ScanTitan tests any public IPv4 or IPv6 address the way a remote attacker would. It maps every listening service, fingerprints its software version, and matches it against the CVE database, the CISA KEV catalog and EPSS exploit probability, with documented evidence and a specific fix behind each finding.
Vulnerability exploitation was the entry point in 20% of breaches, up 34% year over year (Verizon 2025 DBIR)
Attacks on edge devices and VPNs grew almost eightfold, from 3% to 22% (Verizon 2025 DBIR)
PCI DSS 11.3 mandates external ASV scans every 90 days
Median time from edge CVE disclosure to mass exploitation: effectively zero days
An IP vulnerability scanner tests a public IP address for open ports, exposed services and known CVEs an attacker could reach from the internet. It works in three phases: it discovers which ports respond, fingerprints the software behind each one, then checks that software against the CVE database and common misconfigurations.
A port scanner stops at “port 3389 is open.” A vulnerability scanner tells you that port 3389 runs a Windows RDP service exposed to BlueKeep (CVE-2019-0708), and hands you the patched version. ScanTitan runs both phases in one pass across IPv4 and IPv6, so you move from a bare address to a prioritized fix list without stitching tools together.
Findings are ranked by whether they are actually being exploited, using CISA KEV membership and EPSS probability, not by severity language alone. Each verifiable finding ships with the evidence behind it.
Six stages, from confirming authorization to a verified, closed finding.
Confirm you own the target IP or hold written permission to scan it. Scanning an address you do not control can breach the US Computer Fraud and Abuse Act.
The scanner confirms the target is alive, then enumerates open TCP and UDP ports so a quiet service like SNMP on port 161 does not slip past.
Each open port is fingerprinted to the service and software version, since the version number is what links a port to a specific CVE.
Detected versions are matched to the CVE database, CISA KEV and EPSS, separating theoretical bugs from the ones attackers use today.
Findings are ranked by exploitability, each with a specific fix, then a rescan of the same target confirms the vulnerability is closed.
Ranked by Drupal's risk score, CVSS, EPSS probability and KEV membership, each with a fix and a re-scan that checks whether it is closed.
Sample outcome. Of 6 exposed services, ScanTitan flagged 2 CVEs in the CISA KEV catalog and told the team to close port 445 first, before the higher-CVSS finding with no active exploit.
Sees what an internet attacker sees: open ports, exposed services and reachable CVEs on the public IP. Agentless, needs only the address.
Adds credentialed depth on a service that blocks unauthenticated probes, so a patch level hidden behind a login is still assessed.
Runs from inside the network to find what an attacker reaches after the perimeter falls: missing patches, weak internal credentials and lateral paths.
Patch what sits in CISA KEV or carries a high EPSS score and is internet-reachable, ahead of a higher-CVSS bug with no exploit.
Each finding names the patched version or the configuration to change, such as disabling TLS 1.0 or upgrading OpenSSH to 9.8p1.
Rescan the same target to prove the finding is gone, and keep the before-and-after record for your auditor.
People searching for a Drupal exploit scanner want one of two things: a tool that fires exploit code at a site, which is a penetration testing decision, or a scanner that knows which findings attackers are using now. ScanTitan does the second, deliberately not the first, using public sources you can verify.
Attackers do not knock on your front door. They scan the internet for a listening service with a known flaw, and your public IP is where they look first. When a critical edge device CVE goes public, the Verizon 2025 DBIR measured the median time to mass exploitation at effectively zero days. If you run a two-person IT team and scan once a quarter, you are checking a door attackers already tried the day the CVE dropped.
Firewalls, VPN gateways and remote access appliances are internet-facing by design and often run with elevated privileges.
Only 54% of vulnerable edge devices were fully remediated, at a median 32 days, per the Verizon 2025 DBIR.
Emerging threat rescans check your targets against a newly disclosed CVE so you do not have to track every advisory by hand.
Enumerates open TCP and UDP ports across IPv4 and IPv6, then fingerprints the service and, where the banner allows, the exact software version behind each one.
Cross-references detected versions against the CVE database for the services attackers target most: SSH, RDP, SMB, SNMP, FTP, DNS and web servers such as Apache and Nginx.
Adds CISA KEV membership and the EPSS probability to every finding, so you patch what attackers exploit today, not the highest CVSS with no exploit.
Flags expired or mismatched certificates, deprecated protocols such as SSLv3 and TLS 1.0, and weak cipher suites on every service that offers encryption, not just port 443.
Surfaces internet-reachable databases, management interfaces such as phpMyAdmin, and services still running default or blank credentials, the fastest breach that needs no exploit.
Accepts a single IP, a list, or a full CIDR block such as 203.0.113.0/24, discovering live hosts so you assess active addresses and are not billed for dead space.
External and internal scans answer different questions, and a mature program runs both. An external scan tests your public IPs from outside the firewall, simulating a remote attacker. An internal scan finds what an attacker reaches after the perimeter falls.
| Dimension | External IP scan | Internal IP scan |
|---|---|---|
| Vantage point | Outside the firewall, remote attacker view | Inside the network, post-breach view |
| Targets | Public IPv4 and IPv6, exposed services | Workstations, servers, internal services |
| Setup | Agentless, needs only the IP or range | Agent or on-network scanner |
| Finds | Open ports, exposed CVEs, misconfigurations | Missing patches, weak internal credentials, lateral paths |
| Compliance driver | PCI DSS external ASV scans | Internal vulnerability management controls |
An IP scan works at the network layer: ports, services and the software versions running on your infrastructure. A website vulnerability scanner works at the application layer, testing your web app for SQL injection, cross-site scripting (XSS) and broken access control that no port scan can see. An attacker takes whichever is weaker. If your IP scan is clean but your login form is injectable, you are still exposed. Run both, on a schedule. If a scan reveals an active compromise, use website malware removal to clean up.
Open ports, exposed services, network CVEs, SSL/TLS, default credentials.
SQL injection, XSS, CSRF, broken access control, application logic flaws.
Network exposures and application flaws are separate doors. Closing one leaves the other open.
A report is only useful if it tells you what is wrong, proves it, and shows the fix. Every IP scan report is built around action, not a raw port dump.
Every open port, the detected service, and the software version behind it.
Each finding mapped to its identifiers so priority is obvious at a glance.
The banner or confirmed response we collected, so you can validate it yourself.
The patched version number or configuration change, not a generic warning.
Two scanners can find the same 200 issues. The one that tells you which 5 to fix tonight is the one worth paying for. Every network finding carries three signals that decide its real priority.
Confirms whether attackers are exploiting the CVE in the wild right now, per the US government Known Exploited Vulnerabilities catalog. If it is in KEV, it moves to the top.
A data-driven score from 0 to 1 estimating the chance the CVE gets exploited in the next 30 days, so likely targets outrank unlikely ones regardless of severity label.
Weighs technical severity, then combines it with whether the service is internet-facing, so an exposed CVSS 7.5 outranks an isolated CVSS 9.8 an attacker cannot reach.
Scanning is an intrusive act, and a vendor careless with authorization or your results is a liability. ScanTitan treats both as first-class controls, not fine print.
You confirm ownership or written authorization for every target before a scan starts, so you stay on the right side of the CFAA and equivalent EU and Middle East law.
Scan traffic is rate-limited to avoid disrupting production services, and you can schedule scans for low-traffic windows.
Scan results are stored in the EU, in line with our Den Haag base and GDPR Article 32 obligations, with a Dubai presence for regional clients.
Your scan data is deleted on request, with defined retention limits, so old findings do not linger past their usefulness.
All are legitimate tools, and the open-source ones are excellent. The table records what each is best suited to, not a straw man. The right choice depends on your team.
| ScanTitan | Nmap | OpenVAS | Pentest-Tools | Intruder | |
|---|---|---|---|---|---|
| Best for | SMB & mid-market IT | Hands-on engineers | Build-your-own stacks | Pentesters | Growing security teams |
| Delivery | Cloud, agentless | Self-hosted CLI | Self-hosted | Cloud | Cloud |
| KEV + EPSS context | ✓ | – | Partial | ✓ | ✓ |
| Evidence per finding | ✓ | Raw output | Partial | ✓ | ✓ |
| Runs it for you | ✓ | – | – | ✓ | ✓ |
| Transparent public pricing | ✓ | Free | Free | Some tiers | Per target |
| Entry point | Free scan | Open source | Open source | Free light scan | 14-day trial |
How to read this table. ✓ the capability is described in the tool’s own documentation. Partial available with documented limits or only in a paid tier. – not a documented feature of that tool. Free means the core tool is free and open source, run and maintained by you.
Sources reviewed 19 August 2026: Nmap project · OpenVAS / Greenbone · Pentest-Tools Network Scanner · Intruder external scanning.
Spotted something out of date? Tell us and we will correct it.
You can legally scan any IP address you own or have written permission to test. Scanning a third party IP without authorization can breach the US Computer Fraud and Abuse Act and equivalent laws across the EU and Middle East. Before ScanTitan runs a scan, we require you to confirm ownership or authorization for the target. For IPs your provider owns, such as a cloud instance, check the provider policy first. AWS and Google Cloud allow customer-initiated vulnerability scanning of your own resources without prior approval, while some hosts still ask for notice. When in doubt, get authorization in writing and keep it on file for your auditor.
A port scan answers one question: which ports are open on this IP. An IP vulnerability scan goes further. It takes each open port, identifies the service and software version behind it, then checks that version against known CVEs and misconfigurations. A port scanner tells you port 3389 is open. A vulnerability scanner tells you that port 3389 runs a Windows RDP service exposed to BlueKeep (CVE-2019-0708), and hands you the patch. ScanTitan runs both phases in one pass, so you move from discovery to a prioritized fix list without stitching separate tools together. Port scanning is step one of the job, not the whole job.
Yes. ScanTitan accepts a single IP, a list of IPs, or a full CIDR block such as 203.0.113.0/24. For larger perimeters, we discover which IPs in the range are live and listening, so you scan active hosts instead of paying to license inactive addresses. This matters for mid-market teams that hold a class C range but only use a fraction of it. You can schedule recurring scans across the whole range and get alerted when a new service appears on an address that was quiet last week. Continuous coverage across a range is where an external IP scan overlaps with attack surface management.
Quarterly scanning meets the letter of PCI DSS Requirement 11.3, which mandates external scans by an Approved Scanning Vendor every 90 days. It does not meet reality. New CVEs are published daily, and Verizon's 2025 DBIR found the median time between disclosure and mass exploitation of edge device flaws was effectively zero days. If your IP exposes a VPN, firewall, or remote access gateway, monthly or continuous scanning is the defensible baseline. ScanTitan supports scheduled scans and emerging threat rescans, so a newly disclosed CVE triggers a fresh check against your targets without you watching the news feed.
No, and any vendor who claims otherwise is selling a false sense of security. An external scan sees what an internet attacker sees: open ports, exposed services, and reachable vulnerabilities on your public IPs. It cannot see behind your firewall, inside authenticated applications, or on endpoints with no listening service. It also cannot fully assess a device that blocks unauthenticated probes. That is why ScanTitan pairs external IP scanning with authenticated and internal options, and why we state plainly what a given scan did and did not cover. An honest scope statement is part of every report we deliver.
Yes, where the target and its network path support it. ScanTitan scans both IPv4 and IPv6 addresses. IPv6 changes discovery because the address space is far too large to brute force the way attackers sweep IPv4 ranges. Instead, exposure usually comes from a specific IPv6 address that DNS, certificate transparency logs, or a cloud provider publishes. ScanTitan checks the specific IPv6 targets you provide and any it discovers through integrated asset discovery, then runs the same service fingerprinting and CVE matching used for IPv4. If your infrastructure is dual-stack, scanning only the IPv4 side leaves half your perimeter untested.
Fix the exploitable findings first, not the highest CVSS score. ScanTitan sorts results by real-world risk: whether the CVE sits in the CISA Known Exploited Vulnerabilities catalog, its EPSS exploit probability, and whether the affected service is reachable from the internet. Each finding ships with the evidence we collected and a specific remediation step, such as the patched version number or the configuration change. Apply the fix, then rescan the same target to confirm the finding is closed. If a vulnerability points to an active compromise, our malware removal service handles cleanup. Prioritize, patch, verify, and keep a record for your auditor.
ScanTitan runs an external IP vulnerability scan, ranks the findings by what is actually being exploited, and gives you a specific fix for each one. Enter a target to get a report by email, or see how per-IP and per-range pricing works for your perimeter.
OSCP · CISSP · 12 years in web application security · Author profile →
