How do compliance vuln scanners work, really?

I’m normally very forensics-obsessed but recently [expanded my focus](https://www.reddit.com/r/cybersecurity/comments/xiayvl/heres_why_business_operations_communication_and/?utm_source=share&utm_medium=ios_app&utm_name=iossmf) to the Risk Management world. Particularly in the realm of compliance with government regulations, a central point of focus in RM is vulnerability scan results. The problem is that an organization can, after one of these automated scans, have many thousands of CVEs to deal with.

Some of the qualities I’ve heard repeated:

- Not all of the returned vulnerabilities are exploitable.

- Not all of them are accurate.

And I’m …

compliance cybersecurity scanners vuln work