Sees only what is exposed on the network - Identifies vulnerabilities in network-facing services - Misses local vulnerabilities (missing OS patches, local misconfigurations) - Faster, simpler setup - Simulates an external attacker's view