Vulnerability Scanning for Small Business: A Plain Guide

A vulnerability scan is an automated check of your devices and network for known weaknesses: missing updates, exposed services, default passwords, and unsafe settings. It produces a ranked list of things to fix. It is not a penetration test, in which a person actively tries to break in. For most small offices a sensible rhythm is an external scan of anything facing the internet every month or quarter, an internal scan every quarter, and a fresh scan after any significant change. Some businesses are required to scan on a set schedule, covered below.

What Is a Vulnerability Scan?

A scanner is software that looks at each system and compares what it finds to a database of publicly known flaws, each with a severity score. There are two vantage points:

• External scan. Run from the internet against your public IP addresses. It shows what a stranger can see: open ports, remote access services, an old firewall login page.
• Internal scan. Run from inside the network. It finds unpatched computers, printers with default passwords, forgotten devices, and old protocols still switched on.

Internal scans can be unauthenticated (the scanner only sees what is visible on the network) or authenticated (the scanner signs in to each system and reads installed software versions directly). Authenticated scans find far more and produce fewer false alarms.

NIST’s SP 800-115, Technical Guide to Information Security Testing and Assessment is the standard reference for how these techniques fit together.

Vulnerability Scan vs. Penetration Test: What Is the Difference?

	Vulnerability scan	Penetration test
Done by	Automated tool, reviewed by a person	A qualified tester, using tools and manual technique
Goal	List known weaknesses	Show what an attacker could actually reach by chaining weaknesses together
Disruption	Low. It identifies issues without exploiting them	Controlled, but it does attempt exploitation
Frequency	Monthly or quarterly, and after changes	Usually once a year or before a major audit
Cost	Low enough to repeat	A scoped professional engagement, priced by quote
Output	Findings ranked by severity	A narrative report with proof of what was reached

The two answer different questions. A scan asks “what is wrong?” A penetration test asks “how far could someone get?” Scanning comes first, because paying a tester to find missing patches a scanner would have caught is poor value.

Who Requires Vulnerability Scanning?

Check the exact wording of whatever applies to you. These are the rules that most often reach small businesses.

PCI DSS (if you accept cards)

PCI DSS v4 Requirement 11.3 requires internal vulnerability scans at least once every three months and external scans at least once every three months by a PCI Approved Scanning Vendor (ASV), plus scans after significant changes. Requirement 11.4 requires internal and external penetration testing at least once every 12 months.

Whether those requirements apply to you depends on how you take cards and which self-assessment questionnaire (SAQ) you complete. The PCI Security Standards Council explains that version 4 added ASV scans to SAQ A for e-commerce merchants whose site redirects to or embeds a third party’s payment page. Your payment processor or acquiring bank can tell you which SAQ you fall under. The standard and SAQs are in the PCI SSC document library, and our PCI DSS overview covers the basics.

FTC Safeguards Rule (tax preparers, mortgage brokers, and other non-bank financial businesses)

The FTC’s guidance says covered businesses must either run continuous monitoring or conduct annual penetration testing plus vulnerability assessments, including system-wide scans, every six months. Under 16 CFR 314.6, that testing schedule does not apply to businesses that maintain customer information on fewer than 5,000 consumers, though the duty to protect the data still does. See our Safeguards Rule guide.

HIPAA (medical and dental practices and their business associates)

The Security Rule does not name a scan frequency. It requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic patient information (45 CFR 164.308) and periodic technical evaluation. A scan report is a practical way to feed that risk analysis with facts. More in our HIPAA IT guide.

Cyber insurance and client questionnaires

Applications and renewal forms vary by insurer. If yours asks about vulnerability scanning or patch timelines, answer from real reports. An external scan shows you what anyone on the internet, including an underwriter, can see about your network. Read our cyber insurance guide for how to prepare.

How Often Should a Small Business Scan?

Situation	External scan	Internal scan
No regulatory requirement, mostly cloud apps	Quarterly	Twice a year
Sensitive client, patient, or financial data on site	Monthly	Quarterly
PCI DSS scanning requirements apply	At least every three months by an ASV	At least every three months
After a new firewall, server, remote access tool, or office move	Right away	Right away

These are reasonable defaults, not rules. The point is that a scan is a snapshot, and new vulnerabilities are published constantly, so a once-a-year scan goes stale quickly.

What Does a Scan Cost?

Scanner licensing ranges from free open-source tools to commercial products priced per device or per address, and ASV services for PCI are priced by each vendor. Prices vary enough that you should get current quotes.

One free option is worth knowing about. CISA’s Cyber Hygiene vulnerability scanning continuously scans your internet-facing addresses at no cost and sends weekly reports. It is open to U.S. government bodies and to public and private critical infrastructure organizations, a category that includes sectors such as healthcare and financial services. You enroll by email, and CISA says scanning typically starts within three business days. It covers external exposure only, so it complements an internal scan and does not replace one.

What to Do With the Results

A first scan of a network that has never been scanned can return a long list. Work through it in this order:

1. Confirm the inventory. Does the scan show devices nobody recognizes? Identify them before anything else.
2. Fix what faces the internet first. Exposed remote desktop, old VPN firmware, and admin pages open to the world outrank everything inside.
3. Check findings against CISA’s Known Exploited Vulnerabilities Catalog. CISA recommends using it as an input to prioritization. A flaw that attackers are already using jumps the queue, whatever its score.
4. Choose the fix. Most findings come down to applying a patch, changing a setting, or replacing a device that no longer gets updates. A solid patch management routine shrinks the next report.
5. Isolate what cannot be fixed. Put unsupported equipment on its own network segment until it is replaced. See network segmentation.
6. Document exceptions. If you accept a risk, write down why and who approved it.
7. Rescan. Confirm the fix worked. PCI DSS explicitly requires rescans, and it is good practice for everyone.

Keep each report. A series of reports showing findings going down is the simplest evidence of a working security program.

Common Mistakes

• Filing the report without acting on it.
• Scanning only from outside. An external scan cannot see unpatched computers and devices inside the network.
• Running unauthenticated internal scans only, then assuming a short report means a clean network.
• Scanning during business hours without warning. Scans are low risk, but older printers and specialized equipment can misbehave. Schedule them and tell staff.
• Scanning addresses you do not own. Get written permission before scanning anything hosted by a third party, including your website host.
• Treating a passing scan as proof of security. Scanners find known flaws. They do not find a reused password or a convincing phishing email.

When You Do Not Need a Formal Scanning Program

If your business runs entirely on cloud services, has no servers, no open inbound ports, and a handful of automatically updated laptops, the scanner will have little to look at. In that case an endpoint security product that reports missing updates plus an occasional external check of your router may be enough. The picture changes as soon as you host anything on site, open remote access, or fall under one of the requirements above.

Common Questions

Will a vulnerability scan take our systems down?

It is unlikely. Scans identify weaknesses without exploiting them, and most modern equipment handles them without trouble. Older printers, phone systems, and specialized devices are occasionally sensitive to scanning traffic. Run the first scan outside busy hours, exclude anything fragile, and add it back once you know how it behaves.

Can we run scans ourselves?

Yes. Free and commercial scanners are available, and running one is not difficult. The harder parts are setting up authenticated scanning correctly, separating real risk from noise in the results, and making the fixes. Note that PCI external scans must be performed by an Approved Scanning Vendor, so self-run scans do not satisfy that specific requirement.

Is a vulnerability scan the same as a risk assessment?

No. A scan is a technical input. A risk assessment also looks at what data you hold, who can reach it, how you would recover, and which threats matter most to your business. Frameworks such as the NIST Cybersecurity Framework treat scanning as one source of information among several.

Do we need a penetration test as well?

Only if a rule, contract, or insurer requires it, or once the basics are consistently in place and you want to test them. If regular scans still show missing patches and exposed services, fix those first. A penetration test is most useful when the easy findings are already gone.

How We Can Help

Coastal Growth Co. can run internal and external scans, explain the findings in plain English, fix the items that are within agreed scope, and rescan to confirm. It can be a one-time assessment or part of ongoing managed IT support, and we can point you to an Approved Scanning Vendor if PCI applies. Scope and price are agreed before paid work begins. Contact us to discuss your setup.