Vulnerability Scan

A vulnerability scan is an automatic check for weaknesses that are already known. A program visits your website or application the way a visitor would, tries a long list of problems that have caught other people out, and hands back a report. It takes minutes or hours, costs little, and can be repeated as often as you like.

It is good at the known and the boring. Software left three versions out of date with a published hole in it. A login page that allows unlimited guesses. A backup file sitting in a public folder. A test page from last year still live, with real customer names in it. These are the doors ordinary businesses get broken into through, because attackers run scanners too, and they scan everyone, not only the interesting ones.

What it misses is anything needing judgement. A scanner cannot tell that a customer can change one number in the address bar and read someone else's invoice. It does not know your discount can be claimed twice. It cannot see that a new receptionist can reach the salary screen. Those are business mistakes, not software faults, and only a person testing by hand finds them. That test costs many times more and takes a week, and it is worth it before a system starts handling money or health data. Linkysoft treats the two as different jobs and prices them separately in a cybersecurity project.

How often is the easy part. Run one after every change you release, and once a month even when nothing changed, because the list of known weaknesses grows while your code stands still. A scan is only true for the day it ran. One clean report in a drawer from last March tells you nothing about this morning.

Be ready for the report to be noisy. Half of what a scanner reports is either wrong or harmless in your case, and deciding which half is the real skill. That is where the money goes, not the scan itself. The cost difference is worth remembering. A scan is cheap. Being told by a customer that your site is showing other people's orders costs you that customer, everyone they tell, and the week you spend answering. Linkysoft runs a scan before every handover of a web application and reads the report with the client, line by line.