Vulnerability scanning is the process of using automated tools to find security weaknesses in your computers, servers, and network equipment. It is the digital equivalent of a security guard walking around a building, checking every door handle and window latch to see if anything is unlocked. For a UK SME, these 'unlocked windows' are usually outdated software, misconfigured settings, or forgotten devices that provide an easy entry point for attackers.
We find that many business owners confuse a vulnerability scan with a penetration test. A penetration test is a manual, human-led attempt to break into your systems to see how far an intruder could get. A vulnerability scan is a high-speed, automated search for known flaws. It does not try to exploit the flaw; it simply reports that the flaw exists. Because the threat landscape moves so quickly, with thousands of new vulnerabilities discovered every year, a one-off annual check is no longer enough. Modern security requires a continuous approach.
The difference between looking at the front door and looking inside the office
There are two primary types of scans that every small business should understand: external and internal. They serve different purposes and catch different types of risks.
An external vulnerability scan looks at your business from the perspective of someone on the internet. It probes your 'perimeter', your firewall, your website, your email servers, and any remote access tools like a VPN (Virtual Private Network). These scans are critical because they identify the flaws that a random attacker could find without having any prior access to your business. If an external scan finds an unpatched hole in your firewall, you are essentially leaving the front door wide open.
An internal vulnerability scan happens from within your network. This tool looks at the devices that sit behind your firewall: staff laptops, office printers, internal servers, and even smart devices like Wi-Fi lightbulbs or CCTV cameras. This is vital because many attacks start with a phishing email that compromises a single laptop. Once an attacker is 'inside', they will look for other unpatched devices to spread their reach. An internal scan helps you find these internal weaknesses before an intruder does.
Why your first scan might report 5,000 issues
When we run a scan for a new client, it is common for the report to return thousands of individual findings. For a business owner, this is overwhelming. However, most of these findings are not immediate 'house-on-fire' emergencies. A single out-of-date version of Google Chrome on twenty different laptops might show up as sixty separate vulnerabilities because that version of Chrome has sixty known flaws.
A pattern we see on most tenants we take on is the presence of ghost applications, software installed for a one-off project years ago that has not been updated since, creating a permanent backdoor that no one is monitoring. This is exactly what happened in this case study of a Brighton recruitment consultancy, where we found 12,000 open vulnerabilities because patch management had been ignored for years.
The goal of vulnerability scanning is not to reach 'zero' findings, that is impossible in a live business environment. The goal is to identify the 'Critical' and 'High' risks that are actually being exploited in the real world and fix those first. This is where patch prioritisation becomes the most important part of the process.
Moving from CVSS scores to real-world exploitability
Most scanning tools use the Common Vulnerability Scoring System (CVSS) to rank flaws from 0.1 to 10.0. A score of 9.0 or higher is usually labelled 'Critical'. While this is a useful starting point, it does not tell the whole story. A vulnerability might be technically critical but require physical access to the server room to exploit, making it a low practical risk for an SME.
We prioritise fixes based on exploitability. We look for vulnerabilities that are 'wormable' (meaning they can spread automatically from computer to computer) or those that have 'exploit code' available publicly. If a hacker can download a ready-made tool to attack a specific flaw in your system, that flaw moves to the top of the list, regardless of its technical score.
By focusing on the small number of flaws that attackers are actually using, we can reduce a business's risk by 80% or 90% in a few days, even if the total 'count' of vulnerabilities still looks high. This is a core part of our managed cyber security services, where we handle the noise so you only see the risks that matter.
A hypothetical cost of ignoring the open windows
To understand the commercial impact, consider a hypothetical UK firm with 30 employees. If an unpatched vulnerability in their VPN allows a ransomware attacker to encrypt their files, the costs escalate quickly in GBP.
Assuming an average salary and overhead cost of £300 per day per employee, the business loses £9,000 in productivity for every day the systems are down. If it takes three days to restore from backups and verify that the attacker is gone, that is £27,000 in lost time alone. This does not include the cost of emergency IT support, potential ICO (Information Commissioner's Office) fines if personal data is breached, or the reputational damage when clients cannot reach you.
A managed vulnerability scanning programme costs a tiny fraction of that potential loss. It moves security from an emergency expense to a predictable, manageable operational cost.
Five common scanning errors we find in UK SMEs
- Scanning without a plan for remediation. A scan report that sits in an inbox is useless. You must have a process for who will apply the patches and when. Our RMM (Remote Monitoring and Management) tooling handles this 24/7, but the helpdesk reviews the results during office hours to ensure nothing was missed.
- Ignoring the 'Low' and 'Medium' risks. While 'Criticals' come first, attackers often chain several 'Medium' flaws together to gain full control of a system. A 'Medium' flaw that allows an attacker to see a list of usernames is a much bigger deal if you do not have MFA (Multi-Factor Authentication) turned on.
- Scanning only the servers. In the modern office, the server is often the most secure thing in the room. The real risks are the laptops that staff take home, where they might connect to insecure Wi-Fi or skip an update for three weeks.
- Forgetting 'Shadow IT'. This includes the NAS drive someone bought for extra storage or the smart TV in the boardroom. If it is on your network, it needs to be scanned.
- Relying on 'set and forget' tools. Automated tools are great, but they can produce false positives. Sometimes a tool thinks a vulnerability exists when a different security layer is already blocking it. You need an engineer to look at the data and decide what is a real threat.
Common questions about vulnerability management
How often should we run a vulnerability scan?
For most UK SMEs, we recommend running external scans monthly and internal scans at least quarterly. However, if you are working towards Cyber Essentials certification, you will need to demonstrate that all 'High' and 'Critical' vulnerabilities are patched within 14 days of release. For businesses with high-security requirements, we move to continuous scanning that alerts us the moment a new flaw is detected.
Will a scan slow down our office internet or computers?
Modern vulnerability scanners are designed to be 'non-intrusive'. They send small, specific packets of data to test responses. While a very old or poorly configured device might occasionally struggle, a standard office network will not notice any performance dip during a scan. We typically schedule these during office hours so we are available to help if a device does react unexpectedly.
Is vulnerability scanning enough to stop a hack?
No. It is one layer of a proper defence. Scanning finds the holes, but patch management is what actually plugs them. You also need antivirus, MFA, and employee training. Think of the scan as the map that tells you where the holes are; you still need to do the work of filling them in.
Do I need a scan if I use Microsoft 365 for everything?
Yes. Even if your files are in the cloud, your staff are still using physical laptops, tablets, and phones to access them. If those devices have vulnerabilities, an attacker can steal the 'session token' from the browser and bypass your security entirely. Your local network and devices are still the most common entry points for cyber criminals.
How Black Sheep Support secures your business
We do not just hand you a 50-page PDF of problems and walk away. We integrate vulnerability scanning into our daily managed support. We find the flaws, we prioritise them based on real-world risk, and we apply the fixes through our automated systems. This ensures your business stays compliant with standards like Cyber Essentials and GDPR without your team having to become security experts.
If you want to know exactly what is currently 'unlocked' in your network
and we will discuss how to get your first scan running.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers, or 15 to 20 minutes on your own, no commitment. We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is built to be secure from the ground up.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
