Overview
Vulnerability Manager can be used in different ways depending on where your asset is hosted, whether it is publicly accessible, and if you can install the internal scanning agent.
You can choose from three scan types:
- External: Scans the asset from outside your network.
- Internal: Uses an installed agent to assess the asset from the inside.
- Internal & External: Combines both methods for broader coverage.
The best option depends on the asset you want to scan and the level of access you have.
Scanning a Server on an Internal Network
Use this option when the asset is not publicly accessible from the internet.
Example Setup
You have an internal file server, application server or office-based server that sits on a private network. The server may use a private IP address and may only be accessible by users inside your company network or VPN.
Recommended Scan Type
Select the Internal option.
Requirements
- IPv4 address
- Root or admin access to the asset
- Outbound HTTPS access so the agent can report scan data
Scanning a Remote Device or Workstation
Use this option for devices that are not always connected to the same office network.
Example Setup
You want to scan a remote workstation, laptop or device used by an employee outside the office. The device may connect from home, a coworking space or another location.
Recommended Scan Type
Select the Internal option.
Requirements
- IPv4 address
- Root or admin access to the asset
- Outbound HTTPS access so the agent can report scan data
Why Use This Setup
Most workstations are not directly reachable from the internet, so external scanning is usually not suitable. The internal agent is better suited because it can report from the device as long as it can connect outbound to the scanning platform.When used across all workstations you can get a central view of the vulnerabilities.
Scanning a Public-Facing Web Server
Use this option when the server hosts a website, web application, control panel, API or another internet-facing service.
Example Setup
You have a production web server with a public IPv4 address. Customers access the website over HTTP or HTTPS, and the server may also expose other services such as SSH, mail or database ports.
Recommended Scan Type
Select the combined Internal & External option.
Requirements
- IPv4 address
- Relevant services reachable from the internet
- Permission to scan the asset
- Internal agent installed for deeper visibility
- Admin or root privileges for agent installation
Why Use This Setup
The external scan checks what is visible from the internet, while the internal agent checks software, patches, services and configuration from inside the server. Combining both scan types gives a more complete view of the risks affecting the asset.
Scanning a Cloud-Hosted Server
Use this option for servers hosted in cloud platforms such as AWS, Microsoft Azure, Google Cloud or similar providers.
Example Setup
You have a cloud virtual machine running a website, application, database, API or internal service. It may have a public IPv4 address, or it may only be accessible through a private cloud network.
Recommended Scan Type
- Select Internal & External if the server has a public IP address.
- Select Internal if the server is private only.
Requirements
- IPv4 address of the cloud server
- Admin or root access to install the internal agent
- Outbound HTTPS access from the server
- Cloud firewall or security group rules that allow the required scan traffic
- Provider permission to run vulnerability scans, where required
Why Use This Setup
Cloud servers often have firewall, security group or network access rules that affect what can be scanned. External scanning checks the public exposure, while the internal agent gives visibility into the server itself.
Scanning a Server Behind a Load Balancer
Use this option when traffic reaches your service through a load balancer before being routed to one or more backend servers.
Example Setup
You have a public load balancer in front of two or more web servers. Users access the public DNS name or IP address, but the backend servers are private.
Recommended Scan Type
Select External for the public endpoint, plus Internal for each backend server where possible. This would require a subscription for each internal agent.
Requirements
- Public IPv4 address or endpoint for the load balancer
- Internal agent installed on each backend server where visibility is needed
- Admin or root access for agent installation
- Outbound HTTPS access from each backend server
Why Use This Setup
An external scan of the public endpoint may only show what the load balancer exposes. It may not reveal vulnerabilities on every backend server. Installing the internal agent on each backend server helps identify issues that are not visible through the load balancer.
Scanning a Shared Hosting Platform — External Scanning Only
Use this option when your website is hosted on a shared hosting platform and you do not have server-level access.
Example Setup
Your website is hosted with a provider such as IONOS, GoDaddy, Fasthosts or another shared hosting provider. You can manage your website, but you cannot install software on the underlying server.
Recommended Scan Type
Select the External only scan option.
Requirements
- Public IPv4 address or hosted endpoint
- Permission from the hosting provider to run vulnerability scanning
- Services reachable from the internet
Why Use This Setup
Internal scanning is not available because you cannot install the internal agent on the shared server. External scanning can still help identify publicly exposed vulnerabilities.
Before scanning, check your hosting provider’s policy on vulnerability scanning.
Scanning Virtual Machines
Use this option when your server runs as a virtual machine rather than a physical server.
Example Setup
You have one or more virtual machines running on a hypervisor, private cloud or hosted virtualisation platform. Each virtual machine may run a different operating system or application.
Recommended Scan Type
- Internal & External for public virtual machines.
- Internal only for private virtual machines.
Requirements
- IPv4 address for each virtual machine
- Internal agent installed inside each virtual machine you want to assess.
- Admin or root access within the virtual machine
- Outbound HTTPS access from each virtual machine
Why Use This Setup
A virtual machine should be treated like its own server. Installing the internal agent on the host machine does not automatically assess every guest virtual machine. For accurate results, scan each virtual machine as its own asset.
Scanning a DMZ or Segmented Network
Use this option when servers are placed in a restricted network zone, such as a DMZ, isolated VLAN or segmented environment.
Example Setup
You have servers in a DMZ that provide public services while being separated from your internal network. These may include web servers, mail gateways, VPN servers or reverse proxies.
Recommended Scan Type
- Internal & External where the asset is public-facing.
- Internal only where the asset is private within the segment.
Requirements
- Public IPv4 address for external scanning, where applicable
- Internal agent installed on the server
- Admin or root privileges
- Outbound HTTPS access from the network segment
- Firewall rules that allow the agent to report scan data over HTTPS
Why Use This Setup
Segmented networks often have stricter firewall rules. External scanning helps assess what is exposed publicly, while the internal agent provides visibility inside the server. You may need to review firewall or proxy rules to make sure the internal agent can communicate outbound.
Scanning Development, Test or Staging Environments
Use this option for non-production systems that are used before changes go live.
Example Setup
You have a staging server that mirrors production, a test server used by developers, or a development environment used to check releases before deployment.
Recommended Scan Type
Internal, or Internal & External if the environment is publicly accessible.
Requirements
- IPv4 address of the environment
- Permission to scan the asset
- Internal agent installed where server-level visibility is needed
- Admin or root access
Why Use This Setup
Development and staging environments can contain outdated packages, temporary configurations or exposed services that would not be acceptable in production. Scanning these environments helps identify issues before they are copied into live systems.
If the environment is being actively used by developers or testers, plan scans carefully to avoid interrupting important work.
Scanning Multi-Cloud or Hybrid Infrastructure
Use this option when your infrastructure is spread across multiple environments.
Example Setup
You have some assets in AWS, some in Azure, some on-premises and some in a private network. Some assets are public-facing, while others are only available internally.
Recommended Scan Type
Use a mix of External, Internal, and Internal & External based on each asset.
Requirements
- Add each IPv4 asset separately
- Install the internal agent where internal visibility is needed
- Use external scanning for public-facing assets
- Confirm outbound HTTPS access from each environment
- Review cloud firewalls, security groups and network controls
- Use clear asset names so each server is easy to identify
Why Use This Setup
Hybrid environments can be harder to manage because assets are spread across different networks and providers. Scanning each asset based on how it is accessed gives you better visibility and helps you prioritise vulnerabilities across the full environment.
Summary
Different environments need different scan types. Use external scanning when you need to check what is exposed from the internet. Use internal scanning when you need deeper server-level visibility or when the asset is private. Use Internal & External scans where possible for public-facing servers, cloud servers, and critical systems that need the most complete coverage.