Vulnerability Scanning and Vulnerability Assessment (Nessus)

What is vulnerability scanning and what does it do for a business?

Vulnerability scanning is an automated check of which ports the devices on your network expose, which software versions they run and whether those versions have publicly disclosed security flaws. For every finding you get the affected device, a description of the vulnerability, a risk rating and a recommended fix.

The benefit is concrete: you know what is exposed instead of guessing. In most companies the problem is not exotic attacks but forgotten things. A file server nobody has rebooted in years, a printer still on its default password, a NAS that has not been updated since the day it was installed, or an RDP port opened “temporarily” and never closed. A vulnerability scan puts each of these in front of you.

We do not see scanning as a matter of running a tool. The real work is turning a report hundreds of lines long into something that says “close these five this week, these three can wait for the next maintenance window”, and then doing the remediation as well.

Vulnerability scanning vs penetration testing: what is the difference?

A vulnerability scan finds and lists weaknesses; a penetration test tries to exploit them the way a real attacker would and shows how far into your systems someone could get. One does not replace the other. NIST’s security testing guide, SP 800-115, also treats vulnerability scanning and penetration testing as separate techniques.

CybUp carries out vulnerability scanning and the remediation that follows; we do not do penetration testing. If a regulation, an audit or a customer contract requires a penetration test report from a TSE-certified provider, that test is carried out by firms certified under the penetration testing authorisation programme of TSE, the Turkish Standards Institution. In that case we get the environment ready: we scan first and close the obvious holes, and afterwards we take on the technical fixes for whatever the test turns up.

In practice this order makes sense. Going into a certified penetration test with missing patches means spending much of an expensive test on things an automated scan would have found anyway.

How does a Nessus vulnerability scan work?

The scan is run with Tenable’s Nessus scanner from a point that can reach your network. Usually the scanner sits on a virtual machine inside the network, and services you expose to the internet are scanned separately from the outside. The scan policy, the scope (IP ranges, VLANs, sensitive devices to exclude) and the time window are agreed with you.

There are two kinds of scan. An uncredentialed scan sees the device from the outside: open ports, service versions, certificate and protocol settings. A credentialed scan logs in to the server with an account and reads missing patches, installed software and local settings from the inside. As Tenable’s credentials documentation makes clear, the more privilege the scanner has, the more detailed the results. So we create a dedicated scan account for Windows servers and an SSH key-based account for Linux servers, and restrict their rights once the work is done.

Take an 80-user office on two floors: six physical and virtual servers, a firewall, four switches, a few camera recorders and some network printers. In an environment like this a full scan usually finishes in a few hours outside working hours. The first page of the report tends to show the same picture: services that still accept old TLS versions, one or two Windows servers that have gone months without patches, and devices whose management interface was left on default settings.

How should vulnerability scan results be prioritised?

Trying to close every finding with the same urgency means closing none of them on time. We set priority not only by risk score but by where the vulnerability sits. Findings arrive with a CVSS score, and we read that score against the reality of your environment.

• High and critical vulnerabilities on internet-facing services come first.
• Vulnerabilities with public exploit code move up the list, even when their score is lower.
• Servers holding personal or accounting data are dealt with before test machines with the same flaw.
• Updates that clear dozens of findings with a single patch are scheduled as quick wins.
• Findings that cannot be fixed get a compensating control (access restriction, segmentation) recorded in writing.

Does KVKK require regular vulnerability scanning?

Yes, the regulator’s guidance says so explicitly. KVKK, Türkiye’s Personal Data Protection Law (Law No. 6698), requires data controllers under Article 12 to take “all necessary technical and administrative measures to ensure an appropriate level of security”. The Personal Data Protection Authority’s Personal Data Security Guide (Technical and Administrative Measures) states that IT systems should be protected against known vulnerabilities through regular vulnerability scans and penetration tests, with the results assessed.

Note that the guide lists the two measures together. Vulnerability scanning covers the ongoing part of that expectation; a penetration test has to be planned separately. We explain which services map to the other KVKK technical measures on our KVKK technical measures page.

How often should you run a vulnerability scan?

We recommend a full scan at least once a quarter, repeated after every major change. When a new server goes live, firewall rules change or your web application moves to a new version, your attack surface changes with it.

New vulnerabilities are published every week, so a server that came back clean three months ago can show a critical finding today. That is why it makes sense to scan your public IPs more often, monthly for example. To shrink what is visible from outside in the first place, a review of your firewall configuration and a WAF in front of web applications will often remove a large share of scan findings for good.

What happens after the findings are fixed?

Once remediation is complete we run a verification scan with the same policy. The difference between the first and the last report is concrete evidence you can show management and auditors: how many findings there were, how many were closed, and why the rest are still open and which compensating control covers them.

For companies that want this to continue, we put scanning on a schedule and deliver a short comparison report at the end of each cycle. Tying patch management into your Windows Server maintenance routine stops the same findings coming back in the next scan.

What you receive

• Scope and scan policy document (IP ranges, excluded devices, time window)
• Nessus scan report for the internal network and external IPs
• Findings list prioritised for your environment, with a remediation plan
• Patching, configuration changes and disabling of unneeded services
• Verification scan and before/after comparison report
• Compensating control records for findings that cannot be fixed

How we work

1. 1

   Free initial call

   We discuss the size of your network, your critical systems and what you expect from the scan, agree the scope and send a written quote.

2. 2

   Scope and permissions

   IP ranges, scan accounts and the time window are approved in writing; sensitive devices are excluded where needed.

3. 3

   Scanning

   The internal and external scans run outside working hours, with settings that will not disrupt day-to-day work.

4. 4

   Analysis and prioritisation

   The raw report is interpreted for your environment, false positives are weeded out and a remediation plan is drawn up.

5. 5

   Remediation and verification

   Patches and configuration changes are applied, then a verification scan documents the result.

Frequently asked questions