Vulnerability scanning uses software to attempt to connect to hosts in the specified range of ports. When the scanner detects that the port is open, it will try to identify if the software opening the port on the server is vulnerable to a list of known vulnerabilities. If the system proves to be vulnerable, it is added to the report.
The information from a vulnerability scan can be used to either attack the system using known weaknesses or to create a list of vulnerabilities to be addressed.
They want your organization to be scanning your external systems so that vulnerabilities are discovered and addressed by you before they can be exploited.
It is expected that external vulnerability scanning is included in your security plans. You may include it in the vulnerability management plan or other policies.