Is Internal Attack Surface Review a vulnerability scan?

“Partly. The sensor matches open ports and service versions against known vulnerabilities (CVEs), much like an unauthenticated vulnerability scan of the internal network. On top of that we map AD enumeration, SMB shares and poisoning risk and assess the findings in your context. Credentialed scanning and active exploitation are not included.”