CREDENTIALED pre-port discovery lets a scan engine skip outside-in probing and instead ask the host which ports it is listening on, provided the engine already has valid credentials for that host. Where a credential matches, the engine connects to the port used by that credential, authenticates, and the host returns an authoritative list of open TCP and UDP ports. This replaces inference with an inside-out view and avoids probing delays or misreads caused by firewalls, rate limiting, or hardened systems. If authentication fails or no suitable credential exists, the host falls back to a traditional network port scan as before.
Three key considerations accompany enabling this feature. First, pre-port discovery can reveal ports that a firewall or other controls would otherwise block from reach, potentially yielding fewer results and extending scan times on those hosts. Second, SSH and the Scan Assistant are attempted on their standard ports (TCP 22 and TCP 21047) unless you specify a different port in the credential.
Third, credential coverage matters: hosts without a matching credential default to a network port scan, and such fallbacks aren’t treated as errors. The option is per-template and disabled by default, with the process being to enable on one template, compare results against the standard template, and widen if the port lists and scan durations align with expectations.
The feature prioritises environments where the scan engine has broad reach and existing authenticated access (SSH, Scan Assistant, or Windows credentials), especially on hardened or rate-limited hosts or large port ranges. It can coexist with standard templates for segmented or restrictive networks, allowing a targeted rollout starting with a single template.