Design a vulnerability scanning platform
PremiumSecurity systemMedium
- CVE
- SBOM
- CVSS
Quick answer
This security system interview question asks you to design a vulnerability scanning platform. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a vulnerability scanning platform for a company with 60,000 servers, 20,000 container images and 5,000 code repositories, like the scanners security teams run across cloud estates. It finds known vulnerabilities (CVEs), ranks them and tracks each fix. The hard parts are full asset coverage, ranking millions of findings and scanning safely.
Today three separate tools each produce their own list, the same CVE shows up 40,000 times, and teams ignore the reports. When a widely exploited vulnerability is announced, nobody can say within a day which systems are affected.
What must a vulnerability scanning platform do?
- One asset inventory: Keep hosts, images, repos and internet-facing endpoints in one inventory from cloud APIs, agents and registries, each with an owning team.
- Find vulnerabilities: Match installed packages and versions on every asset against CVE advisories (national, OS vendor and language ecosystem databases) every day.
How well must it do it?
- Coverage: 98% of running assets scanned in the last 24 hours.
- Safety: Scans never cause an outage; network scans respect per-target rate limits and change freezes.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- CVE
- SBOM
- CVSS
- EPSS
- CISA KEV
- Container image scanning
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a vulnerability scanning platform and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team