Scanning Overview

You can perform two types of scans using Tenable products: discovery scans and assessment scans. Tenable recommends performing discovery scans to get an accurate picture of the assets on your network and assessment scans to understand the vulnerabilities on your assets.

Configuring both methods provides a comprehensive view of the organization’s security posture and reduces false positives. For more information about Tenable Security Center Director scanning strategies, see the Tenable Security Center Scan Tuning Guide.

In Tenable Security Center Director, you can monitor the scans running on your managed Tenable Security Center instances. Tenable Security Center Director cannot run scans.

Tip: You can manage scan policy configurations for active scans on your managed Tenable Security Center instances from Tenable Security Center Director using the Tenable Security Center Director API. For more information, see the Tenable Security Center API Guide.

Scan Type Description Licensing
Discovery Scan

Find assets on your network. For example:

  • a scan configured with the Host Discovery template.
  • a scan configured to use only discovery plugins.
  • an Tenable Nessus Network Monitor instance in discovery mode.

Assets identified by discovery scans do not count toward your license.

Assessment Scan

Find vulnerabilities on your assets. For example:

  • an authenticated or unauthenticated active scan using a Tenable Nessus or Tenable Vulnerability Management scanner.
  • an agent scan using an agent-capable Tenable Vulnerability Management or Tenable Nessus Manager scanner.

Authenticated Active Scans

Configure authenticated scans, also known as credentialed scans, by adding access credentials to your assessment scan configuration.

Credentialed scans can perform a wider variety of checks than non-credentialed scans, which can result in more accurate scan results. This facilitates scanning of a very large network to determine local exposures or compliance violations.

Credentialed scans can perform any operation that a local user can perform. The level of scanning depends on the privileges granted to the user account. The more privileges the scanner has via the login account (e.g., root or administrator access), the more thorough the scan results.

For more information, see Credentials.

Unauthenticated Active Scans

If you do not add access credentials to your assessment scan configuration, Tenable Vulnerability Management performs a limited number of checks when scanning your assets.

In general, assets assessed by assessment scans count toward your license.

For more information about how discovered and assessed assets are counted towards your license, see License Requirements.