This is the question most Sydney businesses need answered before they can make a confident decision about their security testing program.

Vulnerability scanning is automated, broad, and continuous. It identifies known weaknesses across your entire environment by comparing system configurations against databases of known CVEs and misconfigurations. It runs on a schedule – weekly, daily, or continuously – and produces an ongoing picture of your security posture. It does not attempt to exploit what it finds.

Penetration testing is manual, targeted, and episodic. A certified engineer actively attempts to exploit vulnerabilities, chain multiple weaknesses together, and demonstrate real-world business impact. Penetration testing finds what automated scanners miss – business logic flaws, complex attack chains, and vulnerabilities that require human creativity to discover. It is typically conducted annually or after major infrastructure changes.

The right answer for most Sydney businesses: start with vulnerability scanning to establish a continuous baseline, then conduct penetration testing annually – or when scanning results identify clusters of high-severity findings that warrant deeper manual investigation.

Code Hyper One delivers both services under one roof, meaning vulnerability scanning findings directly inform the scope and focus of your penetration testing engagement – producing a more efficient, more targeted test and a more cost-effective overall security testing program. For the full comparison, read our guide: Penetration Testing vs Vulnerability Scanning: What's the Difference.

1. External Network Vulnerability Scanning

External scanning examines every internet-facing asset your business exposes to the public: web servers, mail servers, VPN gateways, remote desktop services, DNS infrastructure, load balancers, and any service with a public IP address or domain.

This mirrors exactly what attackers see – a list of publicly accessible services, each tested against thousands of known vulnerabilities. A single unpatched internet-facing service is frequently the entry point for ransomware, data theft, and account compromise.

What external scanning identifies:

• Unpatched operating systems and services on internet-facing hosts
• Exposed administrative interfaces (RDP, SSH, Telnet, management consoles) with no IP restriction
• Outdated web server and CMS software (WordPress, Joomla, Drupal) with known exploits
• SSL/TLS weaknesses – expired certificates, weak cipher suites, deprecated protocol versions (SSLv3, TLS 1.0)
• Open ports and services that should not be publicly accessible
• Email server misconfigurations that enable spoofing (SPF, DKIM, DMARC failures)
• Publicly exposed databases, storage buckets, and APIs without authentication
• Forgotten or unmaintained internet-facing assets discovered through subdomain enumeration

External scanning runs continuously – any new vulnerability affecting your existing software stack is flagged as soon as it is added to the CVE database, not at your next scheduled assessment.

Internal scanning examines your full internal network: workstations, servers, switches, routers, printers, access points, NAS devices, and every other network-connected device inside your environment. This reveals what an attacker would find after gaining a foothold through a phishing email, a compromised external service, or a rogue device.

Internal scanning is consistently more alarming than external scanning for most Sydney businesses – because internal networks are typically configured for convenience and operational speed, not security.

What internal scanning identifies:

• Unpatched Windows and macOS workstations across your entire fleet
• Servers running outdated operating systems or end-of-life software
• Network devices (switches, routers, firewalls) with default or weak credentials
• Unnecessary services running on internal hosts that expand attack surface
• Unencrypted protocols on the internal network (Telnet, FTP, HTTP for administrative access)
• Devices with weak or no local authentication configured
• Misconfigurations in Active Directory that create privilege escalation paths
• Legacy and unsupported operating systems still active on the network

Combined with our Datto RMM platform, critical internal scan findings trigger automated patch deployment where possible – meaning the scan-to-remediation cycle completes without manual intervention for known, patchable vulnerabilities.

This is the quality distinction most vulnerability scanning providers do not explain clearly – and it has an enormous impact on the accuracy and completeness of your results.

Unauthenticated scanning probes your systems the way an attacker without credentials would. It identifies vulnerabilities visible from outside an authenticated session: exposed services, open ports, and publicly known issues. It is fast and useful for a high-level external view – but it misses the majority of vulnerabilities that exist on your systems.

Authenticated scanning provides the scanner with read-only credentials to log into each system it tests. Once authenticated, it can examine installed software versions, patch levels, registry configurations, service settings, local user accounts, and file system permissions – finding vulnerabilities completely invisible to an unauthenticated scan. Studies consistently show authenticated scanning finds between three and ten times more vulnerabilities against the same systems.

Code Hyper One uses authenticated scanning as the standard for all internal network assessments – ensuring you receive a complete, accurate picture of your exposure rather than a surface-level view that creates false confidence.

Traditional network-based scanning only finds devices that are on the network when the scan runs. In a hybrid working environment where staff laptops spend days or weeks off the corporate network, this creates invisible blind spots – devices with critical unpatched vulnerabilities that never appear in scan results.

Agent-based scanning installs a lightweight scanning agent on each managed endpoint. The agent reports vulnerability status continuously regardless of where the device is located – at the office, at home, at a client site, or on the road. Every device in your fleet is assessed, all the time, regardless of network location.

For Sydney businesses with remote staff, this is delivered through our Datto RMM agent – the same lightweight software handling patch management and device monitoring – creating a unified endpoint platform where device health, patch status, and vulnerability posture are visible in a single dashboard. This aligns directly with the endpoint hardening controls outlined in our endpoint hardening checklist.

Web application scanning tests your customer-facing websites, internal web applications, APIs, and cloud-hosted portals for application-layer vulnerabilities – a category of weakness that network scanning cannot identify because it operates at a different layer of the technology stack.

What web application scanning identifies:

• OWASP Top 10 vulnerabilities: SQL injection, cross-site scripting (XSS), broken authentication, insecure direct object references, security misconfiguration, and sensitive data exposure
• Outdated web frameworks, plugins, and libraries with known exploits
• Missing security headers (Content Security Policy, X-Frame-Options, HSTS)
• Exposed administrative interfaces and unprotected login pages
• Insecure cookie configurations (missing Secure, HttpOnly, or SameSite flags)
• Server and framework version disclosure in HTTP headers and error messages
• Input validation failures across forms and API endpoints

Web application scanning complements but does not replace web application penetration testing – automated scanning identifies known vulnerability patterns while manual pen testing finds the logic flaws and custom vulnerabilities that no scanner can detect.

Cloud configuration scanning assesses your Azure, Microsoft 365, and cloud infrastructure settings against established security benchmarks, identifying deviations that create data exposure or unauthorised access risk.

What cloud configuration scanning identifies:

• Microsoft 365 tenant misconfigurations: over-permissive sharing settings in SharePoint and OneDrive, mailbox delegation abuse, external access policies that are too permissive
• Microsoft Entra ID misconfigurations: missing MFA, legacy authentication protocols enabled, guest account sprawl, over-privileged admin accounts
• Microsoft Defender gaps: security features licensed but not enabled or misconfigured
• Azure resource exposure: publicly accessible storage accounts, overly permissive network security groups, missing diagnostic logging
• Service principal and application registration misuse: applications with excessive permissions in your M365 tenant
• CIS Microsoft 365 Foundations Benchmark deviations

For a comprehensive assessment of your cloud security posture, see our cloud security assessment service.

Vulnerability scan reports intimidate many business owners and non-technical managers – pages of CVE numbers, CVSS scores, and technical remediation steps that are difficult to prioritise without context. Part of Code Hyper One's managed scanning service is ensuring every finding is understandable and actionable.

CVSS Severity Ratings – What They Actually Mean

Every vulnerability in your scan report is rated using the Common Vulnerability Scoring System (CVSS 3.1), a standardised framework for assessing vulnerability severity from 0.0 to 10.0:

Critical (9.0–10.0) Vulnerabilities exploitable remotely without authentication, leading to full system compromise or sensitive data access. Remediate immediately – within 24–48 hours. Examples: unauthenticated remote code execution on internet-facing services.

High (7.0–8.9) Serious vulnerabilities requiring limited authentication or specific conditions, leading to significant data exposure or system compromise. Target remediation within 2–7 days.

Medium (4.0–6.9) Vulnerabilities requiring specific conditions to exploit or serving as stepping stones in chained attacks. Address within 30 days as part of regular patching cycles.

Low (0.1–3.9) Minor weaknesses with limited exploitability or impact in isolation. Resolved in routine maintenance without urgency.

Informational (0.0) Configuration observations and best-practice deviations without direct vulnerability status. Addressed in security improvement projects.

Environmental Context – Why Raw CVSS Scores Are Not Enough

A CVSS score measures intrinsic severity in isolation. Your actual risk depends on your specific configuration, network exposure, and business context. A Critical CVSS vulnerability on an internet-facing public server is your most urgent finding. The same vulnerability on an isolated internal test machine with no network access warrants an entirely different response.

Code Hyper One's managed service applies environmental context to every finding so your prioritised remediation list reflects your actual risk – not abstract severity scores that cause panic in some areas and false confidence in others.

Most businesses that have previously had a "vulnerability scan" have had a point-in-time scan – conducted once, producing a report, with no follow-up until the next engagement. This model has a fundamental problem: your vulnerability posture changes every day.

New CVEs are published at a rate of over 25,000 per year. Every software update, every new device, every cloud configuration change – each of these changes your exposure. A scan conducted three months ago tells you almost nothing about your current security posture.

Continuous vulnerability scanning runs automatically on a schedule – daily, weekly, or in real time for critical assets – and alerts your team the moment a new vulnerability is identified. This keeps pace with the speed at which your environment and the threat landscape both change.

Code Hyper One's managed vulnerability scanning service is built on the continuous model:

• Scheduled automated scans across all in-scope assets at defined intervals
• Real-time alerts for Critical and High severity findings as soon as they are identified
• Monthly scan summary reports with trend analysis – are you more or less vulnerable than last month?
• Quarterly remediation review – ensuring findings are not just identified but actually closed
• Annual full-scope scan with executive summary for compliance and insurance documentation

This is the difference between knowing your security posture and guessing at it. For broader context on why continuous, proactive security management outperforms reactive approaches, see our article on proactive IT support vs reactive IT.

Finding vulnerabilities is only valuable if you close them. This is where most standalone vulnerability scanning providers fall short – they deliver the report and leave remediation entirely to you.

Code Hyper One delivers a scan-to-patch pipeline that connects vulnerability findings directly to automated and managed remediation:

For patchable OS and application vulnerabilities: Findings feed directly into our Datto RMM patch management platform, which deploys approved patches to affected endpoints automatically during the next scheduled maintenance window – without manual intervention or a separate service request.

For configuration vulnerabilities: Our engineers review configuration findings and implement remediation directly – firewall rule corrections, service disablement, credential resets, permission tightening – with change documentation provided for your records.

For web application vulnerabilities: Findings are provided to your development team with specific remediation guidance, or managed by Code Hyper One's team for externally managed applications.

For cloud misconfigurations: Microsoft 365 and Azure configuration findings are remediated through our managed Microsoft 365 administration service, with change logs maintained for compliance documentation.

For findings requiring architectural changes: Complex findings (network segmentation gaps, legacy system vulnerabilities, application redesign requirements) are escalated to our IT consulting team for remediation planning and project delivery.

Post-remediation, affected assets are re-scanned to confirm each vulnerability is genuinely closed before it is marked resolved in your report. No finding is considered closed until the retest confirms it.

ASD Essential Eight

The Essential Eight's "Patch Operating Systems" and "Patch Applications" mitigation strategies require systematic identification and remediation of vulnerabilities. At Maturity Level 2, the ASD expects vulnerabilities in internet-facing services to be patched within two weeks of release, and within one month for internal systems – timelines that are impossible to meet without continuous vulnerability scanning.

Our scan reports map findings directly to Essential Eight patch management controls, supporting your maturity assessment documentation. See our Essential Eight Checklist 2026 and ASD Essential Eight guide for the full framework context.

ISO 27001

ISO 27001 Annex A control A.12.6 (Management of Technical Vulnerabilities) requires organisations to systematically identify technical vulnerabilities and document remediation processes. Our managed scanning service produces this documentation as a natural output, with monthly reports and annual summaries formatted for ISO 27001 audit submission.

PCI-DSS

Requirement 11.2 of PCI-DSS mandates quarterly internal and external vulnerability scanning, with remediation of High and Critical findings before each quarter is closed. Our scanning program satisfies PCI-DSS 11.2 with quarterly reporting formatted for PCI-DSS audit submission.

Cyber Insurance

Australian cyber insurers are increasingly requiring documented evidence of a regular vulnerability scanning program as a policy condition – particularly for policies covering ransomware, data breach, and business interruption. Our monthly scan reports and annual executive summary satisfy standard insurer evidence requirements. Read our cyber insurance requirements guide for the full picture. For structured cyber risk management, see our cyber risk management framework guide.