"Automated external penetration test" is another name people use for what an ASV vulnerability scan actually does: testing your servers from outside your network, the same way an attacker would, without a person manually driving every step. Here's what actually happens when you run one.
Step 1: Finding What's Exposed
The scan starts by mapping out what's actually reachable from the public internet. It checks every IP address you give it and looks at every port, not just the common ones, to build a full picture of what an outside attacker could see.
Step 2: Identifying What's Running
For every open port, the scan figures out what service is running behind it and what version. A web server, a mail server, a database listening somewhere it shouldn't be. This step is what lets the scan know which checks are even relevant to your setup.
Step 3: Checking Against Known Vulnerabilities
Once it knows what's running, the scan compares each service and version against databases of known vulnerabilities (CVEs), plus checks for weak SSL/TLS settings, default files, exposed admin panels, and other common misconfigurations. This is the bulk of the test, and it's where most findings come from.
Step 4: Testing Your Web Applications
If your scope includes web applications, the scan also runs safe, non-destructive versions of attacks like SQL injection and cross-site scripting against your forms and URL parameters. This mirrors the kind of testing a human attacker would try first, just automated and repeatable.
Step 5: Filtering Out False Positives
Not every raw result belongs in your report. Before anything gets flagged as a finding, it goes through validation to weed out results that look like a vulnerability but aren't actually exploitable in your environment. This step matters, because a report full of noise is just as useless as one missing real issues. It's also why we back our scans with a money-back guarantee: if you can't pass, something's wrong on our end, not yours.
What You Get at the End
A finished report lists every vulnerability found, ranked by severity, with plain-language guidance on how to fix each one. You can rescan as soon as you've made a fix, since unlimited scanning is included on every ServerScan plan, so you're not stuck waiting until your next quarterly window to confirm it worked.
What ServerScan Offers
ServerScan runs ASV-certified automated external scans on the schedule PCI DSS requires (see our scanning requirements guide), with unlimited rescans included and US-based support if a finding doesn't make sense. If your environment needs a deeper look than a standard scan, like actual exploitation attempts instead of just flagging known issues, our penetration testing covers that, still automated, just built to dig further.
Questions about how a scan works against your specific setup? Contact our support team. We're happy to walk through it.