---
title: "Vulnerability Scan"
date: "2013-12-09T21:17:51+00:00"
url: "https://staging.checkmarx.com/glossary/vulnerability-scan/"
description: "Vulnerability scanning explained - what it is, the types of scanners, how scans work, and how scanning differs from assessment."
---

# Vulnerability Scan

A developer-first guide to vulnerability scanning across [SAST](https://checkmarx.com/cxsast-source-code-scanning/), [SCA](https://checkmarx.com/cxsca-open-source-scanning/), [DAST](https://checkmarx.com/checkmarx-dast/), and [IaC Security](https://checkmarx.com/product/iac-security/)—and how to operationalize it in CI/CD.

## Definition

A **vulnerability scan** is an automated check for known weaknesses and misconfigurations across your software surface – source code, third‑party packages, running web apps/APIs, and[ infrastructure as code](https://staging.checkmarx.com/glossary/infrastructure-as-code-iac/). In modern programs, scanning is continuous, shift‑left, and integrated with developer workflows to find and fix issues early.

## How a vulnerability scan works

1. **Discovery/Targeting** – enumerate repos, services, endpoints, IaC files, containers, and [SBOM](https://staging.checkmarx.com/product/sbom/)s.
2. **Automated analysis** – run the right engines:
    - **SAST** for insecure code/dataflows
    - **SCA** for CVEs, license risks, transitive deps
    - **DAST** for runtime issues in web apps/APIs
    - **IaC Security** for cloud misconfigurations
3. **Prioritization** – severity + exploitability + asset criticality
4. **Developer remediation** – actionable guidance in the IDE/PR with auto‑tickets
5. **Verification** – re‑scan, measure MTTR and fix rate

## Types of vulnerability scans (for AppSec)

- **SAST (code):** analyze source/build artifacts for insecure patterns. → *[Checkmarx SAST](https://checkmarx.com/cxsast-source-code-scanning/)*
- **SCA (open source):** detect vulnerable/licensed components; support SBOMs. → *[Checkmarx SCA](https://checkmarx.com/cxsca-open-source-scanning/)*
- **DAST (runtime):** scan live apps/APIs for auth/session flaws, injections, etc. → *[Checkmarx DAST](https://checkmarx.com/checkmarx-dast/)*
- **IaC Security:** validate Terraform/CloudFormation/Kubernetes and more pre‑deploy. → *[Checkmarx IaC Security](https://checkmarx.com/product/iac-security/)*

## Vulnerability scan vs. vulnerability assessment vs. pen test

- **Vulnerability scan:** automated, breadth‑first detection.
- **Vulnerability assessment:** adds expert review and risk context.
- **Penetration test:** human‑led exploitation to validate impact.
    See also: **[Vulnerability Assessments](https://staging.checkmarx.com/glossary/vulnerability-assessments/)** and [**VAPT** ](https://staging.checkmarx.com/glossary/vulnerability-assessment-and-penetration-testing/)(Vulnerability Assessment & Penetration Testing).

## Best practices & tips

- **Secure the pipeline:** sign artifacts, verify SBOMs, [scan containers.](https://staging.checkmarx.com/product/container-security/)
- **Shift left:** SAST/SCA on each PR; IaC/DAST on merges + nightly.
- **Right‑size rules:** tune rulesets, standardize suppressions.
- **Prioritize by exploitability:** severity + [reachability ](https://checkmarx.com/learn/software-composition-analysis/what-is-reachability-analysis/)+ criticality.
- **Fix in the IDE:** shorten feedback loops.
- **Own the backlog:** time‑box triage, auto‑ticket, track MTTR.

##  Key metrics

Fix rate (7/30/90‑day), **MTTR** by severity, exploitable/high‑severity backlog, scan **coverage** across repos/services, **false‑positive rate**, and **policy‑gate pass rate**.

## FAQ

###         Is a vulnerability scan the same as DAST?

No. [DAST](https://staging.checkmarx.com/checkmarx-dast/) is one type of vulnerability scanning focused on live web apps/APIs. Pair it with SAST, SCA, and IaC scanning for coverage.

###         How do we reduce noise and false positives?

Tune rules, enable reachability signals, standardize suppressions, and fix in‑IDE. Track false‑positive rate as a KPI.

###         Where should we start?

Start with SAST/SCA on PRs, then add DAST on main merges and IaC scanning for cloud posture.

**Next step:** See how [Checkmarx One](https://checkmarx.com/product/application-security-platform/) unifies SAST, SCA, DAST, IaC Security, and more – built for developers and AppSec to ship secure software faster.