Question

A vulnerability management analyst runs a weekly authenticated scan against a Linux server fleet. This week, one server that historically reported dozens of missing-patch findings suddenly reports only two open-port findings and no OS-level vulnerabilities. The scan job completed without errors, and the host is confirmed reachable. Other servers in the same subnet still return full patch-level results. What is the MOST likely explanation the analyst should investigate first?

Accepted Answer

The scanner's credentials failed to authenticate to that host, causing it to fall back to an unauthenticated scan

Answer

The server was fully patched since the last scan cycle, so only network-facing findings remain

Answer

The scanner's vulnerability plugin feed was not updated before the scan ran

Answer

The server's EPSS scores dropped below the reporting threshold configured in the scanner