Direct answer
A network scanner finding is a candidate that needs validation against the asset's actual service, configuration and exposure. A port number or banner alone rarely proves exploitability.
Confirm the asset and observation
Record the authorized target, scan source, time, address and responsible owner. Verify that the address still belongs to the intended asset; NAT, load balancers and reassigned addresses can make attribution difficult.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Review the evidence
Compare the scanner's service identification and version evidence with the owner's inventory or a safe supported query. A banner can be missing, changed or misleading; check the vendor advisory's affected versions and prerequisites before claiming a vulnerability.
- Preserve the scanner's confidence and coverage limits.
- Confirm a service is reachable from the relevant source.
- Do not attempt exploitation without explicit scope.
Prioritize with context
Consider reachability, sensitive data, known exploitation, compensating controls and operational impact. For example, the same outdated component may have different urgency on a public gateway and an isolated test host. Assign an owner and change window.
Retest and close
After patching or restricting access, repeat the original safe observation and verify the legitimate service still functions. Record the effective version or configuration, source and time. Leave unresolved or unavailable assets open rather than marking them fixed.
Assessment limits
A safe validation may not establish exploitability, and a successful retest applies only to the tested asset and path. Scanner detection and vendor applicability can change.
Frequently asked questions
Does an open port prove a vulnerability?
No. It shows a reachable service for the observed path. The actual software, configuration and applicable issue require separate evidence.
Is a missing scanner alert enough to close a finding?
Verify the affected asset and effective state as well; changes in scan coverage can also make an alert disappear.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.