Hi @piochfinder, thanks for the question.
I can't speak for Armis, as I don't know how their solution works intrinsically but I am able to talk a little about our difference with the Big 3 (Qualys, Tenable, and Rapid7).
Typically, a vulnerability scanner will do some element of discovery in order to identify characteristics of the asset and then use this information to determine which "tests" to try. The "tests" are typically used to identify whether a particular vulnerability/set of vulnerabilities are present on that asset. It is a little bit more targeted than a brute force, but essentially they have a big long list of "tests" and they try each one based on the characteristics they have found.
Lansweeper is different. We correlate the asset information with the vulnerability data using only the data that we have gathered, we don't perform any of those tests I spoke of. Technically, this is called CPE correlation.
It is typically accepted that CPE correlation is prone to more false positives, having said this though, we have spent a lot of time working on this:
- We have implemented a feature called confidence which removes vulnerabilities from the main list based on whether the CPE we receive from our data provider utilises many wildcards.
- We have also created our own correlation engine that allows us to cross correlate multiple CPE's together, which is something that isn't common across the industry.
- We have been working tirelessly for years on our on-the-fly software normalization capabilities that assist us in create our own CPE catalogue for the assets we identify.
- We recently partnered with VulnCheck and VulDB who provide us with more accurate data.
- We only identify vulnerabilities on assets where we the ability to authenticate.
I hope this helps!
P.S. regardless of how you have the scanning setup e.g. agent vs. agentless, as long as we have a way to authenticate, we will identify vulnerabilities.
