I think they may have been referring to the tools used to identify security vulnerabilities and exploit them after the initial port scanning. Probably just vari

I think they may have been referring to the tools used to identify security vulnerabilities and exploit them after the initial port scanning. Probably just variants on Nessus / OpenVAS / Metasploit / etc. at a guess. I agree with you though, The existence of nmap, Nessus etc. isn't the problem. These tools help the state of security over time. The fact that the governments of the world are so paranoid that they feel they need to try to automatically compromise the majority of internet facing devices in the world is a problem.