External vs. internal security scans: what each can see
A public website may look quiet while an internal network has services that need attention. The reverse is possible too. Scan placement determines which paths the scanner can observe.
External: the view from outside
Torva Edge checks verified domains, their confirmed hostnames and selected public addresses. It reads DNS and HTTPS signals and checks selected public TCP ports where allowed. This can reveal a missing mail record, a certificate or web configuration problem, a responding public service, or a service whose reported version has known vulnerabilities (CVEs). Complete adds a weekly scan of all 65,535 TCP ports. Edge cannot see private IP ranges or establish how the service is authenticated.
Internal: the view from the approved network
Torva Core uses an agent on a machine with reachability to approved internal ranges. It can discover responsive devices and perform its supported network checks on devices within licensed coverage. VLAN routing, firewall policy, host availability and the agent’s position affect what it sees. It records supported configuration observations from that approved network position, including software versions with known vulnerabilities. Neither Edge nor Core logs in to your systems, so neither confirms which patches are installed.
Pick a first step
- If your immediate concern is a public website, mail domain or open internet-facing service, start with Edge.
- If you need visibility into office or server VLANs and the devices the agent can reach, start with Core.
- If both matter, Complete combines the supported views and adds remediation documentation. Check the current coverage page before assuming any specific control is tested.
Ask the coverage question
For every finding, ask: “Which hostname or IP was checked, from where, at what time, and what did it actually observe?” For every clean result, ask whether the relevant asset was in scope and reachable. This prevents a reassuring score from being mistaken for a complete security assessment.
The scan versus penetration test guide explains when hands-on testing is appropriate.
Choose the scope that fits. Compare Edge, Core and Complete and read the coverage details.
Further reading
Keep learning
Several hostnames, one IP address: how to read a security scan · Why configuration can drift after an update or hardware change · All guides