FAQ - Scan365.ai | Cybersecurity Knowledge Base

❓

Is Any Environment Completely Secure?

The most common question in cybersecurity

FAQ #1

No environment is completely free of vulnerabilities. The vulnerabilities differ depending on whether you are assessing a web application, cloud infrastructure, SaaS platform (such as Microsoft 365 or Google Workspace), identity systems, or APIs.

Below is a professional classification similar to what is used by penetration testers, cloud security engineers, and security architects worldwide. Scan365.ai automates the detection of many of these vulnerabilities for your organisation.

🌐

Scan365 Free

Scans Web App and Email Security vulnerabilities automatically

☁️

Scan365 Pro

Adds Microsoft 365, ACSC Essential Eight, Cloud and Infrastructure scanning

🚀

Coming Soon

Google Workspace, AWS, GCP, Mobile App, and Container scanning

1

🌐

Web Application Vulnerabilities

OWASP Top 10 + Common Issues · Scanned automatically in Free plan

FREE SCAN

Scan365.ai automatically detects many of these vulnerabilities during your Website and Domain scan. Results include SSL, headers, outdated software, and configuration issues.

💉Injection9▼

SQL Injection (SQLi)Free
NoSQL Injection
LDAP Injection
XPath Injection
OS Command Injection
Server-Side Template Injection (SSTI)
XML Injection
CRLF Injection
Email Header Injection

📝Cross-Site Scripting (XSS)4▼

Stored XSSFree
Reflected XSS
DOM-based XSS
Mutation XSS

🔐Authentication8▼

Weak passwordsFree
Credential stuffing
Password spraying
Brute-force attacks
Session fixation
Session hijacking
Broken MFA implementation
Weak password reset processFree

🚫Authorization6▼

Broken Access Control
IDOR (Insecure Direct Object References)
Privilege escalation
Horizontal privilege escalation
Vertical privilege escalation
Forced browsing

🍪Session Management6▼

Predictable session IDs
Session timeout issues
Missing Secure cookieFree
Missing HttpOnly
Missing SameSite
Token leakage

🔒Cryptography7▼

Weak encryption
Hardcoded secrets
Weak TLSFree
Deprecated SSLFree
Missing HSTSFree
Poor key management
Weak hashing (MD5, SHA-1)

📎File Upload5▼

Arbitrary file upload
Malicious image upload
Double extension upload
ZIP Slip
Path traversal via uploads

🔌API Security7▼

Broken Object Level Authorization (BOLA)
Broken Function Level Authorization
Excessive Data Exposure
Mass Assignment
Rate limiting bypassFree
API key exposure
JWT vulnerabilities

⚙️Server-Side7▼

SSRF
XXE
Deserialization
Buffer Overflow
Race Conditions
HTTP Request Smuggling
HTTP Response Splitting

💼Business Logic5▼

Coupon abuse
Price manipulation
Workflow bypass
Account takeover
Payment bypass

2

☁️

Cloud Platform Vulnerabilities

Azure · AWS · Google Cloud · Oracle Cloud · Alibaba Cloud

PRO SCAN

Applicable to Azure, AWS, Google Cloud Platform, Oracle Cloud, and Alibaba Cloud. Scan365 Pro scans your Microsoft Azure configuration for these vulnerabilities.

👤Identity6▼

Excessive IAM permissionsPro
Privilege escalation
Inactive accountsPro
Shared administrator accounts
Missing MFAPro
Stale credentials

💾Storage5▼

Public storage bucketsPro
Public blobs
Exposed snapshots
Unencrypted storage
Backup exposure

🌐Network7▼

Open security groups
Open firewall rules
Exposed RDP (3389)
Exposed SSH (22)
Open databases
Misconfigured VPN
DNS exposure

⚡Compute5▼

Unpatched virtual machinesPro
Container escape
Weak Kubernetes RBAC
Docker daemon exposure
Insecure images

🔑Secrets5▼

Secrets in GitHub
Secrets in source code
Exposed API keys
Exposed service principals
Hardcoded passwords

👁️Monitoring5▼

Missing loggingPro
Disabled audit logsPro
Disabled Defender
No SIEM integration
Missing alerting

3

🪟

Microsoft 365 Security Vulnerabilities

Identity · Exchange · SharePoint · Teams · Entra ID · Defender

PRO SCAN

Scan365 Pro performs a Microsoft 365 and Cloud audit checking these common attack vectors including identity, collaboration tools, and Defender configuration.

👤Identity8▼

No MFAPro
Weak Conditional AccessPro
Legacy Authentication enabledPro
Password Hash Sync attacks
Pass-the-Cookie
OAuth abuse
Token theft
Guest account abusePro

📬Exchange Online5▼

Mailbox forwardingPro
Malicious inbox rules
Auto-forwarding to external usersPro
SMTP relay abuse
Shared mailbox abuse

📁SharePoint Online5▼

Anonymous sharingPro
Public links
Oversharing
External sharingPro
Sensitive document exposure

💬Microsoft Teams4▼

Guest abuse
Phishing
External federation abuse
Malicious apps

🆔Entra ID (Azure AD)6▼

Weak Conditional AccessPro
Insecure app registrations
Service Principal abuse
PIM not enabledPro
Excessive Global AdministratorsPro
Consent phishing

🛡️Microsoft Defender4▼

Safe Links disabledPro
Safe Attachments disabledPro
Anti-phishing disabled
Missing Attack Simulation Training

4

🔵

Google Workspace Vulnerabilities

Gmail · Drive · Cloud Identity · Google APIs

COMING SOON

Google Workspace scanning is on the Scan365 roadmap. Currently you can manually review these vulnerabilities against your Google Workspace environment.

👤Identity5▼

No MFASoon
Weak password policy
Third-party OAuth abuse
Inactive users
Admin privilege abuse

📧Gmail6▼

Email spoofingFree
SPF misconfigurationFree
DKIM missingFree
DMARC missingFree
Malicious forwarding rules
Phishing

📁Google Drive5▼

Public sharing
External sharing
Sensitive files
Link sharing
Data leakage

🔌Google APIs3▼

Exposed API Keys
Service Account misuse
OAuth abuse

5

🔷

Azure-Specific Vulnerabilities

Storage · RBAC · Key Vault · AKS · Logic Apps · Conditional Access

PRO SCAN

🔷Azure Vulnerabilities15▼

Public Blob StoragePro
Overprivileged RBACPro
Azure Key Vault misconfiguration
Managed Identity abuse
Azure Automation abuse
VM Managed Identity abuse
Open NSGsPro
Open Load Balancers
Azure Functions exposure
Logic App exposure
Weak Conditional AccessPro
PIM not enabledPro
Azure Arc misconfiguration
AKS misconfiguration
Storage Account SAS token exposure

6

🟠

AWS & Google Cloud Vulnerabilities

S3 · IAM · Lambda · EC2 · Cloud Storage · Service Accounts

COMING SOON

🟠AWS Vulnerabilities10▼

Public S3 bucketsSoon
IAM privilege escalation
Lambda privilege escalation
EC2 metadata attacks
EKS misconfiguration
Security Group exposure
Open RDS
Open Redis
CloudTrail disabled
Secrets Manager misconfiguration

🔴Google Cloud Vulnerabilities8▼

Public Cloud Storage bucketsSoon
Excessive IAM permissions
Cloud Run exposure
Kubernetes RBAC issues
Service Account abuse
Metadata Server abuse
Open Firewall Rules
Secret Manager exposure

8

📦

Container and Kubernetes Vulnerabilities

Docker · Kubernetes · AKS · EKS · GKE

PRO SCAN

📦Container and K8s Issues11▼

Container escape
Privileged containersPro
Host networking
Root containers
Insecure imagesPro
Secrets in images
Kubernetes Dashboard exposure
etcd exposure
Weak RBACPro
Admission controller disabled
Pod Security Standards not enforced

9

🌍

DNS and Network Vulnerabilities

Takeover · TLS · Certificates · Zone Transfer

FREE SCAN

Scan365 Free plan automatically checks your domain for DNS takeover risk, TLS configuration, HSTS and certificate issues.

🌍DNS and Network Issues9▼

DNS takeoverFree
Subdomain takeoverFree
Open DNS resolver
Zone transfer
DNS cache poisoning
Weak TLS configurationFree
Missing HSTSFree
Weak ciphersFree
Certificate issuesFree

10

📧

Email Security Vulnerabilities

SPF · DKIM · DMARC · BEC · Phishing

FREE SCAN

Scan365 Phishing Risk Score module (Free plan) checks all email authentication records including SPF, DKIM, DMARC and identifies email spoofing vulnerabilities.

📧Email Security Issues8▼

SPF missingFree
DKIM missingFree
DMARC missingFree
Open relay
Email spoofingFree
Business Email Compromise (BEC)
Mailbox forwarding abuse
QR-code phishing (Quishing)

11

📱

Mobile Application Vulnerabilities

iOS · Android · OWASP Mobile Top 10

COMING SOON

📱Mobile App Issues8▼

Insecure storageSoon
Root detection bypass
Certificate pinning bypass
Weak encryption
API exposure
Hardcoded credentials
Reverse engineering
Insecure local database

12

🖥️

Infrastructure Vulnerabilities

Patching · RDP · SSH · SMB · Default credentials

PRO SCAN

🖥️Infrastructure Issues10▼

Missing security patchesPro
Unsupported operating systemsPro
Weak administrator passwords
SMB vulnerabilities
RDP exposurePro
SSH misconfiguration
Default credentials
SNMP exposure
FTP/Telnet enabled
NFS exposure

13

📋

Common Vulnerability Frameworks

OWASP · MITRE · NIST · CIS · Microsoft · AWS · Google

REFERENCE

Security professionals assess against these globally recognised frameworks. Scan365 Pro reports reference OWASP, ACSC Essential Eight, NIST and CIS benchmarks in every scan.

🌐

OWASP Top 10

Web Application security risks

🔌

OWASP API Security Top 10

API-specific vulnerabilities

📱

OWASP Mobile Top 10

Mobile application risks

⚔️

MITRE ATT&CK

Adversary tactics and techniques

🗺️

MITRE CAPEC

Common attack pattern enumeration

📝

MITRE CWE

Common weakness enumeration

🔍

CVE

Common Vulnerabilities and Exposures

📏

CIS Benchmarks

Security configuration standards

🏛️

NIST CSF

Cybersecurity Framework

📖

NIST SP 800-53

Security and privacy controls

🚨

NIST SP 800-61

Incident Response

🟦

Microsoft Security Benchmark

Azure security baseline

🟠

AWS Well-Architected

Security Pillar framework

🔴

Google Cloud Security

Security Foundations framework

🎯

Six Security Domain Methodology

Enterprise security assessment framework for Microsoft Azure, M365, AWS and Google Cloud

For organisations with Microsoft infrastructure, Azure, Microsoft 365 and cloud engineering, a practical approach is to organise assessments into six security domains. Scan365.ai maps its scan results to these domains.

Domain	Examples	Scan365 Coverage
🔐Identity and Access	MFA, Conditional Access, RBAC, Privileged Identity Management, OAuth, service accounts	Pro
🌐Network	Firewalls, NSGs, VPNs, WAFs, segmentation, DDoS protections	Free Pro
🔒Data Protection	Encryption, Key Vault, DLP, information protection, backup security	Pro
⚡Compute and Applications	Virtual machines, containers, Kubernetes, serverless functions, web applications, APIs	Free Pro
👁️Monitoring and Detection	SIEM, audit logging, Microsoft Defender, Google Security Center, CloudTrail, alerting	Pro
📋Governance and Compliance	CIS Benchmarks, NIST, ISO 27001, policy enforcement, vulnerability management	Pro

Cybersecurity FAQ
and Vulnerability Guide

Ready to Scan Your Organisation?

Cybersecurity FAQand Vulnerability Guide

Ready to Scan Your Organisation?

Cybersecurity FAQ
and Vulnerability Guide