Vulnerability scan
A vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses. Cyber Essentials self-assessment does not include one. Cyber Essentials Plus runs two: an external scan of your internet-facing IP addresses (test case 1) and an authenticated scan of sampled devices to find missing updates (test case 2).
- Term
- Vulnerability scan
- Also known as
- Vulnerability scanning, Vulnerability assessment
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term vulnerability scan mean in Cyber Essentials?
A vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
How does vulnerability scan apply to Cyber Essentials?
In plain terms
It is like a surveyor walking round a building with a checklist, trying every door and window and noting which are unlocked, broken or out of date. The scanner does the same for IT, comparing what it finds against a large database of known weaknesses. It reports problems but does not break in, which is the difference from a penetration test.
What Cyber Essentials asks
Basic Cyber Essentials is a self-assessment questionnaire and involves no scanning. Cyber Essentials Plus uses scanning in two test cases, each with a scanning tool "that has been approved by the Delivery Partner":
- Test case 1, remote vulnerability assessment. The assessor identifies all the IP addresses you use, including IaaS, and scans them from the internet. Appendix A of the specification explains that the most common internet services are the ones most likely to be probed by low-skilled attackers. See external vulnerability scan.
- Test case 2, authenticated vulnerability scan. The assessor scans sampled end user devices, servers and IaaS instances from the inside and fails the test if a critical or high-risk fix has been available for more than 14 days without being applied. See authenticated scan.
What an assessor looks for
- In test case 1, each internet-accessible service the scan discovers, judged pass or fail using the specification's flow diagram.
- In test case 2, missing fixes that the vendor rates critical or high risk, that have a CVSS v3 base score of 7 or above, or that come with no severity details.
See test 1: external vulnerability scan and test 2: authenticated patch scan. Related: CVSS.
Related terms
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
Frequently asked questions
A vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.