Agent, Wazuh) runs on the host itself. It reports continuously, not just when a scheduled scan runs. This catches newly published CVEs within hours instead of waiting for the next weekly scan window.