External vulnerability scan
An external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them. It is test case 1 of Cyber Essentials Plus, the remote vulnerability assessment, and it checks the firewall and patching answers you gave in the self-assessment.
- Term
- External vulnerability scan
- Also known as
- Remote vulnerability assessment, External scan, Test case 1
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls; 3. Security Update Management
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term external vulnerability scan mean in Cyber Essentials?
An external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
How does external vulnerability scan apply to Cyber Essentials?
In plain terms
Imagine someone walking around the outside of your building at night, trying every door and window to see which are unlocked and which have broken locks. An external scan does that to your internet connection. A scanning tool knocks on each port of each public IP address, notes what answers, and checks what it finds against lists of known weaknesses.
What Cyber Essentials asks
The basic Cyber Essentials self-assessment has no scan. For Cyber Essentials Plus, test case 1 in the test specification v3.2 is the "Remote vulnerability assessment". Its stated purpose is "To test whether an Internet-based opportunist attacker can hack into the Applicant's system with typical low-skill methods."
The assessor must:
- "Identify all of the IP addresses currently in use by the Applicant. This must include IaaS where used."
- "Scan all identified IP addresses, on the recommended set of TCP and UDP ports", using a scanning tool approved by the Delivery Partner.
- Record a pass or fail for each internet-accessible service. The test case passes only if every service passes.
Where your connection uses a dynamic address, the scope "may be defined in terms of appropriate DNS entries".
Common mistakes
- Forgotten services: an old port forward, a firewall admin page left open (A4.9 to A4.11), or remote desktop exposed to the internet (A4.7 and A4.8).
- Out-of-date firmware on VPN appliances and firewalls. Figure 1 of the specification fails any service with a vulnerability scored 7.0 or more, regardless of how old the fix is, so patch internet-facing devices first (A6.4 and A6.5).
- A login page without MFA that neither throttles attempts nor locks out after at most 10 failures, or that still uses a default password.
- Missing a cloud server or second site from the address list.
Running your own external scan before the audit, on the same address list, is the simplest way to find these first.
See Test 1: the external vulnerability scan and how to prepare for Cyber Essentials Plus. Related: internet-facing, CVSS.
Related terms
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- FirewallA firewall is a device or piece of software that sits between your computers and the internet and decides, using a set of rules, which traffic is allowed through.
- Firewall ruleA firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.
Frequently asked questions
An external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
External vulnerability scan relates to 1. Firewalls; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.