Catalog
method#Security#DevOps#Integration#Observability

Vulnerability Scanning

A method for automated detection and prioritization of known security vulnerabilities in systems, applications, and dependencies.

Vulnerability scanning is a structured method for automated detection of known security weaknesses in systems, applications, and dependencies.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

Issue tracker (e.g., Jira)CI/CD toolchain (e.g., GitLab CI, GitHub Actions)Security Information and Event Management (SIEM)

Principles & goals

Regularity: Schedule scans based on risk, not only on time.Authentication: Authenticated scans produce deeper findings.Integration: Scan results must feed into remediation workflows.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Overreliance on scan results instead of manual assessments.
  • Lack of authenticated scanning leads to incomplete results.
  • Mis-prioritized findings consume resources inefficiently.
  • Run both authenticated and unauthenticated scans.
  • Automate remediation ticketing based on priority.
  • Monitor trend metrics and adapt the scanning strategy.

I/O & resources

  • Asset inventory (IPs, hosts, applications)
  • Scan credentials and access configurations
  • Scan policy, windows, and target profiles
  • Prioritized vulnerability listings with context
  • Automatically created remediation tickets
  • Reports for compliance and management

Description

Vulnerability scanning is a structured method for automated detection of known security weaknesses in systems, applications, and dependencies. It includes scheduled, configured scans, prioritization of findings, and integration into remediation workflows to reduce risk and support compliance. Practices like scan authentication, false-positive management, and reporting are essential.

✔

  • Early detection and prioritization of known vulnerabilities.
  • Support for compliance and audit requirements.
  • Automated entry points for remediation processes.

✖

  • Primarily detects known CVEs and signature-based issues.
  • May produce false positives that require manual review.
  • Not all issues (e.g. business-logic flaws) are automatable.

  • Number of vulnerabilities found per scan

    Measures count of findings; helps trend analysis and tuning.

  • Time to Remediate (MTTR)

    Time from discovery to confirmed remediation after prioritization.

  • False positive rate after validation

    Share of scanner-reported findings that prove to be non-actionable.

Banking frontend: CVE remediation

Regular scans detected several third-party library CVEs; prioritization by CVSS and business logic led to targeted patch rollout.

SaaS platform: image scanning in CI

Integrating an image scanner into CI prevented deployment of an image with critical package vulnerabilities.

Intranet: network scan after migration

After a datacenter migration, the scan revealed unauthorized open services that were closed before production go-live.

1

Define scope, objectives, and scan policy.

2

Provide asset inventory and access credentials.

3

Select suitable scanners and configure profiles.

4

Integrate scanner into CI/CD and ticketing systems.

5

Establish feedback loop: validate, prioritize, retest.

⚠️ Technical debt & bottlenecks

  • Outdated scanner versions without current signatures
  • Missing automation for ticket tracking
  • Incomplete asset inventory hinders coverage
Credential managementScan window and performanceFalse-positive handling
  • Scanning products regularly without a remediation process.
  • Insecurely storing and using credentials for scans.
  • Using scans as the sole security strategy.
  • Overestimating scan depth without proper privileges.
  • Missing context data leads to wrong prioritization.
  • Uncoordinated scan windows impact production systems.
Knowledge of network topology and authenticationUnderstanding of CVSS and risk prioritizationExperience with scanner tools and reporting
Visibility of assets and dependenciesMinimization of attack surfaceFast integration into remediation workflows
  • • Compute and network resources for large-scale scans
  • • Access rights for authenticated assessments
  • • Regulatory constraints when scanning third-party infrastructure