Vulnerability Scanning

Vulnerability scanning uses automated tools to probe a target — a network range, a host, an application, or a container image — and identify security weaknesses by comparing what is found against a database of known vulnerabilities (CVEs) and misconfiguration signatures. Unlike penetration testing, vulnerability scanning is non-exploitative: it identifies potential weaknesses without actively exploiting them. Scans can be unauthenticated (external view, as an attacker would see the system) or authenticated (internal view, using credentials to inspect installed software versions and configuration details). Vulnerability scanning is a continuous activity, not a one-time exercise, because new CVEs are published daily.

The CRA requires manufacturers to monitor for vulnerabilities in their products and components and to address them without undue delay. Vulnerability scanning is the operational mechanism that makes continuous monitoring achievable at scale. Manufacturers who scan their products and infrastructure regularly can detect when a newly published CVE affects a component they ship, triggering the remediation process required by Annex I Part I(2)(f). Without automated scanning, manufacturers must rely on passive vulnerability intelligence feeds alone, which may not alert them to configuration-level weaknesses or locally hosted services with outdated software that scanning would immediately detect.

Manufacturers should implement vulnerability scanning across three distinct targets: (1) product software — scanning container images, firmware builds, and application packages for known CVEs using SCA and image scanning in CI/CD pipelines; (2) production infrastructure — scanning the servers, cloud infrastructure, and APIs that support the product's backend services; and (3) product-as-deployed — where possible, scanning deployed product instances to verify update take-up and identify configuration drift. Scan results should feed into a vulnerability management workflow with defined SLAs for remediation based on CVSS severity. Scan reports and remediation records form part of the evidence base for CRA technical documentation.

A common error is running vulnerability scans at fixed intervals — monthly or quarterly — and treating the results as current. The CVE disclosure rate means a scan that is two weeks old may miss critical vulnerabilities discovered after the scan date. Continuous or at minimum weekly scanning of internet-facing systems is the appropriate cadence for CRA-regulated products. Manufacturers also frequently scan only the production environment and miss development and staging environments that may contain vulnerabilities mirroring the production attack surface. Additionally, generating scan reports without a defined remediation process renders the scanning activity compliance theatre rather than meaningful security activity.