Vulnerability Scan

A vulnerability scan is an automatic check for weaknesses that are already known. A program visits your website or application the way a visitor would, tries a long list of problems that have caught other people out, and hands back a report. It takes minutes or hours, costs little, and can be repeated as often as you like.

It is good at the known and the boring, which is where ordinary businesses actually get caught. The list runs from software three versions out of date with a published hole in it, to a login page that allows unlimited guesses. It also picks up a backup file in a public folder, or a test page from last year still live with real customer names. These are the doors ordinary businesses get broken into through, because attackers run scanners too, and they scan everyone rather than only the interesting ones.

What it misses is anything needing judgement, because a scanner cannot tell that a customer can change one number in the address bar and read someone else's invoice. It does not know your discount can be claimed twice, or that a new receptionist can reach the salary screen. Those are business mistakes rather than software faults, so only a person testing by hand finds them. That test costs many times more and takes a week, but it is worth it before a system handles money or health data. Linkysoft therefore treats the two as different jobs and prices them separately in a cybersecurity project.

How often is the easy part, so run one after every change you release, and once a month even when nothing changed. The reason is that the list of known weaknesses grows while your code stands still, so a scan is only true for the day it ran. One clean report in a drawer from last March tells you nothing about this morning.

Be ready for the report to be noisy, because half of what a scanner finds is wrong or harmless in your case. Deciding which half is the real skill, and that is where the money goes rather than on the scan itself. The cost difference is worth remembering, because a scan is cheap. Being told by a customer that your site is showing other people's orders costs you that customer, everyone they tell, and the week you spend answering. Linkysoft runs a scan before every handover of a web application and reads the report with the client, line by line.