Ann, a security analyst, is preparing for an upcoming security audit. To ensure that she identifies unapplied security controls and patches without attacking or compromising the system, Ann would…

Vulnerability scanning uses automated tools to compare a system's current configuration and patch level against a database of known vulnerabilities, identifying missing controls and patches in a non-destructive manner. It does not attempt to exploit findings, meaning it will not compromise the system - exactly the constraint described in the question. This distinguishes it from penetration testing, which actively attempts exploitation to confirm impact.

SQL injection is an active attack technique that attempts to exploit database vulnerabilities and would compromise or damage the system being tested.

Penetration testing involves actively attempting to exploit vulnerabilities to confirm their impact, which by definition involves attacking or compromising the target system.

Updating antivirus software addresses malware protection but does not identify unapplied patches or missing security controls across the broader environment.