What a Vulnerability Scanner Cannot See

A vulnerability scanner is a good tool, and this post is not against it. But every scanner works inside three limits. It tests the assets on your list. It tests them when it runs. And it tests what it can reach. Most surprises come from outside those limits. Vulmon has two products for exactly that space. Vulmon Recon finds the assets that are not on your list. Vulmon Alerts tells you about new vulnerabilities in the software you already run, whether or not a scan can see it.

What a scanner does well

A vulnerability scanner takes a list of targets and tests each one in depth. With credentials it logs in, reads the installed packages and compares them with a vulnerability database. It finds missing patches, weak settings and known vulnerable software on the systems you point it at. It is thorough, and nothing in this post replaces it.

Where it stops

Here is what falls outside its reach.

Assets that are not on the list. A subdomain from an old campaign, a test server that was never turned off, a cloud account a team opened on its own. Nobody added them, so nobody scans them. The list comes from you, and anything not on it does not exist for the scanner.
The view from outside. Scanners usually run inside the network and see what the network lets them see. An attacker sees your public footprint, and the two views are not the same.
Changes between scans. Most scanning runs on a schedule, often monthly. A new host or an expired certificate can go unnoticed until the next run. And a scanner can only find a vulnerability after its vendor has written a check for it and you have installed the update. That takes time.
Software that does not answer on the network. Most scans run without an agent and without credentials. They see what listens on a port. A browser, a PDF reader or an office suite does not listen on anything, so their vulnerabilities never appear in the results. These are the programs phishing goes after.
Problems that are not CVEs. A certificate about to expire on a host nobody listed, a domain registration about to lapse, or a database port that should never have been public. None of these is a vulnerability in a CVE database, and a scanner is not built to look for them.

Gap one: the assets you do not know about

External attack surface management, EASM for short, starts with no list. It begins from your domains, IP ranges and cloud accounts, finds what you expose to the internet and keeps that inventory current. Then it checks what it finds: known vulnerabilities in the detected software and versions, common misconfigurations and certificate problems. It does this from the outside and without agents. It maps, fingerprints and runs non-destructive checks. It does not exploit.

The vulnerability checks are real, but they are not an authenticated scan. EASM sees what an attacker sees without credentials: a version string, a response header, a certificate. Vulmon Recon, for example, matches a CVE only when it can read a product and a version from the outside. A service that hides its version is not scored. A scanner with credentials sees the full package list. Neither view replaces the other.

Vulmon Recon is our EASM product. It watches continuously and notifies you when a new host appears. Expiring certificates are flagged in the inventory and in your scheduled reports. It can open a finding as a Jira, ServiceNow or GitHub issue, export the inventory as CSV, or hand it over through its API.

Gap two: the software you know you run

For the second gap the answer is not another scan. It is knowing, without a scan, when something new is published for the software you run. That is what Vulmon Alerts does. You write down what you follow: a product, a vendor, a vulnerability type, a keyword, or a vendor and product with a CVSS threshold. When a new CVE matches, you get a daily email. Slack, Microsoft Teams, RSS and an API are available too. Nothing is installed, and you do not share an inventory with anyone. A free plan is available.

Alerts covers what a scan cannot reach and what it has not caught up with yet. The browser and the office suite on every laptop. The appliance that no scan credential opens. The CVE that came out yesterday. Alerts does not know your versions or your patch level. It tells you that something new exists for the products you follow, and you decide what to do with it.

How the three fit together

Use the scanner for depth on the systems you own and control. Use Recon to learn what is out there and what is exposed. Use Alerts to hear about new vulnerabilities in what you run, whether a scan can see it or not. Send what Recon and Alerts find to your scanner, your patching process and your ticketing system. Together they answer three questions: what is out there, what is new, and how serious each finding is.

Request a Recon trial if you want to see what your own list is missing. Trials run for 14 days with the full product and no card on file. Or start with Vulmon Alerts and follow the products you already know you run.

Vulmon Blog