Logs into the host using provided credentials (SSH, SMB, WMI) - Examines installed software versions, patch levels, and local configurations - Identifies significantly more vulnerabilities (5-10x typical increase) - Can check for specific missing patches (KB articles on Windows, package versions on