Recently, it was reported that an e-Commerce site was compromised, revealing customer data, despite the fact that the site bore a well-known symbol indicating that it was safe from such attacks. The symbol borne by the website indicated that the site had been scanned and showed no high vulnerabilities.  This is further evidence that scanning alone cannot provide assurances of either compliance with the PCI DSS or general information security best practice.  * Scanning is a snapshot - It provides assurances that, on the given day on which the scan was performed, there were no high-level network vulnerabilities.  Given the proliferation of zero-day exploits and the creativity of hackers, the fact that there were no high level vulnerabilities on Thursday does not necessarily mean that there will be no such vulnerabilities on Friday.

*Scanning is diagnostic, not preventative - It is not uncommon to hear of companies relying on their scanning as a means of protection.  This can be a dangerous stance to take.  Scanning is not a means of preventing an attack, merely a means diagnosing the vulnerability to an attack. * Scanning searches out network vulnerabilities, not application vulnerabilities - Many of the breaches occuring today take place at the application layer, rather than the network layer.  In fact SQL Injection, one of the most commonly used methods of compromise, cannot be detected using scanning.  *Scanning is a component of the information security program, not a replacement for it - Scanning can be a useful tool when used as a part of a robust, well-rounded information security program.  Relying on scanning alone can leave a company dangerously exposed to data compromise.  However, when used in conjunction with timely patch management, strong internal policies and processes that are actively enforced, data classification and control practices and other elements of security practice, scanning can provide valuable insight.