Vulnerability scanning is the process of identifying known vulnerabilities in applications and infrastructure. It is performed using tools that first identify assets within the network and then passively and actively assess if these applications have security flaws. The first step is for the tools to accurately identify applications and their versions. This information is compared against a database of known vulnerabilities, and any matches are reported. Additionally, these tools perform basic security checks to identify common misconfigurations, such as default credentials on exposed applications.