ESD susceptibility scanning essentially works in the reverse manner.
ESD susceptibility scanning techniques build on well known EMI scanning methodologies.
Rather than acting as a receiver, the scanning probe is driven by a special TLP pulser at each step over a running system or PCB. The intensity of the pulse is increased until a sufficient local noise pulse coupled into the system upsets the normal operation of the device, similar to the failure criteria defined for system level ESD testing (i.e. system resets, data loss, lockup, etc.)
Plotting these values creates a "susceptibility map" which indicate areas of relative potential ESD susceptibility, or "hotspots."
This does not necessarily imply a system level vulnerability, but it may indicate one of many ESD entry vectors.
Standards for ESD scanning are under consideration in the ESD Association Working Group 14 among other bodies.