Security Scanners and VCF
Broadcom, Thursday, October 8th, 2026
VMware explains why vulnerability scanner findings for VCF need context and what teams should and should not do about them.
Day 6 of VMware's Cybersecurity Awareness Month series examines the friction security scanners create between security, infrastructure and audit teams.
It explains how network, authenticated and agent-based scanners see different things, and why many findings for VMware Cloud Foundation turn out not to be real problems because scanners lack context.
The post also addresses tension over authenticated scans via SSH, which VMware recommends keeping disabled in VCF except for troubleshooting, and lays out better ways to handle scan results.