A vulnerability scanner is software that lists every computer and app a company has, and checks each one against the public list of known security flaws. This work is also called vulnerability management. The public list is the CVE list, short for Common Vulnerabilities and Exposures. Each flaw on it has a number, such as CVE-2021-44228. Most flaws are also given a severity score from 0 to 10, called the CVSS score.
A scanner works in two ways. First, it can scan over the network. It connects to each address, finds out which program and which version is running there, and compares that version with the CVE list. Second, it can install a small program, called an agent, on each laptop and server. The agent reads the installed software directly and reports it. An agent also works on a laptop that is at an employee's home, outside the office network.
Consider a private hospital group in Ahmedabad with 300 servers and 4,000 computers. Every night, the agents report what is installed on each machine. One morning, the scanner shows 2,600 open findings. A finding is one known flaw on one machine. Among them, 46 servers still run an old version of a file-sharing program with a flaw scored 9.8 out of 10. The scanner groups these 46 servers into one task, together with the patch that fixes the flaw. The IT team installs that patch through patch management the same week. The next night's scan confirms that the flaw has gone from all 46 servers.
The hardest problem is choosing what to fix first. A large company can have tens of thousands of findings, and attackers will never use most of them. So the scanner adds vulnerability intelligence, which marks the flaws that attackers are using right now. It can also send its findings to attack path simulation, which checks whether an attacker could actually reach each machine. A severe flaw on a server that nobody can reach drops down the list.
Some scanners now also install the patch themselves, in the same product. Smaller companies prefer this, because they have no separate patching team.
A scanner only looks at the machines that the company already knows about. It does not find the server that nobody has listed. That job belongs to external attack surface management (EASM), which looks at the company from the internet, as an attacker does.