SecurityHive can detect vulnerabilities using different methods—such as comparing software versions, validating a weakness with a safe test, or identifying exposure through configuration and authentication checks.
When you open a vulnerability and view its details, you’ll see which engine reported it. The engine tells you how the vulnerability was identified.
Types
Network Engine (active scanning)
The Network engine is used during network vulnerability scans. It relies on SecurityHive scanning appliances to actively send traffic to in-scope assets and assess them for weaknesses.
Depending on the target and available evidence, findings can be based on:
Version and fingerprinting signals (e.g., service banners, package versions, protocol responses)
Safe active verification (controlled checks that validate a weakness without causing harm)
Authentication and configuration checks (where applicable and authorized)
Credential strength auditing (only when explicitly configured/allowed)
For transparency and reproducibility, each vulnerability finding is tied to a documented test (the specific check that led to the detection).
Agent Engine (software inventory matching)
The Agent engine is used when vulnerabilities are identified based on software inventory.
With the SecurityHive Vulnerability Agent installed, the agent runs on the operating system and:
Inventories installed software (and versions)
Syncs this inventory to the SecurityHive platform
The platform matches installed versions against known vulnerabilities (CVEs) from NIST/NVD data sources
Vulnerabilities are reported when a match is found
This approach is especially useful for software that isn’t easily detectable from the network (or where network evidence is incomplete).
Frequently Asked Questions
Why does a vulnerability show the Agent engine when I don’t have an agent installed?
Even without an installed agent, network scans can still collect software/version information from some assets (for example via banners, package identifiers, or other discovery methods).
In those cases:
The Network engine may not have enough evidence to confirm the issue via an active test, but
The platform can still detect a likely vulnerability by matching discovered software versions to known CVEs
When the vulnerability is ultimately identified via inventory/version matching, it may be labeled as the Agent engine even if the version data originally came from a network scan.
Tip: If you need higher certainty, run a deeper network scan (where applicable) or install the agent on the relevant systems to improve software visibility and accuracy.