Authenticated scan
An authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed. It is Cyber Essentials Plus test case 2, and it fails if a critical or high-risk fix has been available for more than 14 days, the same rule as A6.4 and A6.5.
- Term
- Authenticated scan
- Also known as
- Credentialed scan, Authenticated vulnerability scan, Patch scan
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term authenticated scan mean in Cyber Essentials?
An authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
How does authenticated scan apply to Cyber Essentials?
In plain terms
An external scan is like checking a house from the pavement. An authenticated scan is being handed the keys and walking through every room with a checklist. Because the scanner logs in, it can read the exact version of the operating system, the browser, Office and every other program, and compare each one against the list of known vulnerabilities.
What Cyber Essentials asks
Test case 2 of the Cyber Essentials Plus test specification v3.2 is "Check patching, by authenticated vulnerability scan of devices". Its purpose is "To identify missing vulnerability fixes within the defined CE+ test scope that could be exploited within the bounds of the CE threat model." It runs on sampled end user devices, servers and IaaS instances.
From the scan output the assessor picks out vulnerabilities that the vendor describes as critical or high risk, that have a CVSS v3 base score of 7 or above, or that have no severity details from the vendor. If any of those has a vendor fix "which has been available for more than 14 days", the sub-test fails. The specification adds that virtual patching "will not be recognised as a mechanism for compliance" for legacy unsupported operating systems.
This is the practical check on your self-assessment answers at A6.4 (operating systems and firmware) and A6.5 (all other software).
Common mistakes
- Updates downloaded but waiting for a restart. They still show as missing, so restart devices before the audit.
- Old software nobody uses, such as a second browser or an outdated runtime. The scan still finds it. Remove it (A6.6).
See test 2: authenticated patch scan and the security update management requirements. Related: vulnerability scan, CVSS.
Related terms
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- BackupA backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Commodity attacksCommodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
- EDR (endpoint detection and response)Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
Frequently asked questions
An authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
In the 2026 Danzell question set, authenticated scan comes up at A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.