Scan Policies, Scan Zones, and Credentialed Scanning
Policies
A scan policy is a template plus plugin families, scan settings, and credentials. Templates (Basic/Advanced Network Scan, Host Discovery, Malware, Web Application, and compliance templates such as PCI DSS or DISA STIG) pre-set plugin families that you narrow or widen. Compliance scans use audit files on supported platforms and report pass/fail rather than vulnerabilities. Performance settings (max concurrent hosts, max checks per host) trade speed for reliability, and safe checks suppress plugins that can destabilize fragile devices.
Scan zones
A scan zone is a named object holding one or more scanners plus the IP ranges (CIDR) those scanners may reach. At launch you choose a zone, and SC selects a scanner in that zone covering the target. If no scanner in the chosen zone covers the target IPs, the scan errors - the most common why-will-this-not-run question. A scanner can belong to several zones.
Credentials
Credentials are stored centrally (managed by the Credential Manager role) and must be attached to the policy or supplied at launch. Windows uses SMB with administrative rights; Unix uses SSH with password or key plus privilege escalation. Credentials unlock local checks - patch auditing, configuration, compliance - and sharply reduce false positives. Verify with plugin 19506 (Nessus Scan Information), whose output reports credential success or failure per host.
Traps
A scan happily completes uncredentialed and still looks successful. Filtering firewalls hide hosts unless host discovery tests multiple ping methods (ICMP, TCP, ARP, UDP). Policies and zones are organization-scoped.
Rule of thumb: if results look thin, read plugin 19506 for credential failure before touching the policy.