Run both. The agent gives you depth and reports in near real-time; periodic authenticated scanning adds the network-facing view the agent can't see. This combination covers the bulk of what you own.

Routers, switches, and firewalls can't run an agent, so they're assessed by scanner appliances.

Covered by agents and scanners, plus additional cloud-only options: agentless, API-based assessment that reads instance state through the cloud provider APIs, and snapshot-based assessment that evaluates a point-in-time copy of the virtual machine.

Often too fragile to probe actively. Assessed passively instead - a passive sensor watches network traffic and infers what's present and what's vulnerable without sending packets at the devices themselves.