# Vulnerability Scanning

The process of automatically scanning systems for known security weaknesses on a regular basis.

**Vulnerability scanning[↗](/vulnerability-scanning)** is the process of regularly checking systems, networks, and applications against known security vulnerabilities using automated tools. The scanner compares target systems against a constantly updated vulnerability[↗](/vulnerability) database to identify missing patches, misconfigurations, and known weaknesses.

A scan typically produces a report that ranks the vulnerabilities found by severity (for example, by CVSS score). This report helps the security team decide which issues to address first. Scanning is different from penetration testing[↗](/penetration-testing): it finds and lists vulnerabilities, but unlike a pentest it doesn't actually try to exploit[↗](/exploit) them.

Regular, automated scanning ensures vulnerabilities are found and closed before attackers find them, which is why it's a continuous practice, not a one-time exercise. New vulnerabilities emerge every day, so a system that looked clean yesterday can be exposed today. Scanning is the starting point of a broader vulnerability management process.