Here is a question worth asking before any security test starts: does the tester need your domain admin password?
Many vulnerability scanners and testing tools ask for privileged credentials. They log in to each system, read the installed software and patch levels, and report back. That is called a credentialed or authenticated scan, and it has real value. It also has a cost that rarely gets discussed: one of your most powerful passwords is now typed into, stored by or sent across the network by another piece of software.
You can get a meaningful picture of your risk without starting there.
Credentialed vs non-credentialed scans
The two approaches answer different questions.
A credentialed scan logs in to each system with an account that has enough rights to read configuration and software details. It is good at finding missing patches, outdated software and local configuration issues, and it produces fewer guesses.
A non-credentialed scan, sometimes called unauthenticated, looks at systems from the network, the way an outsider would. It sees open ports, exposed services and anything an attacker could probe without logging in. It misses some internal detail, but it shows what is actually reachable.
A penetration tester would describe these as grey box and black box views. Neither one is wrong. The question is which one you start with, and what you hand over to get it.
The risk nobody puts in the proposal
Credentials are an attacker’s favorite shortcut. Verizon’s 2026 Data Breach Investigations Report found credential abuse was the initial way in for 13% of breaches and showed up somewhere in the attack in 39% (Verizon 2026 DBIR). Once an attacker has a privileged account, they no longer need to break anything. They just log in.
Scanning accounts are attractive targets because they usually have broad rights across many systems. SANS Internet Storm Center described a case where attackers on one compromised machine captured the authentication from a vulnerability scanner’s credentialed scan and reused it to move to more hosts (SANS ISC, The Risk of Authenticated Vulnerability Scans). The security tool became the path.
CISA and the NSA list poor credential hygiene and improper separation of user and administrator privileges among the ten most common misconfigurations they find in large networks (CISA and NSA advisory AA23-278A). Handing a shared admin password to an outside tool for convenience works against both.
None of this means credentialed scanning is bad. It means a test should not create a new way in while it is looking for the old ones.
How a credential-free test works
BTI’s free cybersecurity assessment and our Cyber Watch program start without admin credentials.
- You choose the machines. For the free assessment, that is 3 to 5 systems.
- A testing agent runs on those machines. The test starts without domain admin or other privileged passwords.
- The agent probes what it can reach from there. That models what an intruder could do after compromising a staff laptop or a trusted program, which is how many real attacks begin.
- An optional external scan checks what is exposed from the internet.
- You get a written report and a roadmap, ranked by real risk, and a readout with a senior BTI engineer.
The result shows what an attacker could actually do from a realistic foothold, not what an administrator can see. Testing is run with an independent testing partner, and findings are retested after fixes.
What a credential-free report shows leadership
Because the test starts from a realistic foothold, the findings read like an attacker’s to-do list rather than a patch inventory. Typical questions the report answers include:
- From a normal staff computer, which other systems can be reached, and which ones should not be?
- Are there stored passwords, shared drives or misconfigured services that would let an intruder raise their privileges?
- Which weaknesses chain together into a path toward sensitive data or administrator control?
- What is exposed from the internet, if the optional external scan is included?
- Which three to five fixes would close the most dangerous paths first?
That framing helps leadership fund the right work. It also gives your IT team or provider a short, ranked list instead of a long export. After fixes, the same paths are retested so everyone can see the risk actually went down.
When credentialed scanning makes sense
There are good reasons to add authenticated scans later, especially for detailed patch reporting or compliance evidence. When you do, set them up carefully:
- Use a dedicated scan account, never a shared or personal admin login.
- Grant the least privilege the scan needs, and scope it to the systems being scanned.
- Make it temporary or time-boxed where possible, and rotate the password after each cycle.
- Store it in a password vault, not in a spreadsheet or the scanner’s notes field.
- Alert on any use of that account outside the scan window.
- Turn on SMB signing and similar protections so captured authentication is harder to relay.
That way you get the patch detail without leaving a standing master key in another system.
Questions to ask before your next test
- Does this test require privileged credentials to start? Why?
- Where will those credentials be stored, and who can see them?
- Will the account be disabled or rotated when the test ends?
- Will the report show what an attacker could reach from a normal user’s machine?
- Who retests the findings after we fix them?
Local testing support in Los Angeles, Chicago and Phoenix
BTI’s engineers support organizations across Southern California, Chicagoland and Arizona and can coordinate on-site steps when a finding involves a physical device or branch network. See our Los Angeles, Chicago and Phoenix and Tucson cybersecurity pages. When findings call for fixes, they flow into BTI managed patching and vulnerability management, backed by our 24/7 NOC/SOC.
See what an attacker could reach, without handing over your keys
Get a free cybersecurity assessment or book a free consultation. Call the BTI IT team: Los Angeles 323-510-8003, Chicago 312-492-2613, Phoenix 480-272-8728.
Cybersecurity by industry
Critical infrastructure
Utilities and operational networks.
Critical infrastructure cybersecurity →Logistics
Warehouses, dispatch and multi-site networks.
Logistics cybersecurity →Construction
Job sites, project files and field devices.
Construction cybersecurity →Government
Public agencies and contract vehicles.
Government cybersecurity →Healthcare
Medical groups, pharmacies and dental practices.
Healthcare cybersecurity →Parking and venues
Payment, access and guest networks.
Parking and venues cybersecurity →
Frequently asked questions
What is the difference between a credentialed and a non-credentialed scan?
A credentialed scan logs in to each system with an account and reads software and configuration details. A non-credentialed scan looks at systems from the network without logging in, the way an outsider would. Credentialed scans see more detail. Non-credentialed scans show what is actually reachable.
Are credentialed scans risky?
They can be. The scan account usually has broad rights, and if an attacker captures or reuses it, the security tool becomes a path into more systems. Use a dedicated, least-privilege, time-limited account stored in a vault and monitored.
Can you do a penetration test without admin credentials?
Yes. BTI’s free assessment and Cyber Watch start without admin credentials. A testing agent runs on machines you choose and probes what it can reach, which models an attacker who has compromised a staff computer.
What is black box penetration testing?
It is testing with no inside knowledge or credentials, from the same starting point as an outside attacker. It shows what is exposed and reachable rather than what an administrator can see.
Should I ever give a tester credentials?
Sometimes, for detailed patch reporting or specific compliance evidence. When you do, create a dedicated account with only the rights needed, limit how long it exists and rotate it after the test.
