External vs internal vulnerability scanning: what each one finds
A vulnerability scan looks for known weaknesses in the systems it can reach. Where the scan runs from changes what it can see. An external scan runs from the internet, the way an attacker would approach your business. An internal scan runs from inside your network, the way someone who has already gotten in would see it. They answer different questions, and most businesses eventually want both.
What an external scan sees
An external scan sees only what the internet can reach: your websites, mail servers, remote access services, DNS records, TLS certificates, open ports and any forgotten subdomains. It needs nothing installed on your computers. It starts from your domain names, or from the address ranges you own, and asks one question: what can a stranger reach, and what could they try?
What an internal scan sees
An internal scan sees what is on your local network: laptops, servers, printers, network equipment and shared folders. It finds missing patches, weak settings and default passwords that the internet cannot see. It usually needs a scanning device or software inside the network, and often a login with enough rights to inspect each system properly. It answers a different question: if someone got in through a phishing email, an infected laptop or a guest on your wifi, what could they reach?
Side by side
- Runs from: external, the internet; internal, inside your network.
- Needs: external, your domain names or address ranges; internal, a device or software on the network and usually credentials.
- Finds: external, exposed services, weak email and DNS settings, certificate problems and vulnerable public software; internal, unpatched computers, weak configurations and exposed internal shares.
- Misses: external, anything not reachable from the internet; internal, how your business looks to an outsider.
Which one comes first
For most small businesses, start with external scanning. Your internet-facing systems are the front door, so mistakes there are the easiest for others to find and use. External scanning is also the simplest to start: no installation, no network changes, and it covers the same view that some insurers and brokers can build for themselves.
Do not treat it as the whole job, though. Many serious incidents, ransomware among them, spread once someone is inside the network, and only an internal view shows that risk. Think of it as two layers: external scanning to keep the doors closed and watched, and internal checks, plus good patching and account security, for what happens if one is opened.
Questions to ask any provider
- Does it scan only the systems you have authorized, and will it refuse to scan anything else?
- Does it show what changed since the last scan, or only a list of problems?
- How does it decide what is most serious, and can you see the evidence behind a finding?
- Can you run a fresh scan after a fix to confirm it worked?
Where Frontage fits
Frontage does external scanning and monitoring only. It looks at your domains from the outside, runs active checks only on domains you have authorized, and shows you what changed over time. It cannot see inside your network, so it is a complement to internal checks, not a replacement for them.