How a vulnerability scanner works