Vulnerability Scanning - authenticated scan vs unauthenticated
Imagine you have the choice between opening a box and looking inside, or shaking and prodding it from the outside to guess what it may contain. Imagine further, that if you are unable to successfully guess the contents of the box, something bad may happen, something damning, damaging or dangerous. Which of the two choices would you decide to take? Unauthenticated testing alone will not fully simulate targeted attacks on your application or system. Although unauthenticated scans will show weaknesses in your perimeter, it will not show you what the attacker will exploit once breaching your perimeter: weaknesses within your network. Authenticated scans allow vulnerability scanners to use privileged credentials to dig deeper into a network and detect threats around weak passwords, malware, installed applications, and configuration issues. They are able to simulate what a user of the system can actually do. By finding and fixing internal security holes, you can prevent an attack