> scanners usually do not account for the current v vulnerable configuration. So while they may flag a vulnerability, its often a potential vulnerability. This

> scanners usually do not account for the current v vulnerable configuration. So while they may flag a vulnerability, its often a potential vulnerability. This is a straight-up artifact from the fact that the scanners (which essentially have to operate in non-destructive mode) rely on banner grabbing and very basic service behaviour pattern matching. Hence for every service they find, they report - quoting your words here - the potential vulnerability. Which basically is what you want. Trying to intelligently reduce noise would be really cool, but the moment the intelligence suppresses a finding that you WOULD have wanted to know about, you're screwed. It's bad either way, but the worst-case scenarios of the two are asymmetrical. I personally find point-in-time scans a useless exercise. Findings from individual cans are one thing, the difference over time is what really matters.