# What is a vulnerability scan?

A vulnerability scan is an automated check of your systems against a database of known vulnerabilities and weak settings, such as missing patches, default passwords or outdated encryption. A scanner looks at what each machine reveals and produces a list of findings with severity scores. It is cheaper and more frequent than a penetration test, but it only finds known problems and cannot judge how they combine. Run an external scan of everything you expose to the internet regularly, and an internal one at least every few months. Expect many findings; start with those on internet-facing systems that are known to be exploited.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-is-a-vulnerability-scan

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What is a honeypot in cybersecurity?](https://netsenx.com/en/faq/what-is-a-honeypot)
- [What is a sandbox in security?](https://netsenx.com/en/faq/what-is-a-sandbox-in-security)
- [What are allowlists and denylists?](https://netsenx.com/en/faq/what-are-allowlists-and-denylists)
- [What are IDS and IPS?](https://netsenx.com/en/faq/what-are-ids-and-ips)
- [What is SOAR?](https://netsenx.com/en/faq/what-is-soar)