Why a client's first vulnerability scan sets the baseline for future reports

The first vulnerability scan for a new client differs from later ones because there is no prior report for comparison, the asset inventory may be incomplete, and results often look worse than expected. A one-page scope note helps prevent surprises by defining what is included and excluded, the scan window, which credentials will be used, and written approval from an authorized party. Authorization matters because unapproved scanning can breach hosting contracts or violate the law. Scanner authentication results should be checked before trusting any numbers, since failed logins can make a credentialed scan look misleadingly clean. The initial report should show coverage, group findings into a small set of actions, prioritize a first wave of fixes, and record baseline totals that future reports will be measured against.