Comparing the Best Free Vulnerability Scanners
This video explores the best free vulnerability scanners available today, specifically comparing Nessus Essentials and OpenVAS (also known as Greenbone). Hackers are experts at finding tiny gaps in your security, so using these tools allows you to find and fix those gaps before they can be exploited.
What is a Vulnerability Scanner?
A vulnerability scanner is a tool that checks for a list of known security problems. It is important to distinguish these from:
• Patch Scanners: While missing updates cause vulnerabilities, many issues are caused by poor configuration choices that an update won't fix.
• Penetration Tests: A scanner is like checking if your doors and windows are locked; a penetration test involves a skilled human looking for less obvious ways in, such as social engineering.
The Contenders: Nessus vs. Greenbone (OpenVAS)
Both companies offer commercial products with powerful free versions:
• Nessus Essentials: The primary limitation is a 16-host limit. However, it provides nearly all the features of the paid version and a superior, user-friendly interface that helps novices identify "low-hanging fruit" for remediation.
• Greenbone (OpenVAS): This tool has no limit on the number of hosts you can scan. It is available as an Enterprise Trial (a virtual appliance) or a Source Edition. For long-term use, the Source Edition (available via Kali Linux) is recommended to ensure you receive platform updates.
Performance and Detection Results
In head-to-head testing, the two scanners showed different strengths:
• Outdated Systems: Both tools successfully identified hundreds of vulnerabilities on an old, end-of-life Drupal server, with Greenbone providing slightly better coverage.
• Modern Misconfigurations: Nessus outperformed Greenbone in detecting "planted" configuration issues on patched servers. It successfully flagged unquoted service paths and disabled Network Level Authentication on Windows, which Greenbone missed.
• False Positives: Nessus is more prone to false positives, particularly on Linux distributions like Rocky Linux, because it sometimes fails to account for security fixes backported by distributors.
Final Verdict
• Use Nessus Essentials if you have 16 hosts or fewer. It offers the best user experience and more comprehensive detection for configuration-based vulnerabilities.
• Use Greenbone if you need to scan more than 16 hosts for free, as it does not have a hard stop on the number of devices it can assess.