Active scanning works by attempting to exploit potential vulnerabilities on devices. By sending packets directly to endpoints, active scanning can accelerate data collection. Medical Devices are risky to actively scan in the field because it can cause them to malfunction when in patient use (which could be deadly).

Passive scanning silently analyses network traffic to identify endpoints and traffic patterns. It does not generate additional network traffic and carries almost no risk of disrupting critical processes by interacting directly with the endpoints.