Looking for vulnerability scanning tools — what can I run myself in an 8-person team without breaking anything?

You absolutely must separate active from passive scanning. If you attach aggressive fuzzers or heavy request modules to web forms and login pages, you'll lock the database. For network-level port scans, throttle the requests per second. On the web app side, never run scans against a production database; always test on a staging environment mirrored from prod.

You can't pass an audit with an enterprise German client using a scan report you generated yourself. An auditor won't accept "we ran an internal scan and came out clean"; they look for an independent sign-off and an established methodology. Besides, most of the hundred-page report generated by the tool ends up being false positives, and weeding those out requires expert knowledge anyway.

edit: I wrote something wrong above, sorry about that.

Follow these steps to run the scan safely: 1) Back up the production database restore it in a staging environment, and point the scan exclusively at this test address. 2) Rate-limit the scanner to a maximum of 3 to 5 requests per second. 3) Keep a real-time server resource monitoring dashboard open before kicking off the scan.

we tried running it on prod last year and the contact form ended up generating eight hundred empty support tickets in two hours. btw notification systems completely choked so definitely exclude form fields from the scan or stick to a test server.

Make sure to take these three precautions when setting up free and open-source engines: 1) Stick strictly to information gathering and passive analysis modes, and disable exploit or denial-of-service tests. 2) Blacklist any URLs for forms that trigger emails or send SMS messages. 3) Schedule the scan outside of business hours, around midnight.

In our team of eight, we run automated weekly dependency scans. When we first set it up, we found 14 critical vulnerabilities in our third-party packages. We patched them all in 3 days just by bumping versions, significantly slashing our risk without sending a single test packet to the server.

When we install and run these tools on the server, do they leave behind any persistent files or agent software that could create security holes, or does everything revert back to how it was once the scan finishes?

Don't touch the production machine at all. Run an open-source static code analysis tool on your local machine for your codebase. As for the server OS, just run your package manager's command that lists security updates. That solves half the problem with zero risk.

You're right.

Here's how it went for us. Solutions that work at a small scale collapse when you grow; I learned this late.

The discussion got scattered, let me summarize. Don't hesitate to ask; those who don't ask always pay more.

Most incidents start with a leaked password, not a vulnerability.

Noted thanks.

Let me summarize what's been said so far. When making decisions, write down the worst-case scenario too, not just the best.

I'd say don't rush. Payment information changes are never verified through the channel they came from.

Sorry, but this doesn't apply in every case. Payment information changes are never verified through the channel they came from.

Correct me if I'm wrong.

Sorry, but this doesn't apply in every case. The real issue isn't the number, but what it's based on.

I agree.

There's a part I don't understand. Security isn't absolute; it's about making attacks not worth the effort.

The real issue isn't the number, but what it's based on. Good luck with that.