ScanTitan assesses a public IP address or server that you own or are authorized to test. It identifies the exposed services, matches detected versions to known CVEs and ranks the results by CVSS, EPSS and CISA KEV status. It does not scan internal networks or IP ranges.
Known CVE matching · CVSS + EPSS scoring
KEV and EPSS prioritization
Public services and servers
A network vulnerability scanner checks the services a host exposes for known CVEs, misconfigurations and exposed services before an attacker reaches them. ScanTitan does this for individual public IP and server assets that you own or are authorized to test. It does not scan internal networks or IP ranges.
Six stages, from adding the asset to a fix you can re-check. ScanTitan assesses the public IP or server you add.
Add the public IP or server you own or are authorized to test. ScanTitan assesses that asset rather than sweeping IP ranges.
ScanTitan identifies the services reachable on the asset and the versions they report.
Every detected service version is cross-referenced against published CVEs, so an outdated service becomes a named CVE with a CVSS score.
On Business and Consultant plans, use the authorized Linux package inventory to identify eligible security advisories for installed packages. See authenticated Linux vulnerability scanning.
The report labels observations, potential CVE matches and results verified by a test, so you can see what each finding rests on.
Findings are ranked by CVSS, EPSS and CISA KEV status, each with a plain-language fix. Re-scan the asset after the fix to check it.
Most breaches begin at the perimeter. ScanTitan assesses the public IP or server you add, so you see what an outsider can reach and which of it is affected by known CVEs.
A network scan can return thousands of findings, and you will never fix them all. ScanTitan scores each on more than raw severity, combining CVSS with EPSS, the probability a flaw is exploited in the wild, plus exploit availability and host reachability. Read how vulnerability prioritization with CISA KEV and EPSS works.
A CVSS 7.0 on an internet-facing service with a live exploit outranks a CVSS 9.0 on an unreachable internal host. Each finding carries a plain-language fix, and a one-click re-scan verifies closure and attaches audit-ready evidence.
Ranked, not dumped, The top of your queue is genuinely the thing to fix first, so a two-person team gets the risk reduction of a much larger one.
Network scanners can bury real issues under noise, and a lean team cannot triage a thousand maybes a week. ScanTitan labels each finding by what it rests on and ranks them using CVSS, EPSS and CISA KEV status.
A result is marked as verified only when a test exercised the behavior. Version-based matches are shown as potential matches.
Each finding states what the scan saw, so your team can confirm it on the asset.
CISA KEV status and EPSS probability push the issues most likely to be exploited to the top of the queue.
Detected service versions are matched to published CVEs across vendors.
From a known CVE on a public host to a database port open to the internet. Each check maps to how exposed servers actually get breached.
Detected service versions are matched to published CVEs, including widely exploited ones.
Exposed databases, open management ports and unnecessary services that quietly widen your attack surface.
On Business and Consultant plans, an authorized SSH assessment identifies eligible security advisories for installed Linux packages.
Flags findings whose CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Expiring or misconfigured certificates, weak cipher suites, and deprecated protocols like SSLv3 and early TLS that break both security and compliance.
Flags services running unsupported software versions, a latent exposure even before a CVE is published, because unmaintained software is where the next one lands.
A cloud-hosted server with a public IP is assessed like any other public server.
An SSH assessment uses the authorized package inventory to find advisories an outside view cannot see.
Every finding is shown with its CVSS score, EPSS exploit probability and CISA KEV status, so the top of your queue is the thing to fix first.
Detected service versions are matched to published CVEs, including widely exploited ones.
Flags services running unsupported software versions, a latent exposure even before a CVE is published, because unmaintained software is where the next one lands.
Every finding is shown with its CVSS score, EPSS exploit probability and CISA KEV status, so the top of your queue is the thing to fix first.
Exposed databases, open management ports and unnecessary services that quietly widen your attack surface.
Expiring or misconfigured certificates, weak cipher suites, and deprecated protocols like SSLv3 and early TLS that break both security and compliance.
A cloud-hosted server with a public IP is assessed like any other public server.
On Business and Consultant plans, an authorized SSH assessment identifies eligible security advisories for installed Linux packages.
Flags findings whose CVE appears in the CISA Known Exploited Vulnerabilities catalog.
An SSH assessment uses the authorized package inventory to find advisories an outside view cannot see.
The vulnerabilities that cause real breaches are rarely exotic. They are often unpatched, internet-reachable services with public exploits. These are examples of widely exploited CVEs that affect network services.
| Vulnerability | CVE | Affected service | Severity |
|---|---|---|---|
| Log4Shell | CVE-2021-44228 | Apache Log4j (Java services) | CVSS 10.0 |
| BlueKeep | CVE-2019-0708 | Remote Desktop (RDP) | CVSS 9.8 |
| EternalBlue | MS17-010 | Windows SMB | CVSS 9.3 |
| CitrixBleed | CVE-2023-4966 | Citrix NetScaler / ADC | CVSS 7.5 |
| ProxyShell | CVE-2021-34473 | Microsoft Exchange | CVSS 9.8 |
Findings are grouped so the engineer who fixes the issue and the manager who reports the risk work from the same list.
The exposed services and reported versions found on the assessed asset.
CVE ID, CVSS score, EPSS probability and CISA KEV status.
Whether the finding is an observation, a potential CVE match or verified behavior.
Findings ordered by real-world risk so remediation starts where it matters most.
A specific fix per finding. Re-scan the asset after the fix to check it.
OpenVAS is free but needs setup and maintenance. ScanTitan runs from the cloud with no install and ranks findings by CVSS, EPSS and CISA KEV status. It assesses public IP and server assets, not internal networks.
Cloud-based assessment of public IP and server assets.
No install to scan externally
Recent changes to the network assessment, limited to what is released.
July 2026
Network findings carry CVSS, EPSS probability and CISA KEV status, so an actively exploited issue can outrank a higher CVSS score.
May 2026
Business and Consultant plans can add an authorized SSH assessment to identify eligible security advisories for installed packages.
March 2026
January 2026
Findings are labeled as observations, potential CVE matches or verified behavior.
A network vulnerability scanner checks the services exposed by a host for known weaknesses, such as outdated software with published CVEs. ScanTitan assesses one public IP or server at a time and ranks findings by CVSS, EPSS and CISA KEV status.
No. ScanTitan assesses public IP and server assets only. It does not scan private networks, internal address space or IP ranges.
It uses the authorized package inventory of a Linux server you are allowed to test to identify eligible security advisories for installed packages. It is available on the Business and Consultant plans.
No. A scan result helps you find and fix issues but is not a compliance certification or attestation.
It depends on the job. ScanTitan is cloud-based and assesses public IP and server assets, with findings ranked by CVSS, EPSS and CISA KEV status. If you need to scan internal networks or run a scanner on your own hardware, a self-managed scanner may fit better.
Each finding is labeled as an observation, a potential CVE match or verified behavior, so you can see whether it is based on what the scan saw, on a version match or on a test.
IP / server assets are included in the Business plan, priced per asset place and billed annually. The pricing page lists current prices.
Internal or private networks, IP ranges and CIDR blocks, and router, switch or firewall credential checks are not covered. Each public IP or server is added as its own asset.
ScanTitan assesses a public IP or server for known CVEs, misconfigurations and exposed services, labels each finding by how it was established and ranks them by CVSS, EPSS and CISA KEV status.
CISSP · GXPN · GCIH · GWAPT · CISA · CEH · EnCE · ISO 27001 Lead Auditor · COBIT 5 · 12+ years in information security · Author profile →
One scanning engine, one report, one set of CVSS, EPSS and CISA KEV priorities. Pick the scanner that matches what you run.
