Nessus Essentials Setup: 5 Free IPs in 12 Steps [2026]

Tenable shipped Nessus 10.12.5 on October 1, 2026, patching multiple vulnerabilities and, notably, beginning to require signed plugin archives from that release forward, a tightening of the update pipeline that followed close on the heels of 10.12.4’s August 19, 2026 release. The free Nessus Essentials tier that ships with it still confuses people who learned the product years ago. Older guides insist the free edition scans up to 16 IP addresses. Tenable’s current product page and its 10.12 documentation both say five. That single number changes how you plan a home lab, a small-office audit, or a certification study environment, and it’s the first thing this tutorial sets straight before walking through a full install.

This guide covers registering for an activation code, installing Nessus Essentials on Windows, Linux, or macOS, running a credentialed scan, reading CVSS and VPR scores correctly, and automating the whole workflow with the Nessus REST API. It also covers where the free tier stops working for you and what a step up to Nessus Essentials Plus, Nessus Professional, or an open-source alternative like OpenVAS actually costs in 2026.

Twelve steps, five-plus code blocks, and a full home-lab project sit between here and a working scanner. Whether you’re studying for a certification, doing your first authorized assessment of your own home network, or evaluating Nessus before recommending a paid tier to your employer, the process below assumes zero prior experience with vulnerability scanning and walks through every screen you’ll actually see.

What Nessus Essentials Actually Gives You for Free in 2026

Nessus Essentials is Tenable’s no-cost edition of its commercial vulnerability scanner, built on the same scan engine and plugin architecture as Nessus Professional and Nessus Expert. Tenable’s own documentation describes it plainly: “This free tier features high-speed asset discovery and vulnerability scanning for up to five IP addresses with a 30-day delayed plugin feed.” That delayed feed matters more than most tutorials admit, Essentials receives the same plugin checks as paid Nessus editions, just roughly a month after Tenable’s commercial customers get them. Tenable’s release cadence through 2026 has been unusually fast: 10.12.0 arrived in April 2026 and was listed in Tenable’s Q1 2026 Core release notes, followed by point releases on June 25 (10.12.1, which Tenable also included in the Core offline-update image), July 23 (10.12.2, with scanner stability fixes), August 3 (10.12.3, which fixed scanner offline and plugin-update issues), and August 19 (10.12.4) ahead of October 1’s 10.12.5, meaning an Essentials install that skips even one refresh cycle can drift behind several patched releases at once, not just one.

The five-IP cap is a hard ceiling per scanner instance, not a rolling monthly quota. If you scan five hosts on Monday and five different hosts on Tuesday, you’ve used ten distinct targets against a five-IP license, and Nessus will block the scan. Tenable also now sells Nessus Essentials Plus, a new low-cost annual license positioned above Essentials and documented for students, educators, and individuals: it raises the ceiling to 20 IPs, drops the 30-day plugin delay for real-time updates, and adds PDF reporting and concurrent scans. Verified students and instructors can claim a free one-year Essentials Plus license for coursework through Tenable’s education program.

For a home lab, a single subnet audit, or prepping for a certification like Security+ or eJPT, five IPs is workable. For anything resembling a small-business network assessment, you’ll hit the wall inside the first hour and need to either rotate targets deliberately or budget for Essentials Plus, Professional, or an alternative scanner. Vulnerability scanning is one piece of a larger defensive posture, alongside patch management, network segmentation, and the kind of threat monitoring covered across our broader cybersecurity coverage.

Prerequisites: Versions and System Requirements

Before you download anything, confirm your host machine actually meets Tenable’s published requirements. Undersized VMs are the single most common cause of scans that hang or time out, and it’s a five-minute check that saves an hour of troubleshooting later.

You’ll also need a web browser to reach the local Nessus interface (it runs on https://localhost:8834 by default), an email address for registration, and, if you plan to run credentialed scans, which you should, a low-privilege service account on the systems you’re targeting. Full details on the 30-GB baseline and per-OS breakdowns are on Tenable’s system requirements page.

Running Nessus inside a virtual machine is the most common setup for a home lab, and it works fine as long as you allocate resources honestly rather than accepting a hypervisor’s default. A VM configured with 2 vCPUs and 2 GB of RAM will technically boot Nessus, but plugin compilation on first launch can stretch past an hour and scans against even a single host may stall. Bump the allocation to 4 vCPUs and 8 GB before you start, and thin-provision the disk at 40 GB or more so you’re not fighting for space after your first few scans and plugin updates accumulate. If you’re running security software like an endpoint agent or a strict host firewall on the same machine, add an exception for the Nessus service and port 8834, antivirus tools occasionally flag the scanner’s own port-probing behavior as suspicious, which can silently degrade scan accuracy without throwing an obvious error.

Step 1–2: Register and Download the Right Package

Go to the Nessus Essentials product page and fill out the registration form with your name and a valid email address. Tenable’s instructions are exactly as blunt as the product itself: “Complete the registration form at the top of this page and follow the prompted steps for Nessus download and installation.” Within a few minutes you’ll get an email containing your activation code, save it somewhere durable, because you’ll need it again if you ever reinstall or move Nessus to a new machine.

From the same download page, pick the package that matches your host OS:

• Windows: a .exe installer
• Linux (Debian/Ubuntu): a .deb package
• Linux (RHEL/Fedora/CentOS): an .rpm package
• macOS: a .dmg disk image containing an installer .pkg

Match the architecture (x86_64 vs. ARM) to your hardware too, installing the wrong build is a common early mistake that produces a service that won’t start at all.

The activation email sometimes lands in a spam or promotions folder, especially if you registered with a work email behind aggressive filtering, check there before assuming the registration failed. If you don’t see it within about fifteen minutes, the registration page also offers a resend option rather than making you fill out the form a second time. It’s worth registering with an email address you’ll still control a year from now; Tenable ties the activation code to that address, and recovering it later means logging into Tenable’s account portal rather than simply re-reading an old email.

Step 3–4: Install and Launch Nessus Essentials

On Windows, run the .exe with administrative privileges, accept the license agreement, choose an install directory (the default is fine for most setups), and let the installer finish. It registers the Nessus service automatically and opens your browser to the local interface when done.

On Debian-based Linux, install the package and start the service manually:

sudo dpkg -i Nessus-10.12.4-debian10_amd64.deb
sudo systemctl start nessusd
sudo systemctl enable nessusd
sudo systemctl status nessusd

On RPM-based distributions, swap the install command but keep the same service steps:

sudo rpm -ivh Nessus-10.12.4-es8.x86_64.rpm
sudo systemctl start nessusd
sudo systemctl enable nessusd

On macOS, open the .dmg, double-click Install Nessus.pkg, and follow the standard macOS installer prompts. Nessus runs as a background service and, again, serves its interface over HTTPS on port 8834.

Whichever OS you used, open a browser and navigate to https://localhost:8834 (or the machine’s IP address if you installed on a headless server or VM you’re accessing remotely). Your browser will flag the self-signed certificate as untrusted, that’s expected for a local scanner, and you can safely proceed past the warning on a machine you control.

If the page never loads at all, confirm the service actually started before troubleshooting anything else. On Windows, open Services (services.msc) and look for “Tenable Nessus” in a Running state; on Linux and macOS, the systemctl status nessusd command from above should show active (running) rather than failed or inactive. A fresh install occasionally needs sixty to ninety seconds after the installer finishes before the web server is actually listening, so a blank or connection-refused page immediately after installation isn’t necessarily a real problem, wait a minute and refresh before digging into logs.

Step 5: Activate Nessus and Create Your Admin Account

On first load, Nessus asks you to choose a product type. Select Nessus Essentials, paste in the activation code from your registration email, and click through to create your administrator username and password. Use a real password manager entry here, not a throwaway string, this account has full control over scan configuration and results on the box.

Once activated, Nessus downloads and compiles its plugin feed. On a fresh install this typically takes anywhere from five to twenty minutes depending on your connection and CPU, and you’ll see a progress indicator in the interface. Don’t interrupt this step, a partial plugin compile is one of the more annoying things to recover from cleanly.

This is also the point where Nessus asks whether to enable plugin auto-updates, leave that on. Given that Essentials already runs roughly 30 days behind the paid feed, manually forgetting to refresh plugins on top of that built-in delay means scanning against checks that are two or three months stale by the time you actually run them. Tenable’s own release notes show why that gap matters in practice: 10.11.2 updated the bundled expat library to 2.7.4 on February 5, 2026 (the 10.10.2 release the same month carried the same expat 2.7.4 update), and 10.11.3 fixed a directory-traversal vulnerability on March 3, 2026, both the kind of scanner-affecting fixes you don’t want to be running weeks or months without. If you’re setting up Nessus on a machine that will sit powered off between study sessions, get in the habit of checking the plugin feed status the moment you boot it back up, before you trust any scan results from that session.

Step 6: Tour the Web Interface

While plugins compile, take a minute to orient yourself. The left-hand navigation splits into My Scans (your saved and completed scans), All Scans, Policies (reusable scan configuration templates), and Plugin Rules. The top-right corner shows your license type, IP count used against your five-IP cap, and a link to Tenable’s plugin feed status. Bookmark that license indicator, it’s the fastest way to check how much headroom you have left before you accidentally lock yourself out mid-audit.

Step 7–8: Create and Launch Your First Basic Network Scan

Click New Scan, then choose the Basic Network Scan template, Tenable’s general-purpose starting point for discovering hosts and checking them against the full plugin catalog. Give the scan a descriptive name (for example, “Home-Lab-Baseline-Sept2026”), and in the Targets field enter the IP addresses, hostnames, or CIDR range you want to assess. For a first run, target a single machine or a small range you fully control, never scan infrastructure you don’t own or have explicit written permission to test.

If you’re scanning a subnet rather than a known host list, Tenable’s own guidance is worth following before you commit scanner time to a full assessment: “In larger or dynamic networks, Tenable recommends doing discovery prior to undertaking a full vulnerability scan of a large subnet(s).” Run a lightweight host discovery scan first, confirm which IPs actually respond, then build your five-IP target list from real, live hosts instead of guessing at a range. If you’d rather do that discovery pass outside Nessus entirely, a dedicated port scanner works just as well for mapping live hosts before you commit any of your five IP slots, see our guide to network scanning with Nmap for that exact workflow.

Save the scan, then click the launch (play) icon next to it in the My Scans list. A Basic Network Scan against a single host typically completes in under ten minutes; a full five-IP scan with all plugin families enabled can run considerably longer depending on how many services each host exposes.

Step 9: Set Up a Credentialed Scan for Real Results

An unauthenticated network scan only sees what’s visible from outside, open ports, banner-grabbable service versions, and misconfigurations exposed over the wire. A credentialed scan logs into the target with an account you provide and inspects installed software, missing patches, local configuration, and registry or file-permission issues that no amount of external probing will ever surface. Tenable is explicit about the gap between the two approaches: “Tenable recommends performing fully authenticated assessments wherever possible; these provide up to 45 times more findings and insights than uncredentialed assessments.”

To add credentials, edit your scan (or create a new one from the same Basic Network Scan template), open the Credentials tab, and choose the relevant type, SSH for Linux/Unix targets, Windows for domain or local accounts, or SNMP for network gear. For SSH, a key-based login is preferable to a password; for Windows, a domain account with local admin rights on the target (or membership in a scoped scanning group) gives Nessus the visibility it needs. Create a dedicated, least-privilege scanning account rather than reusing a personal or shared admin login, it makes audit trails cleaner and limits blast radius if the credential ever leaks.

Two platform-specific details trip up almost everyone the first time. On Windows targets, Nessus needs File and Printer Sharing enabled and the Remote Registry service running, along with administrative share access (C$/ADMIN$), a locked-down workstation with those services disabled will reject the scan even with a valid admin password. On Linux targets, if the scanning account isn’t root, you’ll need to grant it passwordless sudo access to the specific commands Nessus runs, or configure privilege escalation directly in the Credentials tab under the SSH settings rather than trying to scan as an unprivileged user and wondering why local checks come back empty.

Step 10: Read Results: CVSS, VPR, and Severity Explained

Once a scan finishes, Nessus groups findings by host and by severity. Under the hood, it can score vulnerabilities using CVSS v2.0, CVSS v3.0, CVSS v4.0, or EPSS, and new installations default to CVSS v3 where a plugin supports it. Severity buckets map to standard CVSS score ranges, defined by the Forum of Incident Response and Security Teams (FIRST) and tracked centrally by the National Vulnerability Database.

Nessus also surfaces Tenable’s own Vulnerability Priority Rating (VPR) alongside CVSS. Don’t treat VPR as a replacement for CVSS, CVSS measures technical severity in a vacuum, while VPR layers in threat intelligence like active exploitation and exploit-kit availability to help you decide what to patch first when you can’t patch everything at once. A Medium-CVSS finding with a high VPR because it’s being actively exploited in the wild deserves more urgency than a High-CVSS finding sitting unexploited for years.

Click into any finding to see the plugin output, affected port, CVE references, and Tenable’s suggested remediation, usually a specific patch, configuration change, or vendor advisory link.

Not every Info-severity item is noise, and not every finding needs the same urgency you’d give a Critical. An Info finding that reveals a full OS and kernel version banner is low-risk on its own, but combined with a High finding for an outdated service on the same host, it tells an attacker exactly which known exploits to try first, read findings on a host together, not purely as an isolated severity list. If a specific plugin result looks wrong for your environment (a false positive on a custom-built service, for instance), you can suppress it for that host under Plugin Rules rather than re-triaging the same non-issue every time you re-scan.

Step 11: Schedule Recurring Scans and Keep Plugins Current

A one-time scan is a snapshot; a scheduled scan is a program. Edit any saved scan, open the Schedule tab, toggle it on, and set a frequency, weekly is a reasonable default for a home lab or small environment. Remember that Essentials’ plugin feed lags roughly 30 days behind paid editions, so a newly disclosed critical CVE may not show up in your Essentials scan results as quickly as it would on Professional or Expert. That delay is the tradeoff for a free license, and it’s worth flagging explicitly if you’re using Essentials for anything beyond learning or a personal lab. It’s also a good reason not to treat Nessus as your only source of patch intelligence, cross-reference major vendor patch cycles directly, like our coverage of a recent Microsoft Patch Tuesday release, so a scanner’s feed lag never becomes your only warning about a critical, actively exploited flaw.

You can also trigger a manual plugin update from the command line if the GUI feels slow to refresh:

# Linux/macOS
sudo /opt/nessus/sbin/nessuscli update --all

# Check current plugin feed status
sudo /opt/nessus/sbin/nessuscli fetch --check-auto-update

Step 12: Export Reports and Build a Remediation Workflow

From a completed scan, click Export and choose a format, HTML and PDF work well for sharing with non-technical stakeholders, while CSV and Nessus’s native .nessus XML format are better suited to feeding results into a ticketing system, spreadsheet, or a second tool for tracking remediation over time. A minimal but effective workflow looks like this: export findings, triage by CVSS/VPR combined, assign each Critical and High finding an owner and a due date, re-scan the same targets after patches land, and confirm the finding actually clears rather than just assuming the patch worked.

That re-scan step is the part most beginners skip, and it’s the one that actually closes the loop, a vulnerability scanner that never verifies its own findings got fixed is just generating reports nobody acts on.

If you’re using Nessus in a small IT team rather than solo, the .nessus export is worth learning even if you never touch the API, it’s structured XML that a second analyst, a GRC tool, or a simple script can parse without re-running the scan themselves. Pair each exported finding with three fields at minimum: an owner, a target remediation date based on the severity table above, and a re-scan date. That’s a lightweight enough process to run in a spreadsheet for a five-IP Essentials setup, and it’s the same shape of workflow that scales up to a full ticketing-system integration once you outgrow the free tier.

Common Pitfalls When Setting Up Nessus Essentials

• Scanning more than five distinct IPs across a week. The license blocks new targets once you hit the cap, and it doesn’t reset until you free up a slot by removing an old target from your scan history, plan your target list before you start, not during.
• Skipping host discovery before scanning a whole subnet. Pointing Nessus at a /24 without checking which hosts actually respond wastes scanner time and can silently burn through your five-IP allowance on dead addresses.
• Running only unauthenticated scans. As covered above, credentialed scans surface dramatically more findings, an Essentials setup that never adds credentials is leaving most of its value on the table.
• Scanning targets you don’t have explicit permission to test. Even on a free tool, port scanning and vulnerability scanning without authorization can violate computer-fraud laws or your ISP’s acceptable-use policy. Stick to hardware you own or a deliberately provisioned lab environment (Metasploitable, a VulnHub VM, or similar).
• Ignoring the 30-day plugin delay. Treating an Essentials scan as proof a network has no critical exposure to a vulnerability disclosed last week is a false sense of security, the plugin for it may not have arrived yet.
• Installing on an undersized VM. Below the 4 GB RAM minimum, plugin compilation can stall for hours or fail outright, and scans against even a single host can time out.
• Losing the activation code. It’s tied to your registered email, but retrieving it again means digging through Tenable’s account portal, save it in a password manager the day you receive it.

Troubleshooting: 8 Nessus Essentials Problems and Fixes

1. Plugin feed update fails or hangs. Check outbound HTTPS (443) connectivity from the host to Tenable’s servers, confirm any corporate proxy is correctly configured in Nessus’s advanced settings, verify system disk space, and make sure the system clock is accurate, a clock skew of more than a few minutes can break TLS validation during the update. Since Nessus 10.12.5 (released October 1, 2026) started enforcing signed plugin archives, an out-of-date install can also fail validation on an otherwise-healthy connection, if you’re still running a pre-10.12.5 build, upgrading the Nessus binary itself is now a standard first troubleshooting step, not just refreshing the plugin feed.

2. Activation code rejected. Double-check for copy-paste whitespace or a mistyped character, confirm you’re entering an Essentials code into an Essentials install (not a Professional or trial code), and verify the scanner can actually reach Tenable’s activation servers over the network.

3. Scan times out before finishing. Reduce the target scope, confirm the hosts are actually reachable (a simple ping or port check first), check whether a firewall between the scanner and target is silently dropping probe packets, and reduce the number of concurrent checks in the scan’s Performance settings if the scanner itself is resource-constrained.

4. Nessus web interface won’t load at localhost:8834. Confirm the nessusd service is actually running (systemctl status nessusd on Linux), check that nothing else is bound to port 8834, and try accessing via 127.0.0.1:8834 instead of localhost if DNS resolution is the issue.

5. Credentialed scan shows “Unable to log in” even with correct credentials. For Windows targets, confirm the account has the necessary remote administration rights and that File and Printer Sharing / WMI aren’t blocked by a local firewall rule. For SSH, confirm the account can actually log in interactively outside of Nessus first, and that key permissions are set correctly (600) if you’re using key-based auth.

6. “License limit exceeded” error mid-scan. You’ve hit the five-IP Essentials cap. Go to Settings, review which IPs are currently counted against your license, and remove stale or test targets you no longer need before adding new ones.

7. Scan results show far fewer findings than expected. This is almost always an unauthenticated scan against a well-patched or firewalled host. Add credentials (Step 9) before assuming a target is genuinely clean.

8. Nessus service won’t start after a Linux package upgrade. Check the service logs at /opt/nessus/var/nessus/logs/ for a specific error, confirm the install completed without a dependency conflict, and try a manual restart with sudo systemctl restart nessusd followed by journalctl -u nessusd -n 50 to see the most recent startup errors.

Output Example: What a Finished Scan Summary Looks Like

A typical completed Basic Network Scan against a single moderately patched Linux host produces a results screen resembling this breakdown:

Scan: Home-Lab-Baseline-Sept2026
Status: Completed
Host: 192.168.1.42
Vulnerabilities found: 27

Critical:  0
High:      2   (outdated OpenSSH version, missing kernel patch)
Medium:    6   (weak TLS cipher suites, self-signed cert)
Low:       9   (informational service banners, SNMP defaults)
Info:      10  (open port enumeration, OS fingerprint)

Scan duration: 6m 42s
Plugins used: full family set (credentialed)

The two High findings are where you start: an outdated SSH daemon and a missing kernel patch are exactly the kind of remotely exploitable issues Nessus exists to catch, and both typically have a direct, low-risk fix (update the package, reboot into the patched kernel).

Advanced Tips: API Automation and Scan Tuning

Nessus exposes a REST API on the same port as the web interface, which means you can trigger scans and pull results programmatically instead of clicking through the GUI every time. First, generate an API key pair from your user profile in Settings, then authenticate and launch a scan by ID:

curl -k -X POST "https://localhost:8834/scans//launch" \
  -H "X-ApiKeys: accessKey=; secretKey="

# Check scan status
curl -k -X GET "https://localhost:8834/scans/" \
  -H "X-ApiKeys: accessKey=; secretKey="

This is enough to drop a scan trigger into a cron job or a CI pipeline step that scans a staging environment before every deploy. Nessus itself only assesses hosts and networks you point it at directly, it has no visibility into cloud-native threats like anomalous IAM activity or compromised access keys, so treat it as one layer of coverage rather than the whole picture. If part of your footprint lives in AWS, pairing scheduled Nessus scans of your self-managed servers with a service like AWS GuardDuty for continuous cloud threat detection closes a gap that a host-based scanner alone can’t. A few other tuning tips worth knowing once the basics are working:

• Narrow plugin families for faster scans. If you only care about web-facing issues, disable unrelated plugin families (like local Windows registry checks on a Linux-only target list) to cut scan time significantly.
• Use the “Host Discovery” template before a full scan on unfamiliar ranges to build an accurate target list without burning your IP allowance on unresponsive addresses.
• Tag and compare scan history over time rather than treating each scan as a one-off, the trend line (are findings going up or down month over month) is often more useful than any single scan’s absolute count.
• Set a scan window rather than “any time” if you’re scanning production-adjacent systems, even in a lab. Aggressive plugin checks can occasionally trip an IDS/IPS rule or briefly spike CPU on an older device, so scheduling scans for low-traffic hours is good practice even when you’re the only user on the network.

One more automation option worth knowing about: Tenable also publishes an official Nessus Docker image, which is useful if you want a disposable, reproducible scanner instance for a CI pipeline instead of a persistent VM, spin it up, register and activate it with the same activation code, run the scan via API, and tear it down when the job finishes. If you’re managing the scanner itself remotely, say, a Nessus instance running on a home server you access while traveling, a zero-config mesh VPN is a cleaner way in than opening port 8834 to the wider internet; our Tailscale setup guide covers getting that running in about the same amount of time as this Nessus install.

Nessus Essentials vs. Professional, Expert, and Open-Source Alternatives

Once five IPs and a 30-day plugin delay stop being enough, you have a genuine decision to make between staying inside the Tenable product family or switching tools entirely.

Nessus Expert adds web application scanning and external attack-surface visibility on top of everything Professional includes, which is why it commands roughly a $2,000-a-year premium. Existing Nessus Professional users can test it first, since Tenable lists a free seven-day upgrade trial to Nessus Expert. See Tenable’s Expert product page for the current feature breakdown. Greenbone’s community edition of OpenVAS remains the closest free alternative with no IP cap, at the cost of a rougher setup process and a less polished interface than Nessus. Qualys and Rapid7 both price by asset count through a custom quote rather than a flat annual license, so get a current quote directly rather than relying on a number from an older comparison article, enterprise vulnerability-management pricing shifts constantly with deal size and add-on modules. Full current Nessus pricing tiers are on Tenable’s buy page, and the FAQ covering license limits in detail is at Tenable’s Nessus FAQ.

Nessus is a network and host scanner, not a web application security tool, even on the Expert tier’s attack-surface features. If application-layer testing, SQL injection, cross-site scripting, broken authentication flows, is part of what you need to cover, pair Nessus with a dedicated web app scanner rather than expecting network-focused plugins to catch it. Our OWASP ZAP setup guide covers the free, open-source option most teams reach for first.

What Nessus Professional and Its Add-Ons Cost Over Several Years

Tenable’s current purchase display lists Nessus Professional at $4,790 for one year, $9,330.95 for two years, and $13,637.54 for three years. Those are the figures to put in front of whoever approves the budget if your five-IP lab turns into a real assessment job. Tenable continues to advertise a free trial of Nessus Professional, although the listing does not state the trial length, so confirm it on the sign-up page before you plan a test around it.

The same purchase material lists Advanced Support at $400, On-Demand Training at $275, Nessus Fundamentals at $275, and Nessus Fundamentals plus Nessus Advanced at $385. The listing does not clearly specify whether each of those amounts is annual, one-time, or tied to a particular license term, so check the term before you add them to a budget.

None of this pricing changes the free tier. Nessus Essentials remains the free option for up to five IP addresses with a 30-day-delayed plugin feed, and Nessus Essentials Plus sits between it and Professional with up to 20 IP addresses and real-time plugin updates. The practical order is to outgrow Essentials first, try Essentials Plus if you qualify as a student, educator, or individual, and price Professional only when you need more coverage than that.

Complete Working Project: A Home Lab Vulnerability Assessment

Here’s how all twelve steps come together in a realistic, self-contained project you can run this weekend on hardware you own.

Setup: A hypervisor (VirtualBox or VMware Workstation Player, both free for personal use) running two VMs, one Nessus Essentials install on a Linux VM with 8 GB RAM allocated, and one deliberately vulnerable target VM downloaded from VulnHub or Metasploitable, isolated on a host-only or NAT network so it never touches the wider internet.

Tech
Insider

Tech Insider delivers in-depth coverage of the technologies shaping the future: AI, cybersecurity, cloud computing, hardware, and the trends that matter.

[email protected]