A method comprising: providing one or more scanners in a private network , each scanner including a scan engine and a configuration agent ; establishing a first secure tunnel between a configuration manager and a further scanner , and a second secure tunnel between a scan controller and the further scanner , wherein the further scanner is located in a public network and the configuration manager and the scan controller are located in the private network , wherein the further scanner includes a further scan engine and a further configuration agent , wherein the first secure tunnel is distinct from the second secure tunnel ; communicating scanner configuration information between the further scanner and the configuration manager over the first secure tunnel ; and communicating scan information between the further scanner and the scan controller over the second secure tunnel , including providing, by the scan controller , one or more scan instructions to the further scan engine , wherein the scan controller and the configuration manager communicate with the one or more scanners located in the private network , including providing, by the scan controller , one or more scan instructions to at least one scan engine and providing, by the configuration manager , scanner configuration information to at least one configuration agent over dedicated internal network connections in the private network , wherein each scan engine of the one or more scanners and the further scanner is configured to scan one or more assets (20A-C) according to the scan instructions dictated from the scan controller . providing one or more scanners in a private network , each scanner including a scan engine and a configuration agent ; establishing a first secure tunnel between a configuration manager and a further scanner , and a second secure tunnel between a scan controller and the further scanner , wherein the further scanner is located in a public network and the configuration manager and the scan controller are located in the private network , wherein the further scanner includes a further scan engine and a further configuration agent , wherein the first secure tunnel is distinct from the second secure tunnel ; communicating scanner configuration information between the further scanner and the configuration manager over the first secure tunnel ; and communicating scan information between the further scanner and the scan controller over the second secure tunnel , including providing, by the scan controller , one or more scan instructions to the further scan engine , wherein the scan controller and the configuration manager communicate with the one or more scanners located in the private network , including providing, by the scan controller , one or more scan instructions to at least one scan engine and providing, by the configuration manager , scanner configuration information to at least one configuration agent over dedicated internal network connections in the private network , wherein each scan engine of the one or more scanners and the further scanner is configured to scan one or more assets (20A-C) according to the scan instructions dictated from the scan controller . <EOS>