A vulnerability scan run without credentials reports very few findings on a group of servers, yet administrators know those servers are missing several operating system patches and have weak local security settings. Which change will most improve the accuracy of future scans?

A credentialed scan authenticates to each target with an account that has sufficient read access, allowing the scanner to enumerate installed software and patch levels, read configuration settings and check local security policies directly. That reveals missing operating system patches and weak local settings that are invisible from the network, which is exactly what the non-credentialed scan missed. Running the non-credentialed scan more often repeats the same outside-in view; it may catch a service that is only occasionally listening, but it still cannot see patch levels or local settings. Passive scanning listens to network traffic to infer hosts, services and some software versions without sending probes, which is useful where active scanning is risky, but it sees even less of a host's internal configuration than an active non-credentialed scan. Raising the reporting threshold to show only critical findings by score filters the report, which reduces visibility further rather than improving accuracy, and it ignores that real risk depends on context, not just a base score. Exam caveat: the scan account must be protected and limited to the access the scanner needs, because it is a privileged credential that attackers would value. Operational check: rescan the servers with credentials, confirm the missing patches and weak settings now appear, and compare the finding counts with the earlier non-credentialed results.