A subdomain nobody remembered was still serving a login page. Your scanner never flagged it because the host was missing from its target list. Finding the subdomain closes one gap; assessing the service behind it closes another.
For the broader basics, start with what a vulnerability scan is.
Active and passive scanning, defined
Active scanning interacts with a target to assess it. Passive scanning analyses information already available without sending probes to that target.
What is passive vulnerability scanning?
Passive vulnerability scanning analyses existing network traffic to identify assets, services, and signs of vulnerabilities. Passive external reconnaissance uses existing records to discover internet-facing assets and exposure clues. Both avoid direct probing, but they see different parts of an environment.
External reconnaissance draws on sources such as certificate transparency logs, search data, and previously collected Domain Name System (DNS) records. A certificate record might reveal a forgotten subdomain, but it does not establish whether the service is still running or vulnerable today.
Network monitoring instead observes traffic from a mirror feed, such as a SPAN (switch port mirroring) connection or PCAP (packet capture) file. It can identify vulnerabilities or insecure behaviour visible in that traffic. Quiet devices, encrypted content, and traffic outside the sensor's view can limit what it detects.
What is active vulnerability scanning?
Active vulnerability scanning sends requests to systems and examines their responses for weaknesses. Checks can identify open ports, detect service versions, assess Transport Layer Security (TLS) configuration, and test web application behaviour. These checks map to Vornin's scan types, from network and TLS to web application testing.
For example, a TLS check can establish which protocol versions a server accepts.
Finding confidence depends on the check. Version matches suggest possible vulnerabilities; observed behaviour can provide stronger evidence. Assess the supporting evidence before treating a finding as proof of exploitability.
Penetration testing complements scanning by investigating whether weaknesses can be combined into a meaningful compromise. Regular scans help identify weaknesses between engagements. See vulnerability scanning vs penetration testing for the fuller comparison.
What are the key differences between active and passive scanning?
Active scanning generates traffic to assess a target; passive methods depend on existing records or traffic. Active checks can examine behaviour that ordinary traffic never reveals. Passive coverage depends on the sources available, with external discovery and network monitoring providing different views.
| Attribute | Passive | Active |
|---|---|---|
| Method | Analyses existing records or traffic | Sends requests and evaluates responses |
| Typical findings | External recon: assets and service clues. Network monitoring: observed services, vulnerability indicators, and insecure behaviour | Reachable ports, service versions, TLS weaknesses, web flaws, and misconfigurations |
| Main blind spots | Missing or stale records; quiet devices, encrypted content, or unseen traffic | Targets outside scope, inaccessible services, missing credentials, and unsupported checks |
| Operational impact | No added probe traffic to the target | Generates traffic; some checks can affect sensitive systems |
| Evidence produced | Source records, observed traffic, and findings derived from them | Scan results and responses supporting findings; detail varies by check |
| Best use | Extending discovery and observing environments where probing is restricted | Assessing reachable systems within authorised scope |
Neither method guarantees a complete inventory or a clean bill of health. A passive source can miss a host, and an active scanner can miss a weakness even when the host is in scope.
Keep method separate from two other choices. Authenticated or unauthenticated describes access. It covers whether the scanner uses credentials and what those credentials allow it to inspect. Internal or external describes where the assessment runs from.
An external web scan can be active and authenticated. An internal network scan can be active without credentials. Installing an agent is another deployment choice; a device's inability to accept an agent does not by itself make active network checks unsuitable.
When should you combine active and passive scanning?
Combine them when you need both discovery and assessment, or when different systems need different levels of interaction. Choose the approach per asset, considering its sensitivity, the visibility available, and the checks you are authorised to run.
For an internet-facing estate, a certificate record can reveal a forgotten login page's hostname, the kind of gap that turns forgotten subdomains into breach paths. Once ownership and scope are established, an authorised scan identifies an outdated TLS configuration. After the owner changes that configuration, a repeat check records whether the server still accepts the affected protocol.
Fragile Operational Technology and Industrial Control Systems (OT/ICS) equipment may need a different approach. Passive network monitoring can provide visibility without adding probe traffic. Any active assessment should account for the device model, firmware, vendor guidance, an agreed operating window, and a recovery plan.
External reconnaissance discovers internet-facing assets; passive network monitoring observes traffic inside the sensor's view. Choose according to the visibility you need.
Some attack-surface tools focus on passive discovery. Finding an asset is the starting point; assessing its weaknesses and documenting remediation requires further checks.
Can you stay compliant with passive scanning alone?
There is no universal answer across frameworks. Passive evidence can support inventory, monitoring, and vulnerability assessment, but discovery alone does not demonstrate that weaknesses were assessed and addressed. Where an applicable requirement names scans or testing, check whether your assessment meets that requirement.
Some frameworks prescribe an activity or cadence. Others require you to evaluate risk or security effectiveness and leave the assessment method to you. The useful question is what your evidence demonstrates, including the systems covered and what happened after a finding.
For its covered sectors, NIS2's implementing regulation names vulnerability scans "where appropriate" and requires evidence of their results at planned intervals.
| Framework | Applicable scope | Required activity | Method or testing requirement |
|---|---|---|---|
| NIS2 (Directive 2022/2555; CIR 2024/2690) | Essential and important entities under the Directive; the CIR's binding technical rules apply to a named sector subset (cloud, data centre, DNS, managed service and security providers, and similar) | Vulnerability handling; scans "where appropriate" at planned intervals, with evidence of results recorded (CIR Annex 6.10) | Scans named explicitly, risk-based, no fixed cadence |
| DORA (Regulation 2022/2554) | EU financial entities (microenterprises get lighter obligations, and some small firms use a simplified framework under Art 16); their ICT third-party providers are bound through contract, with designated critical providers under direct EU oversight | A risk-based testing programme (Art 24-25) whose example tests include "vulnerability assessments and scans"; automated vulnerability scanning at least weekly for assets supporting critical or important functions (the regulatory technical standard (RTS) 2024/1774 Art 10); test all ICT systems supporting critical or important functions at least yearly (Art 24(6)); entities other than microenterprises remedy and validate all issues revealed by testing (Art 24(5)) | Scans named in law; a competent-authority-selected subset of larger entities also runs threat-led penetration testing (TLPT) at least every three years (Art 26) |
| ISO 27001:2022 (comparison with NIS2) | Management-system standard (not law); any organisation with an information security management system in the audit scope | Obtain information on technical vulnerabilities, evaluate exposure, and take action (Annex A control A.8.8) | Method not prescribed; the auditor expects evidence the control operates |
| SOC 2 Type II | Examination criteria (not law); service organisations reporting against the AICPA (American Institute of Certified Public Accountants) Trust Services Criteria | Detection and monitoring to identify new vulnerabilities and config changes that introduce them (criterion CC7.1) | No prescribed method; points of focus include vulnerability scans run regularly and after material change |
| HIPAA Security Rule | Covered entities and business associates handling electronic protected health information (ePHI) | Risk analysis of risks and vulnerabilities to ePHI (164.308(a)(1)(ii)(A)); periodic technical evaluation (164.308(a)(8)) | Scanning not named; commonly used to meet the risk-analysis and evaluation duties |
| GDPR | Controllers and processors of personal data | A process for regularly testing, assessing and evaluating the effectiveness of security measures (Article 32(1)(d)) | No method named; testing is required as an outcome, and scans and penetration tests are recognised means |
| CIS Controls v8 | Any organisation adopting the controls (best practice, not law) | Automated scans of internal assets, quarterly or more (safeguard 7.5); automated scans of externally-exposed assets, monthly or more and on new disclosure (7.6) | Explicit automated scanning with a named cadence |
| NIST SP 800-53 Rev 5 | US federal systems and organisations that adopt the catalogue | Monitor and scan for vulnerabilities at an organisation-defined frequency and on new disclosure (control RA-5) | Scanning named directly; frequency organisation-defined |
| PCI DSS v4.0.1 | Industry standard (not law); entities handling payment card data (the cardholder data environment) | Internal scans at least every three months (req 11.3.1), performed with authenticated scanning (req 11.3.1.2); external scans at least every three months by an Approved Scanning Vendor (req 11.3.2) | Explicit quarterly internal and external scanning |
Record asset discovery, assessment results, and remediation separately, with evidence for each activity.
Best practices for a hybrid scanning strategy
- Maintain discovery and review scope. Review newly discovered assets before adding them to active scans. Record exclusions and their reasons so an omitted system is not mistaken for an assessed one.
- Choose checks by sensitivity and access. Agree scope with the system owner and use authentication where it adds relevant coverage. A successful web login and credentialed operating-system assessment provide different access; confirm which your scanner supports.
- Track findings through follow-up. Consolidate duplicate detections, retain scan evidence, and record remediation or accepted risk. Use a supported retest to check a fix, and distinguish that result from a status someone changed manually.
Check scan completion, authentication failures, and exclusions before interpreting a falling finding count. Reduced coverage can hide weaknesses. Keep these checks within your vulnerability management lifecycle.
Frequently asked questions
Is Nmap active or passive?
Nmap's standard host discovery, port scanning, and service detection are active because they send packets to targets. A lighter scan still counts as active when it probes the system.
What are the two main types of vulnerability scans?
Active and passive describe scanning methods: probing a target or analysing existing observations. Authenticated and unauthenticated describe access, while internal and external describe vantage point.
Do NIS2, DORA or ISO 27001 require active or passive scanning?
None prescribes one method by name for every entity. DORA names vulnerability assessments and scans in its testing programme; NIS2's implementing regulation names scans "where appropriate" for covered sectors. ISO 27001 control A.8.8 requires exposure evaluation and action without prescribing a scanning method.
Is passive scanning safe for fragile or OT/ICS devices?
Passive network monitoring avoids adding probe traffic, making it useful for sensitive OT/ICS equipment. Active checks need device-specific planning, including vendor guidance, an agreed operating window, and a recovery path. External passive reconnaissance serves a different purpose and does not provide internal network traffic visibility.
How to combine active and passive scanning
Passive methods extend visibility without touching the target; active checks confirm which weaknesses are actually reachable. Match the mix to each system's sensitivity and scope, and keep evidence of what was discovered, assessed, and fixed. No framework mandates one method, so coverage, not the label, is what to defend.
Vornin combines passive external discovery with scoped active scanning as part of its attack surface monitoring, bringing findings and follow-up into one workflow. Its passive coverage is external reconnaissance; internal network traffic monitoring requires a separate capability.
Working scan data deleted after each scan · EU-hosted
