Vulnerability Scanner Missed CVEs: What It Shows

Updated 14 November 2026 · Standard formula, shown below

A vulnerability scanner missing four of five CVEs shows that the scanner’s coverage is incomplete and that you cannot rely on a single automated tool for a full security assessment. It also indicates that the scanner’s detection logic, plugin updates, or configuration may not be aligned with the actual attack surface of your environment. This result is a signal to investigate the gaps, not a definitive judgment that the scanner is broken or that your systems are safe.

Background: How Vulnerability Scanners Work

Vulnerability scanners automate the process of identifying security weaknesses in networks, operating systems, and applications. They work by comparing the software versions and configurations they detect against a database of known vulnerabilities, often using the Common Vulnerabilities and Exposures (CVE) system. The scanner sends requests to target systems, reads banner information, and may perform authenticated checks to gather detailed software inventory. Based on this data, it matches against its internal knowledge base and reports any CVEs it believes are present.

Scanners vary widely in their depth and accuracy. Some are designed for broad network coverage and speed, while others focus on deep application-level testing. The quality of the vulnerability database, the frequency of updates, and the scanner’s ability to interpret complex software configurations all affect how many CVEs it can correctly identify. A scanner that misses a large percentage of CVEs in a test is showing that its detection capability is limited in that particular context.

What a Miss Rate Really Indicates

When a scanner misses four out of five CVEs, the immediate takeaway is that the scanner’s coverage is not comprehensive. This can happen for several reasons:

Outdated vulnerability database: If the scanner’s CVE database is not current, it will not know about recently disclosed vulnerabilities.
Lack of authentication: Unauthenticated scans can only see what is visible from the network, missing many software versions and patch levels.
Limited plugin coverage: Some scanners have fewer detection plugins for certain types of software or operating systems.
Misconfiguration: The scanner may be configured to skip certain ports, protocols, or host groups, so it never sees the vulnerable services.
False negatives by design: Scanners often err on the side of avoiding false positives, which can lead to missing real vulnerabilities.

The result shows that the scanner is not a complete security solution. It is a tool that provides a snapshot of potential issues, but it cannot guarantee that all vulnerabilities are found. Security teams must interpret the miss rate as a call to action: review the scanner’s configuration, update its plugins, and consider supplementing it with other assessment methods.

How to Interpret the Results Correctly

Interpreting a scanner’s output requires understanding the difference between a true negative and a false negative. A true negative means the scanner correctly identified that a CVE is not present. A false negative means the scanner failed to detect a CVE that actually exists. In your scenario, four of five CVEs were missed, so those are false negatives.

False negatives are common in vulnerability scanning because scanners rely on version matching and signatures. If the software version is obfuscated or the scanner cannot access the system deeply, it may miss the vulnerability. Also, some vulnerabilities are only present under specific conditions, such as a particular configuration or user interaction, which the scanner cannot easily replicate.

It is also important to consider the severity of the missed CVEs. If the missed ones are low-risk or require local access, the impact may be minimal. But if any are critical and remotely exploitable, the miss rate is a serious concern. The result shows that you need to prioritize manual verification of the scanner’s findings and use additional tools like penetration testing or manual code review to fill the gaps.

Common Causes of Missed CVEs

Several technical factors can cause a scanner to miss CVEs. One of the most common is the lack of credentialed scans. Without valid credentials, the scanner cannot inspect the system’s registry, installed patches, or configuration files, so it relies on banner grabbing and port scanning, which are less accurate. Another cause is the use of outdated plugins or signatures. Scanners update their databases regularly, but if the update process fails or is delayed, the scanner will not detect recent CVEs.

Network issues can also play a role. If the target system is behind a firewall that drops certain packets, or if the scanner’s IP is blocked, it may not receive responses from all services. Additionally, some software hides its version information, making it impossible for the scanner to match against its database. For example, a web server might be configured to suppress the version header, so the scanner cannot determine if it is vulnerable to a specific CVE.

Finally, the scanner’s own configuration can limit its effectiveness. Many scanners allow you to set the scan intensity, port range, and protocol. If these are set too narrowly, the scanner will not probe all services, and vulnerabilities on un-scanned ports will be missed. The result shows that the scanner’s coverage is not just a matter of the tool itself, but also how it is deployed.

How to Choose a Better Scanner or Improve the Current One

If you are seeing a high miss rate, you have two paths: improve the current scanner or consider alternatives. To improve the current scanner, start by ensuring it is fully updated. Check that the vulnerability database is current and that all plugins are enabled. Then, configure credentialed scans where possible, as this dramatically improves detection accuracy. Adjust the scan profile to cover all relevant ports and protocols, and test on a small subset of systems to see if the miss rate decreases.

If the miss rate persists, you may need to evaluate other scanners. When comparing tools, look at the following factors:

Coverage: Does the scanner support the operating systems and applications in your environment?
Accuracy: Look for independent tests or user reviews that mention false negative rates.
Update frequency: How often is the vulnerability database updated?
Customization: Can you write custom plugins or adjust detection thresholds?
Integration: Does it integrate with your existing security tools and workflows?

Remember that no scanner is perfect. Even the best tools have a certain percentage of false negatives. The goal is to minimize them to an acceptable level, not to eliminate them entirely.

Limitations of Vulnerability Scanners

Vulnerability scanners have inherent limitations that contribute to missed CVEs. They are not designed to find logic flaws, business logic errors, or complex multi-step attacks. They also cannot verify if a vulnerability is actually exploitable in your specific environment. A scanner may report a CVE as present, but if the vulnerable code path is not reachable due to configuration, the actual risk may be lower.

Scanners also struggle with custom software and applications that are not widely deployed. If your environment uses proprietary systems, the scanner may have no plugins for them, so it will miss any CVEs in those systems. Additionally, scanners do not perform static analysis of source code, so they cannot find vulnerabilities that are only visible in the code.

Another limitation is that scanners only see what is present at the time of the scan. If a system is patched after the scan, the scanner will still report the CVE until the next scan. Conversely, if a new vulnerability is disclosed after the scan, it will not be detected until the database is updated and a new scan is run. This is why regular scanning is essential, but it is not a substitute for a continuous security program.

Best Practices for Using Vulnerability Scanners

To get the most out of a vulnerability scanner and reduce the impact of missed CVEs, follow these best practices:

Run credentialed scans: Always use credentials when possible to get accurate software inventory.
Keep the scanner updated: Schedule automatic updates for the vulnerability database and plugins.
Scan regularly: Perform scans at least weekly, or more frequently for critical systems.
Verify findings manually: Do not trust the scanner blindly; spot-check critical findings with manual investigation.
Use complementary tools: Combine scanning with penetration testing, intrusion detection, and log analysis.
Prioritize remediation: Focus on fixing the most critical CVEs first, based on exploitability and asset value.

By following these practices, you can turn the scanner’s miss rate into a driver for improvement rather than a source of false confidence.

Frequently Asked Questions

Why did my scanner miss so many CVEs?

Scanners miss CVEs because of outdated databases, lack of credentials, limited plugin coverage, or configuration issues. It can also be that the CVEs are in software that the scanner does not support or that the scanner’s detection logic is not sensitive enough to detect the specific vulnerability.

Does a high miss rate mean the scanner is useless?

No, it means the scanner is not sufficient on its own. It still provides value by finding some issues, but you need to supplement it with other methods and improve its configuration. A high miss rate is a warning sign that you cannot rely solely on that tool.

How can I reduce false negatives in vulnerability scanning?

Enable credentialed scans, update the scanner regularly, configure it to scan all relevant ports and protocols, and use custom plugins if needed. Also, consider using multiple scanners to cross-check results.

What is the difference between a false negative and a false positive?

A false negative is when the scanner fails to report a vulnerability that exists. A false positive is when the scanner reports a vulnerability that does not exist. Both are problematic, but false negatives are considered more dangerous because they leave you unaware of real risks.

Should I use a free scanner or a commercial one?

Free scanners can be useful for small environments or initial assessments, but they often have fewer features and less frequent updates. Commercial scanners typically offer better coverage and support, but they require a budget. The choice depends on your needs and resources.

Can a vulnerability scanner replace a penetration test?

No. A scanner automates the identification of known vulnerabilities, while a penetration test involves a human expert attempting to exploit vulnerabilities to assess real-world impact. Penetration testing can find issues that scanners miss, such as logic flaws and chained attacks.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.