Vulnerability scanning (M1016) is one of the most widely deployed ATT&CK mitigations and one of the narrowest: in ATT&CK v20 it is mapped to only five techniques and sub-techniques, and it mitigates none of them on its own. Scanning finds the weakness; something else has to fix it before an attacker uses it. This page treats M1016 as a control that a security team has to prove rather than assume: which techniques ATT&CK says it addresses, what "coverage" has to mean for each, how to wire scanning to remediation, where scanning is blind, and the measurements that show it is working. It is for vulnerability management leads and detection engineers who report ATT&CK coverage. Scanner selection and scan operations are in the Vulnerability Scanning Guide; this page does not repeat them.
Key takeaways
- Five mappings, two that matter most. ATT&CK v20 links M1016 to T1190, T1210, T1195, T1195.001 and T1195.002; the first two are the ones where scanning changes outcomes quickly.
- ATT&CK ties scanning to patching speed. For T1190 its text pairs regular external scanning with "procedures to rapidly patch systems", so a scan without a remediation clock is not M1016.
- Internal service discovery is part of the control. For T1210 ATT&CK asks for regular scans of the internal network to find new and potentially vulnerable services, not just known assets.
- Prioritise on exploitation evidence. The CISA Known Exploited Vulnerabilities catalogue held 1,754 entries in its 21 October 2026 release, a small, actionable subset of all published CVEs.
- Patched is not always safe. Where a flaw leaks sessions, keys or tokens, the fix must include revoking what leaked, which scanners do not report.
What M1016 is in ATT&CK v20
ATT&CK defines M1016 as "the automated or manual assessment of systems, applications, and networks to identify misconfigurations, unpatched software, or other security weaknesses", classified by risk to prioritise remediation. Its description lists five measures: regular host and application scanning, cloud environment scanning (its examples are open storage buckets and overly permissive IAM roles), network device scanning (weak SNMP strings and outdated firmware, correlated with vendor advisories), dynamic web application scanning, and prioritisation with CVSS integrated into ticketing.
The cloud measure is the one most often missed: ATT&CK explicitly puts overly permissive IAM roles in scope. That makes cloud identity posture, including the roles held by workloads, CI pipelines and other non-human identities, part of M1016 rather than a separate exercise.
Techniques M1016 addresses
| Technique (tactic) | ATT&CK v20 usage text, paraphrased | What coverage has to mean | Who fixes it |
|---|---|---|---|
| T1190 Exploit Public-Facing Application (initial access) | Regularly scan externally facing systems and have procedures to patch rapidly when scanning or public disclosure reveals critical flaws | Every internet-facing asset is known and scanned, with a measured time from disclosure to fix | M1051 Update Software, M1048 Application Isolation and Sandboxing |
| T1210 Exploitation of Remote Services (lateral movement) | Regularly scan the internal network for available services to find new and potentially vulnerable ones | Unauthenticated discovery across internal ranges, compared with the asset inventory | M1051, M1030 Network Segmentation, M1042 Disable or Remove Feature or Program |
| T1195 Supply Chain Compromise (initial access) | Continuously monitor vulnerability sources and use automatic and manual code review tools | Dependency and build tool inventory checked against advisory feeds | M1013 Application Developer Guidance, M1051 |
| T1195.001 Compromise Software Dependencies and Development Tools | Same text as T1195 | Software composition analysis on every build, including CI actions and plugins | M1013 |
| T1195.002 Compromise Software Supply Chain | Same text as T1195 | Vendor advisories tracked for every installed product | M1051, vendor management |
In all five rows the per-technique text describes finding and reporting. The blocking control is a different mitigation, which is why M1016 coverage claims should always be paired with the mitigation that closes the finding.
Making scanning a mapped control
External surface (T1190)
- Inventory first: scan what attackers can see, not only what the CMDB lists. Certificate transparency, DNS and cloud provider asset lists find hosts that agent-based scanning misses. See the Attack Surface Management Guide.
- Cadence tied to exposure: internet-facing systems scanned at least weekly and re-checked within a day of a major advisory for a product you run.
- Remediation clock: record disclosure date, detection date and fix date for every finding on an external asset. That interval is the evidence ATT&CK's text asks for.
- Edge devices: VPNs, gateways and firewalls are T1190 targets that general scanners often cover poorly. See Vulnerability Management for Network Devices.
Internal services (T1210)
- Discovery scans: regular unauthenticated sweeps of internal ranges to find new listening services, then compare with what should exist.
- Authenticated scans: for depth on known hosts. These need scanner credentials, which are privileged non-human identities in their own right: store them in a vault, scope them to read-only where the scanner allows, restrict where they can log on, and rotate them. A scanner account with domain admin rights on every host is a lateral movement path waiting to be used. See Securing the SAST, SCA and code scanning tool itself for the same principle applied to code scanners.
Supply chain (T1195 and sub-techniques)
- Software composition analysis on every build against an advisory database such as OSV. See OSV and Open Source Vulnerability Databases.
- Software bills of materials for what you ship and, where vendors provide them, for what you buy, so a new advisory can be matched in minutes. See the SBOM Guide.
- Development tools: include CI plugins, actions, IDE extensions and build servers in the inventory. Build servers are a recurring target, as the TeamCity CVE-2023-42793 exploitation showed.
Cloud posture and identity
Following ATT&CK's description, include cloud posture findings (public storage, permissive roles) in the same queue and the same service levels as CVE findings. Overly permissive roles on workloads and pipelines are the cloud equivalent of an unpatched service.
Prioritisation that matches the techniques
| Signal | What it tells you | Source | Use in M1016 |
|---|---|---|---|
| Known exploited | Exploitation has been observed | CISA KEV catalogue (1,754 entries, 361 marked as known ransomware use, as of the 21 October 2026 release) | Fix first on any exposed asset. See the CISA KEV Catalogue Guide |
| Exploit likelihood | Probability of exploitation activity in the next 30 days, published daily for every CVE | FIRST EPSS | Order the non-KEV backlog. See the EPSS Guide |
| Severity | Technical impact; CVSS v4.0 adds Threat and Supplemental metric groups and the CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE labels | FIRST CVSS | Tie-breaker, adjusted with environmental metrics. See the CVSS v4 Guide |
| Exposure | Reachable from the internet or from user networks | Asset inventory and network data | Separates T1190 from T1210 service levels |
| Identity impact | Flaw leaks credentials, sessions or keys | Advisory text | Add credential revocation to the fix |
Rolling it out
- Define the asset scope: external, internal, cloud accounts, code repositories and build systems, each with an owner.
- Close discovery gaps: compare scanner-seen assets with inventory in both directions and fix the difference before tuning anything else.
- Set service levels by technique: stricter for KEV-listed findings on external assets (T1190) than for internal ones (T1210); document them and the exception process.
- Pilot authenticated scanning on one server group, confirm credential scope and performance impact, then extend. Roll back by removing the credential from the scan policy.
- Connect to ticketing with automatic assignment by asset owner, and re-scan to verify closure rather than trusting the ticket.
- Add the identity step: for flaws that leak secrets or sessions, the runbook includes rotation and session revocation. See the Emergency Out-of-Band Patching Playbook.
What M1016 does not stop
- Zero-days: scanners match known flaws. Exploitation before disclosure needs isolation, least privilege and detection.
- Malicious updates from trusted suppliers: a backdoored release is not a known vulnerability when it ships. Composition analysis flags it only after an advisory exists.
- Stolen credentials and valid accounts: a fully patched estate still falls to a leaked key; that is T1078 territory.
- Assets nobody told the scanner about: shadow cloud accounts and unmanaged SaaS stay invisible until inventory catches up.
Common failure patterns
- Patching without revoking: in CitrixBleed (2023) upgrading stopped new session cookies leaking, but stolen cookies stayed valid, and Citrix told customers to kill all active and persistent sessions after upgrading.
- Counting scans, not fixes: coverage dashboards show 100% scanned while critical external findings sit open for months.
- Over-privileged scanner accounts: one domain-wide credential used on every host, never rotated.
- CVSS-only queues: thousands of high-severity internal findings bury the handful of KEV entries on the perimeter.
- Build systems excluded: CI servers and runners left out of scope because they belong to engineering.
- Cloud posture handled elsewhere: public buckets and permissive roles tracked in a separate tool with no service level.
Measuring coverage
Metrics and target directions are NHI Mgmt Group recommendations.
| Metric | Technique evidence | Target direction |
|---|---|---|
| Share of internet-facing assets scanned in the last 7 days | T1190 | Towards 100% |
| Median days from disclosure to fix for KEV-listed findings on external assets | T1190 | Falling |
| New internal listening services found that were not in inventory, per month | T1210 | Falling after the first quarter |
| Share of builds with composition analysis and an SBOM | T1195.001 | Towards 100% |
| Findings that leaked credentials where rotation was recorded | T1190, T1078 follow-on | 100% |
| Scanner credentials rotated within policy | T1210 (scanner as path) | 100% |
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | RA-5, RA-5(2), RA-5(5), SI-2, CM-8 | Vulnerability monitoring and scanning, updating scanned vulnerabilities, privileged access for scanning, flaw remediation, component inventory |
| NIST CSF 2.0 | ID.RA-01, ID.AM-01 | Vulnerabilities identified and recorded; hardware inventories maintained |
| CIS Controls v8.1 | Control 7 Continuous Vulnerability Management | See the CIS Control 7 guide |
| NIST SP 800-40 Rev. 4 | Enterprise patch management planning | Treats patching as preventive maintenance; the remediation half of M1016 |
Practitioner checklist
- Map M1016 claims to its five v20 techniques and name the mitigation that closes each finding.
- Reconcile scanner-seen assets with inventory, including cloud accounts and build systems.
- Scan internet-facing assets at least weekly and after every major advisory for products you run.
- Run regular internal discovery sweeps for new listening services.
- Prioritise KEV, then EPSS, then CVSS with environmental context.
- Vault, scope and rotate scanner credentials.
- Add session and secret revocation to the fix for credential-leaking flaws.
- Bring cloud posture findings, including permissive roles, into the same queue and service levels.
- Report time to fix, not scan counts.
Standards and references
- MITRE ATT&CK: Vulnerability Scanning (M1016)
- CISA: Known Exploited Vulnerabilities Catalog
- FIRST: Exploit Prediction Scoring System (EPSS)
- FIRST: Common Vulnerability Scoring System v4.0
- NIST: SP 800-40 Rev. 4 Guide to Enterprise Patch Management Planning
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Vulnerability Scanning Guide · Exposure Management and CTEM Guide · Exploited Vulnerability Breaches · MITRE ATT&CK Coverage Mapping Guide