---
title: "Vulnerability Scanning"
canonical: https://trickest.com/glossary/vulnerability-scanning
description: "Vulnerability scanning runs automated checks against hosts and applications to detect known weaknesses, missing patches, and risky configurations, then reports findings for triage."
last-updated: 2026-06-03
---

# Vulnerability Scanning

Vulnerability scanning runs automated checks against hosts and applications to detect known weaknesses, missing patches, and risky configurations, then reports findings for triage.

Vulnerability scanning checks hosts, services, and applications against a database of known issues. A scanner probes targets, compares responses and version banners to signatures, and reports matches such as missing patches, default credentials, exposed admin panels, and weak TLS settings. Most findings map to a published [CVE](/glossary/cve) and carry a [CVSS](/glossary/cvss) score so teams can rank what to fix first.

Scanning matters because it scales to surface that no human could review by hand. A single run can cover thousands of hosts and flag the low-hanging issues attackers reach for early. It does not confirm exploitability the way a [penetration test](/glossary/penetration-testing) does, and it produces false positives, so a scan starts a triage process rather than ending one.

## Where it fits a workflow

In an automated pipeline, scanning sits right after discovery. New assets feed into a scanner template, results land in a normalized store, and you diff against the previous run to surface only what changed. Web targets often get a [dynamic application security testing](/glossary/dynamic-application-security-testing) pass alongside the host scan. Scheduling the whole chain keeps coverage current as the surface shifts, and routing high-severity hits to alerts shortens the window an attacker has to act.

---
_Markdown source of https://trickest.com/glossary/vulnerability-scanning._