Choose methods that reveal different parts of the system

An external assessment observes services from outside the organisation boundary; an internal assessment observes what is reachable from its authorised internal position. Differences between them reveal exposure and segmentation. Neither replaces the other. A service hidden from the public internet may still be reachable from ordinary user devices, while a gateway may expose a service that an internal scan does not identify.

An agent collects information from its installed host and can support intermittently connected endpoints. Agentless assessment avoids a persistent local component but depends on remote access, credentials, or service responses. Compare freshness, deployment coverage, privileges, and maintenance overhead. An installed agent that stopped reporting is not current evidence, and an agent report does not describe every network path to its host.

Credentialed assessment can inspect installed packages, patch state, and configuration that network banners cannot reveal. Confirm that authentication actually succeeded and that the account had the permissions needed for the selected checks. Use controlled credentials with only the necessary access. A configured username does not prove that a scan obtained host-level evidence; expired credentials can silently reduce assessment depth.

Non-credentialed checks show what a requester can learn without that account. Active methods send traffic or queries; passive methods observe existing communications or records. Passive observation is valuable where direct interaction is constrained, but quiet devices and unobserved traffic remain blind spots. Combine approved active checks, passive evidence, and inventory review rather than interpreting an absence of observations as an absence of assets.

Discovery and mapping establish which systems and services appear present. Device fingerprinting estimates characteristics from responses, so record its confidence and corroborate important identifications. A blocked probe does not prove a host is absent. Discovery helps build assessment scope, but finding an open service is not equivalent to proving that the service has an exploitable vulnerability.

Baseline assessment compares configuration with an agreed set of expectations. CIS Benchmarks provide technology-focused recommendations; PCI DSS and the ISO 27000 family inform broader control requirements and governance. Translate applicable requirements into appropriate checks rather than treating every framework as a machine-readable scan profile. Record justified exceptions, the baseline version, and the actual setting found so drift can be investigated.