Author: Kateryna Ivanenko, Brand Manager (Invicti, Mend.io, OPENVAS software)
False positives are one of the most frequently discussed problems in the vulnerability scanning and management field. They cause plenty of hours to be wasted on issues that do not actually exist, so it is hard not to notice.
False negatives are quieter. That vulnerability exists, but the scanner does not detect it. The dashboard shows fewer findings, and the security team thinks that they are progressing. Issue not found – no actions are performed; it is the ideal-case scenario for busy specialists.
Why false negatives matter
The number of disclosed vulnerabilities is increasing rapidly. FIRST’s 2026 Mid-Year Vulnerability Forecast states that they had to revise their forecast from about 59 000 CVEs to 66 000 CVEs being disclosed by the end of 2026.
NIST is experiencing the same pressure at the database level. In April 2026, it reported that CVE submissions during the first quarter of 2026 were nearly one-third higher than during the same period a year earlier.
It means that, in the current threat landscape, coverage is one of the highest priorities for vulnerability scanning, if not the most important one.
The most common reasons for insufficient coverage
Reason 1: The vulnerable asset type is not supported by the tool (even in discovery mode)
A network scanner cannot test an asset that it does not see.
It is especially crucial to ensure that the tool supports the enterprise-grade systems in use, since they are often mostly missed by open-source scanners.
Furthermore, networks change continuously. This is why thorough asset discovery is a meaningful part of the vulnerability scanning and management process.
In the Binding Operational Directive 23-01, which is still referenced in the 2025 FISMA document, CISA emphasizes the importance of automated asset discovery every 7 days. Although this requirement is mandatory for federal agencies, the underlying principle should be adopted by organizations from different verticals.
A scanner that detects all vulnerabilities on only a part of the infrastructure still leaves a blind spot.
Reason 2: Lack of security checks updates
Asset discovery is an important step, but at the end of the day, vulnerability detection is the main purpose of a network scanner.
Having a big database of security checks embedded in the scanning engine is crucial, but it does not guarantee the absence of false negatives. What about the newly disclosed vulnerabilities that impose high risk? Are you sure they are promptly covered?
A CVE being publicly disclosed does not automatically mean that every vulnerability scanner can detect it. Vendors need to develop and test a security check to be able to uncover it by their tool.
NIST mentions this point in their vulnerability monitoring and scanning guidance: organizations should use tools that can readily update the vulnerabilities to be scanned.
We can reverse the comparison from the previous section: a scanner that detects a part of vulnerabilities on all the infrastructure still does not provide sufficient coverage.
Reason 3: Incorrect configurations that affect scanner behavior
Even a solution with comprehensive coverage can miss vulnerabilities if the environment or the tool is not configured correctly.
For example, a scanner might mistakenly treat a host as not alive and not test it, because a local firewall blocks an anticipated response.
Incorrect scan scope configuration can become an issue as well. Hosts, ports, and vulnerabilities that are not included in settings will be omitted from testing.
Proper authentication also matters. It helps with in-depth asset discovery and vulnerability detection that can uncover information not available otherwise.
Security teams should make sure that the scanner can reach all intended network assets, authenticate successfully, and run the expected vulnerability checks. If struggles occur, professional technical support from the vendor should be able to help.
Reason 4: Lack of regular scanning
This time it is not about the network scanner itself but how it is used. Even the best tool will not help much when it is barely leveraged.
Although there is no single universal scanning interval, different frameworks exist, such as:
- The British NCSC recommends regular infrastructure scanning (at least monthly), as well as retesting after remediation of critical issues.
- The federal requirement by CISA demands vulnerability scanning to be performed every 14 days.
It is important to remember that the bigger the interval between scans, the longer new vulnerabilities can remain invisible to the security team.
3 key questions for scanner coverage evaluation
- Are all companies’ relevant enterprise systems supported by the tool?
- What is the volume and frequency of security checks updates? Is an SLA in place?
- Can scanner be deployed and configured in a way to reach all assets required in the company’s use case? (e.g., authentication, distributed or isolated environments)
Testing can answer those questions. You can create a list of test cases that cover enterprise-grade systems discovery, known network vulnerability detection, and nuances of your environment.
False negatives lead to a false sense of security
False negatives reduce the number of findings, leaving some vulnerabilities unnoticed.
This is why it is crucial to make sure that your network scanner is reliable in terms of system support, security checks updates and specific configurations.
For organizations that are looking for comprehensive coverage, the Enterprise version of OPENVAS helps using the following capabilities:
- More than 4500 systems supported, including Cisco, VMware, Oracle and others.
- Enterprise-level security checks updates with SLA up to multiple times a day.
- Some CVEs are added before their official publication thanks to extensive vendor’s research.
- Professional support is provided for the Enterprise version customers.
- Setup options for distributed and isolated networks (air-gapped).
If you would like to test the Enterprise version of OPENVAS for free, please provide your contact details below, and our manager will get in touch with you:
