Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

Security Scanning Is Not Risk Analysis
Many IT decision makers assume that performing a security vulnerability assessment is the same thing as risk analysis. However, these two processes are very different. (2002)