Key Takeaways
- The risk to your company: an unpatched website plugin, VPN or router can let attackers in without anyone clicking a link. HKCERT logged 469 vulnerable-system incidents in Hong Kong in Q3 2026 alone.
- Vulnerability scanning is an automated check that compares your systems against databases of publicly known flaws and ranks the findings by severity.
- Scan at least quarterly, and again after every major change or security alert that affects software you use.
- A scan finds known holes broadly; a penetration test goes deep and proves what an attacker could actually reach. Most businesses need both.
Your website, your office router and the VPN your staff use from home all run software. Every few weeks a new flaw in that software is made public, and automated attack tools often start hunting for it within days.
What is vulnerability scanning?
Vulnerability scanning is an automated security check that compares your websites, servers, network devices and cloud settings against databases of publicly known weaknesses, then reports each finding ranked by severity. Think of a building inspector walking every floor with a list of lock models known to be faulty.
A vulnerability is a flaw in software or configuration that someone can misuse: an outdated plugin, a default password, an open management port. Most are catalogued as CVEs (Common Vulnerabilities and Exposures), public IDs such as CVE-2026-109618, and scored from 0 to 10 with CVSS (the Common Vulnerability Scoring System).
How does vulnerability scanning work?
A scanner first discovers what you have online, then identifies the software and version on each system, matches them against known-flaw databases, checks for common misconfigurations and finally scores and reports the findings. The whole cycle can run automatically every week or every month.
A Hong Kong example. On 22 October 2026, HKCERT warned of two critical flaws in PHP, nicknamed PHP2Shell. PHP runs many company websites and WordPress sites. HKCERT also pointed out that PHP is built into the management pages of some network, security and storage products, so a company could patch its web server and still be exposed through a forgotten device. Finding that forgotten device is exactly what a scan is for.
The five steps of a typical scan
- Discovery: find every IP address, domain and open port in scope
- Fingerprinting: identify the software and version running on each one
- Matching: compare those versions against CVE databases and vendor advisories
- Configuration checks: weak encryption, default passwords, exposed admin pages
- Reporting: rank findings as Critical, High, Medium or Low, with fix advice
What are the types of vulnerability scans?
The main types are external scans of internet-facing systems, internal scans of the office network, web application scans that test websites for flaws such as SQL injection, authenticated scans that log in for a deeper view, and cloud configuration scans. Most small businesses should start with external and web application scans.
| Scan type | What it checks | Who needs it first |
|---|---|---|
| External | Website, VPN, firewall and email server as seen from the internet | Every business |
| Web application | Login pages, forms and plugins; OWASP Top 10 issues such as SQL injection | Anyone with a website, online shop or customer portal |
| Internal | Office PCs, file servers, printers and Wi-Fi | Firms with 20 or more staff or a server room |
| Cloud configuration | Public storage buckets and over-broad permissions | Teams on AWS, Azure, Google Cloud or Microsoft 365 |
How can you tell your systems may be vulnerable?
Warning signs include devices or software that no longer receive updates, a website nobody has patched for months, admin pages reachable from the internet, a router or VPN more than five years old, and nobody who can list every system the company exposes online. Any one of these justifies a scan.
Old equipment matters more than most owners think. VulnCheck research cited by HKCERT found that 42.5% of the exploited network-edge flaws it studied affected end-of-life or likely end-of-life products, rising to 65% among flaws used by botnets.
Every main way in, not just the famous one
- Website and CMS plugins: WordPress, PHP, online shop add-ons
- Network-edge devices: VPN, firewall, router, NAS storage
- Remote access tools opened during the pandemic and never closed
- Cloud accounts and shared storage links set to public
- Staff laptops and phones running outdated systems
How do you protect your business from known vulnerabilities?
Keep an up-to-date list of every system, switch on automatic updates, replace devices that no longer get patches, scan at least quarterly and after major changes, and fix Critical and High findings first. Individuals should update phones and laptops promptly; IT teams should own a clear patch timetable.
For individuals and every staff member
- iPhone: Settings > General > Software Update > Automatic Updates > turn on both options
- Android (Google Pixel): Settings > System > Software updates; Samsung: Settings > Software update > Download and install
- Windows: Settings > Windows Update > turn on "Get the latest updates as soon as they're available"
Menu paths checked in November 2026; names can differ slightly by model and system version.
For SMEs and IT teams
- Keep an asset list: every domain, IP address, device and cloud account, each with a named owner
- Scan externally at least once a quarter, and again after launches, major changes or a new HKCERT alert
- Patch Critical findings within days, not at the next quarterly meeting
- Restrict admin pages to known IP addresses and protect them with multi-factor authentication
If you take card payments, the PCI DSS standard expects quarterly external scans by an approved scanning vendor. Operators designated under Hong Kong's critical infrastructure law (Cap. 653, in force since 1 January 2026) must include vulnerability assessment and penetration testing in their annual risk assessment, according to Tanner De Witt's summary of the Code of Practice.
A company scenario: the fake "scan failed" invoice
Scanning creates its own scam opening. A finance clerk receives an email that looks like it comes from the company's IT vendor: "Your website failed this month's vulnerability scan. Pay HK$18,000 today for an emergency patch or your site will be blacklisted." An hour later a WhatsApp message from "the boss" says to pay it quickly. Both are fake.
Company rule: no payment for any "urgent security fix" until finance has called the vendor and the boss on a number already on file, never one given in the message.
Team notice (security)
1. Our website and systems are scanned for security flaws on a schedule. Nobody will ask you to pay for an "urgent fix" by email or WhatsApp.
2. Any request to pay a security vendor must be confirmed by phone, on a number we already have.
3. Please turn on automatic updates on your phone and laptop today.
4. Not sure? Forward it to IT before you click or pay.What should you do if a scan finds a critical vulnerability?
Confirm the finding, then patch or apply the vendor's workaround within days, and cut the system off from the internet if you cannot patch yet. Next, check whether it was already exploited: new admin accounts, unusual logins or changed files. If you suspect a breach, report it to HKCERT.
- Patch now, or follow the vendor's temporary mitigation; for PHP2Shell, HKCERT advised isolating internet-facing apps that could not be patched immediately
- Rescan to confirm the fix worked
- Look for signs of compromise: unknown accounts, configuration changes, unusual traffic
Who to contact in Hong Kong
- HKCERT incident hotline 8105 6060, or the online incident report form
- Anti-Scam Helpline 18222 if a fake vendor or payment request is involved; check numbers and links first with Scameter
- The Office of the Privacy Commissioner for Personal Data (PCPD) if customer or staff personal data may have been accessed: assess whether to notify, and record the decision
What is the difference between vulnerability scanning and penetration testing?
A vulnerability scan is automated and broad: it lists known weaknesses across many systems quickly and at low cost. A penetration test is manual and deep: ethical hackers try to chain weaknesses together to prove what an attacker could actually reach. Common practice is quarterly scans plus a yearly penetration test.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated tools | Skilled testers, assisted by tools |
| Coverage | Wide: many systems at once | Narrow: chosen targets |
| Depth | Known flaws and misconfigurations | Chained attacks and business-logic flaws |
| Frequency | Monthly to quarterly | Yearly, or before major launches |
Find the holes before someone else does
Vulnerability scanning is not a one-off project. It is a routine, like a fire drill, that stops a growing list of systems from quietly drifting out of date. The flaw that hurts is rarely the newest one; it is the one on the device nobody remembered.
Your 60-second self-check
- Can someone name every website, VPN and router your company exposes online?
- Are automatic updates on for all staff phones and laptops?
- Has every internet-facing system been scanned in the last three months?
- Is any device past its vendor's end of support?
- Does finance verify "urgent security fix" payments by phone?
Get a clear list of what to fix
UD engineers run commercial-grade scans of your websites, servers and cloud assets, remove false positives and explain every finding in plain language, so your team knows exactly what to patch first.
Get a Vulnerability Scan Quote
Frequently Asked Questions
How much does a vulnerability scan cost?
Cost depends on how many websites, IP addresses and servers are in scope and how often you scan. An external scan of a small business website usually costs far less than a penetration test, so ask for a scoped quote rather than comparing flat prices.
Will a vulnerability scan slow down or crash my website?
A well-configured scan uses low-intensity settings and can run outside business hours. Older or fragile systems can be scanned in a test copy first.
Can I use a free vulnerability scanner?
Yes. Free tools such as OpenVAS are a reasonable start for internal checks. The trade-off is more false positives and more staff time to interpret results, and PCI DSS requires external scans by an approved vendor.