A quarterly vulnerability scan of a company's IaaS Linux instances is run from the network without any credentials. It reports only a handful of low findings, even though the instance images have not been patched in months. What best explains the result, and how should the scanning be improved?

An unauthenticated scan probes a host from the network and can only fingerprint services that answer on open ports, so it misses vulnerable libraries, kernels and packages that are not exposed, as well as local misconfigurations. A credentialed, or authenticated, scan logs in with a least-privilege account or uses an agent to enumerate installed software, versions and settings, producing far more complete and accurate results. That is why a months-unpatched fleet can look clean in an unauthenticated report. The claim that the provider patches guest operating systems misreads shared responsibility: in IaaS the customer owns the guest operating system, middleware and applications, while the provider maintains the hypervisor and physical layers. Replacing scanning with an annual penetration test confuses two activities; scanning provides frequent, broad coverage, while a test is periodic and goal-driven, and providers generally permit customers to scan their own resources within published policies. Opening security groups to scan from the internet weakens real defenses and still yields only an external view. Exam caveat: scanning credentials must be protected, scoped and rotated like any privileged secret. Operational check: confirm scan reports show successful authentication on each host and compare findings against the patch status of the images.