## Authenticated vs Unauthenticated Scanning

### Unauthenticated Scan (The Hacker's View)
*   The scanner sends packets to ports (80, 443).
*   It grabs banners: "Apache 2.4.49".
*   It checks the Banner version against a CVE list.
*   *Prob*: It misses everything inside the OS. Browsers, Adobe Reader, Kernel versions.
*   *Result*: High False Positives (Backported patches look old).

### Authenticated Scan (The Auditor's View)
*   You give the scanner credentials (SSH specific user, or Windows Admin).
*   The scanner logs in.
*   It runs `rpm -qa` or looks at the Registry.
*   "I see Chrome version 80 installed."
*   *Result*: Extremely accurate. This is the Gold Standard for corporate VM.