Credentialed vs non-credentialed vulnerability scans: what changes in your report

The short version:

• A credentialed scan logs in and reads installed software directly; a non-credentialed scan infers from the network.
• Credentialed scans usually find far more missing patches and produce fewer false positives.
• A failed login silently turns a credentialed scan into a non-credentialed one. Check for it on every host.
• Report coverage per host, so a partially assessed machine never looks cleaner than it is.

The difference in one paragraph

A non-credentialed (unauthenticated) scan sees a host the way an outside attacker does: open ports, service banners and responses to network probes. A credentialed (authenticated) scan also logs in, over SMB or WMI on Windows and SSH on Linux and macOS, and reads the installed software, patch level, registry and configuration directly. Both are useful. They answer different questions, and the report has to say which one it is answering.

What changes in the results

Typical differences between the two scan types

That last row matters for client conversations. The first time an MSP switches a client from network-only to credentialed scanning, the number of findings usually jumps. Nothing got worse; the scanner can finally see. Say so in the report before the client sees the chart.

The silent failure: credentials that did not work

When a scanner cannot log in, it does not stop. It completes a network-only scan of that host and moves on. The host then appears in the results with very few findings, which looks like good news.

• Nessus: check plugin 19506 (Nessus Scan Information) for whether credentialed checks ran, and look for plugin 21745 (Authentication Failure - Local Checks Not Run).
• Greenbone / OpenVAS: look for the authentication success or failure results the scan reports for SMB and SSH logins, and compare the QoD of results across hosts.
• Any scanner: compare finding counts per host. A Windows workstation with three findings next to identical machines with forty is almost always a credential problem.

Common causes are expired or rotated passwords, accounts without local administrator rights, firewalls blocking SMB or WMI, UAC remote restrictions on Windows and SSH key or sudo configuration on Linux.

How to report coverage honestly

1. State the scan type in the method section: credentialed, non-credentialed or mixed.
2. List hosts where credentials failed as partially assessed, separately from fully assessed hosts.
3. Do not compare finding counts between credentialed and non-credentialed hosts as if they measured the same thing.
4. Make fixing the credential failures an action in the report itself, so the next scan covers them.

Varaxon Scan Hub reads credential status from the export and shows coverage, credential failures and missing host context at the top of every report, so a partially assessed host is never presented as clean. The Nessus report walkthrough shows where those signals live in a .nessus file.

Common questions

Is a credentialed scan safe to run on production systems?

Generally yes; credentialed checks read information rather than attack services. Use a dedicated scanning account, schedule scans in an agreed window and avoid enabling intrusive or denial-of-service checks on production systems.

Do I still need non-credentialed scans if I run credentialed ones?

Yes, for internet-facing systems. An external, unauthenticated scan shows what an attacker on the internet can reach, which a credentialed internal scan does not tell you.

Does PCI DSS require credentialed scanning?

PCI DSS v4 requirement 11.3.1.2 requires internal vulnerability scans to be performed with authentication, effective from 31 March 2025.

This guide first appeared on varaxontech.com.

I'm building Varaxon Scan Hub. It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan
Founder, Varaxon Technologies