Scanning and Authenticated Scans

Run an uncredentialed Nessus scan against a server and it comes back with a handful of mediums. Run the same scan a minute later with an SSH login and that same box lights up with 180 findings. Same host, same instant. The difference is that one of them actually looked inside instead of guessing from the outside.

Uncredentialed sees the outside

An unauthenticated scan pokes at open ports from the network and reads whatever banners the services hand back. Apache announces itself as 2.4.41, so the scanner flags every CVE ever filed against that version. The problem is that banners lie constantly. A backported Ubuntu fix closes the bug but keeps the version string, so you get a false positive. Or a vulnerable library sits behind a service that shows no banner at all, and you get a false negative you never even see.

Use uncredentialed scans for the attacker's-eye view of your perimeter, and for hosts you have no login to. Just do not treat the results as ground truth, because half of them are noise.

Credentialed reads the actual state

A credentialed scan logs in and queries package versions, the Windows registry, installed KB numbers, and config files directly. Instead of guessing from a banner, it reads dpkg -l, checks the patch level, and knows the backport closed the hole. Accuracy jumps and the false-positive pile collapses.

Setting it up is the part people skip. On Linux, create a dedicated scan account with an SSH key and enough sudo to read root-owned config. On Windows, the scanner needs a domain account with remote registry and admin access to the target, plus SMB and WMI reachable through the host firewall.

The one line to check in every finished scan is whether the credential handshake worked. Nessus reports it in plugin 19506.

If that says no, you ran the guesswork scan and your numbers are wrong. Chase the credential failure before you trust a single finding from that job.

Coverage: the host the scanner never reached

Network scanners only see what is reachable at the moment the scan runs. A laptop that was off, a cloud host behind a tight security group, a segmented OT network: all invisible to a scheduled sweep. Agent-based scanning fixes that. Install a lightweight agent (Nessus Agent, Qualys Cloud Agent, Rapid7 Insight Agent) and the host scans itself locally, then reports up whenever it has a connection. Roaming laptops and cloud-native fleets basically require agents, because there is no fixed IP for a network scanner to aim at.