Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?

Daily vulnerability scans are primarily used to track the status of patching installations. By regularly scanning endpoints, an organization can identify missing patches or misconfigurations that could lead to vulnerabilities. This helps ensure that security updates are being applied effectively and consistently across the network, reducing the attack surface. While vulnerability scans can sometimes indirectly reveal unauthorized cloud deployments (shadow IT) if they expose misconfigured services, their main purpose isn't to discover them. Similarly, they are not designed for continuous hardware inventory monitoring, though they might collect some system information. Actively hunting for attackers typically involves more advanced tools like EDR (Endpoint Detection and Response) or SIEM (Security Information and Event Management) systems, rather than routine vulnerability scanning.