Credentialed Patch Audit

The result, before and after

Scan, remediate, scan again. The second pass across the same hosts shows the high-severity findings coming down after patching. That second scan is the whole point, it's the difference between finding problems and fixing them.

Outstanding remediations dropped from 3 to 1 across the fleet, with high-severity findings cleared on the hosts that carried them.

How it was set up

A credentialed scan logs into each target the way an admin would, so it sees the actual installed patch level instead of guessing from the outside. That means it finds far more, and far more accurately, than an unauthenticated scan.

• Service accounts on both Windows and Linux, so Nessus could authenticate to each host
• A defined scope, the lab IP range set as the scan target
• The Credentialed Patch Audit template in Nessus Essentials, pointed at that range
• Per-OS credentials, SSH for Linux, an account for Windows

The remediation plan

The findings were prioritized by severity, high first, and handled per operating system:

• Windows, check for and apply the missing updates
• Linux, patch from the command line with apt update && sudo apt full-upgrade -yy across the VMs and containers
• macOS, check for and apply updates

Then the same scan was run again to confirm the high-severity items were actually gone rather than assumed fixed.

It running

Screenshots from the scan: the setup, the credentials, and the before and after results.