Glossary
Authenticated scanning
Vulnerability assessment performed with credentials, so the scanner can inspect installed software and configuration directly.
Authenticated (or credentialed) scanning means the scanner logs in to the target — over SSH, SMB/WinRM or an API — and inspects installed packages, file versions, registry settings and configuration. Unauthenticated scanning, by contrast, only sees what the system exposes on the network, such as open ports and service banners.
Authenticated results are far more accurate. They detect client-side software, understand vendor backports that do not change version strings, and produce fewer false positives. The trade-off is operational: credentials must be provisioned with least privilege, stored securely, rotated and monitored, and failed authentications must be tracked, because a scan that silently falls back to unauthenticated checks is a coverage gap.
For a VOC, authenticated coverage is one of the most important quality metrics. See vulnerability scanning strategy.