We point a vulnerability scanner at our own network. It found us.

There is a particular kind of honesty that comes from pointing a vulnerability scanner at your own network and hitting go. It does not care that you built the thing. It probes every open port, throws malformed input at every service, checks every version against a database of known holes, and hands you a list you would rather not read.

We run Greenbone Vulnerability Management — the engine behind OpenVAS — on a Kali Linux box, scanning our own network on a schedule. Not once, the week before a client asked. On a schedule, against ourselves, because a network is not a fixed thing: a patch lands, a service gets added, a certificate expires, and last month's clean report is this month's fiction.

What a scan actually does

People picture scanning as a green tick or a red cross. It is neither. A good scan is thousands of small, rude questions asked of every device at once: what are you running, what version, do you still answer to this old exploit, what happens if I send you this garbage. The output is a ranked list of what an attacker would notice first — the expired certificate, the service running a version with a published flaw, the management port that should never have been reachable.

The time it found us

The most useful result we ever got was the scanner tripping over one of our own services. A scan does not send polite, well-formed requests; it sends deliberate rubbish to see what breaks. One of our internal services handled that rubbish badly — not a break-in, but it logged screamfuls of errors under the malformed input, which is its own kind of problem when you are trying to tell signal from noise in a log.

So we hardened it: strict limits on request size, a clean rejection of malformed input, and no more stack-trace spam. The scanner did not get in. It did something more useful — it showed us a rough edge under pressure that a real attacker's noise would have hidden behind. We would not have seen it by reading the code.

Why do it to yourself

Because the alternative is someone else running the same scan without telling you. The tools are not secret; the OpenVAS engine we use is free to anyone already poking at your perimeter. The only real question is whether you see the list first.

• It catches the drift — the forgotten test box, the service that got exposed during a change and never put back.
• It turns “we think we're patched” into a dated report you can show an insurer or a tender panel.
• It gives remediation a priority order, so the genuinely urgent gets done before the cosmetic.

This is one slice of an Essential Eight uplift, and one of the cheapest to start. If nobody has ever run a proper scan across your network, you do not know what you don't know — and that is the least comfortable place to be.