I am confused about Operating Systems scanner vs Network Scanner. Usually a network scanner such as Nessus can already check for operating systems vulnerability. So what does an operating system scanner do? Any ideas? thanks.

  • 1
    If Nessus is a "network scanner", what's an example of an "operating system scanner"?
    – schroeder
    Jan 20, 2015 at 20:56

1 Answer 1


A network scanner interrogates the target over the network:

  • determines open ports via (semi-)exhaustive search
  • determines software and versions, if possible, based on banners and behavior
  • checks for known vulnerabilities (e.g., does /CFIDE/administrator exist)

but it is limited by only having network access. The banner printed on port 22 will identify the SSH version, but this can be misleading - if the OS vendor has backported security fixes (common practice), then the banner may indicate an older, vulnerable version when in fact the software is newer enough to be invulnerable to those issues.

An operating system scanner uses local credentials to access the system from the inside.

  • determines listening ports looking at the OS tools (e.g. netstat)
  • queries exact software installations and versions
  • queries installed patches and file versions to see if vulnerabilities are patched

The operating system scanner is much more complete and accurate as a result.

There are a number of scanners that fall into this category to various degrees. I can't recommend one (so many and so different) but they fall into two main categories:

Scanners or scanning services that performs "authenticated", "trusted", or "credentialed" scans; these will generally check OS configuration, patches, and installed software.

Tools which authenticated users run locally:

  • Microsoft Baseline Security Analyzer (checks versions and patches for MS products)
  • Qualys BrowserCheck (checks browsers, limited (web-related) software, OS patches, and certain OS configuration details like firewall and AV configured)

This latter "tools" category tends to be more limited in scope; for the fullest coverage, look for a scanner that supports either enterprise or cloud-based scope. (Arguably no one is going to sink the time and money into a tool that they sell for individual system users; the money is in the people who need to use it to protect entire networks).

  • What do you mean by "if the OS vendor has backported security fixes"?
    – Motivated
    Dec 29, 2018 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .