Pick one scanner for everything and you will miss something. The five vulnerability scanner tools in this comparison, OpenVAS, Tenable Nessus, OWASP ZAP, Trivy and Nuclei, each inspect a different layer: hosts and network devices, running web applications, container images and infrastructure code, or a fast list of known-bad signatures. As of October 28, 2026, all five are still actively developed, and all five offer a free way in.
The week of October 21 showed how differently they behave. When two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed PHP2Shell), went public, ProjectDiscovery’s cloud library lists a PHP2Shell detection entry, Greenbone published its first guidance on October 21, ZAP shipped a passive rule on October 22, and Tenable followed with a how-to on October 26. One CVE, several different doors into the same problem.
This guide skips the enterprise-suite duel, which an earlier head-to-head on Nessus vs Qualys vs OpenVAS already covers. Instead it asks the question most buyers actually face: which vulnerability scanner tools belong in your stack for the thing you need to scan? You get a specs table, a pricing table, six real 2026 events, use-case picks, a migration plan, and a verdict. Every number comes from vendor pages and project announcements dated October 2026, and where a figure rests on a single source, the text says so.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Vulnerability Scanner Tools at a Glance: The 5 Picks
Here is the short version before the detail. Each pick wins a different job, and none of them is the best vulnerability scanner for every job.
- OpenVAS (Greenbone): best for scanning internal networks and servers at scale, with an Enterprise Feed that Greenbone says holds more than 250,000 vulnerability tests.
- Tenable Nessus: best for a polished, widely understood host scanner, with a free Essentials tier capped at five IP addresses.
- OWASP ZAP: best free vulnerability scanner for web applications and APIs, and the easiest to wire into a CI pipeline.
- Trivy: best for container images, filesystems, Kubernetes manifests and infrastructure-as-code, with the caveat of a 2026 supply-chain incident.
- Nuclei: best for fast, template-driven checks of known issues across many web targets.
If you want one sentence of advice, it is this. Run a network scanner (OpenVAS or Nessus) against your hosts, run ZAP against your web apps, run Trivy in your build pipeline, and use Nuclei when a new CVE drops and you need to check many targets within hours. The rest of the article explains why, and where each tool breaks down.
One boundary note. Enterprise platforms such as Qualys VMDR and Rapid7 InsightVM sit outside this roundup because they solve a different buying problem (central dashboards, ticketing integrations, quote-based contracts). The five tools here are the ones a small team can start using this afternoon without a sales call.
Why the Right Scanner Depends on What You Scan
A vulnerability scanner is a program that compares what it finds on a target against a database of known weaknesses. The word “target” hides most of the difference. A network scanner probes hosts and services and checks versions and configurations. A web scanner crawls an application and tests inputs. A container scanner unpacks an image and reads its package list. A template scanner fires a library of small, specific checks at a list of URLs.
These categories map loosely onto the testing families that appsec teams talk about. Network and host scanning has no clean equivalent there, while web scanning is dynamic testing and container scanning is closer to software composition analysis. If those terms are new, the explainer on SAST vs DAST vs SCA sorts them out and shows where each family fits in a pipeline.
Volume is the second reason to match tool to target. Tenable’s October write-ups describe Oracle’s October 2026 Critical Patch Update as addressing 1,209 CVEs and Microsoft’s October 2026 Patch Tuesday as addressing 1,407 CVEs. No single feed covers all of that equally well, and a host scanner with a large commercial plugin or test feed has a structural edge on operating-system and appliance flaws. A web scanner has the edge on logic and input handling in your own code, where no CVE exists at all.
Authentication is the third factor. An unauthenticated scan sees only what a stranger sees, which is useful for exposure checks but shallow for patch auditing. Authenticated scans log in and read installed packages, which is how Greenbone’s PHP2Shell guidance reaches Linux and Windows hosts through package-level checks. When you compare vulnerability scanning tools, ask early whether the scan you need can run with credentials, and whether the free tier of that tool allows it.
Specs Compared: OpenVAS vs Nessus vs ZAP vs Trivy vs Nuclei
The table below uses only details that vendor pages or project announcements confirmed in October 2026. Where a tool has no confirmed figure for a row, the cell says so instead of guessing. Version numbers describe the newest release the sources identify, which is not always the one you will get from a distro package.
| Spec | OpenVAS (Greenbone) | Tenable Nessus | OWASP ZAP | Trivy | Nuclei |
|---|---|---|---|---|---|
| Primary target | Hosts, network devices, services | Hosts, network devices, applications | Web applications and APIs | Images, filesystems, repos, Kubernetes, IaC | Web targets, via templates |
| Delivery format | Hardware and virtual appliances, plus OPENVAS BASIC | Installed scanner (Essentials, Essentials Plus, Professional, Expert) | Desktop proxy, Docker images, automation framework | Command-line tool | Command-line tool |
| Newest release in sources | Greenbone OS 25.0.8 (Oct. 23, 2026) | Nessus 10.12.x | Browser extension 0.3.0 (Oct. 21, 2026) | v0.76.1 (Oct. 21, 2026) | Template library v10.5.0 |
| Free way in | Free, self-managed community option | Nessus Essentials | Entire tool is free | Free, open source | Open source |
| Free-tier asset cap | Self-managed, no vendor cap stated | 5 IPs (Essentials), 20 IPs (Essentials Plus) | None | None | None |
| Paid path | OPENVAS BASIC and OPENVAS SCAN appliances | Essentials Plus, Professional, Expert | None required | Aqua’s commercial platform | ProjectDiscovery’s wider platform |
| Public price list | No standard list | Professional price shown on Tenable’s purchase page (see text) | Not applicable | No Aqua list found | See text |
| Detection content | Enterprise Feed, more than 250,000 tests | Plugin feed, 30-day delay on Essentials, real-time on Essentials Plus | Passive and active scan rules via add-ons | Vulnerability, misconfiguration and secret checks | Community YAML templates |
| Credentialed scanning | Yes, Linux and Windows checks | Yes | Authentication Helper add-on | Reads package lists inside images | Limited, template dependent |
| Agent-based scanning | Technology Preview on G90, G30, G10 and virtual models | Not part of this comparison | No | No | No |
| Recent change | OPENVAS SCAN SENSOR with asset-based licensing | Selected by Atos for a CTEM service (Oct. 27, 2026) | Script Viewer for Zest scripts (Oct. 21, 2026) | 0.76.x line, maintenance fixes | Signed JavaScript templates required since v3.11.0 |
| Maintainer | Greenbone AG | Tenable, Inc. | OWASP Foundation, ZAP Dev Team | Aqua Security | ProjectDiscovery, Inc. |
| Main caution | Needs an appliance or VM to run well | Free tier is non-commercial and capped | Crawling modern JavaScript apps needs the Client Spider | 2026 supply-chain incident, pin versions | Unsigned JavaScript templates are skipped |
Two details deserve a second look. First, Greenbone’s licensing is moving toward counting analyzed assets for its new sensor model, which changes how you budget for a distributed network. Second, ZAP’s tidy “none required” in the paid row is a feature, not a gap. The project is free and open source, and its founder says so plainly, as the ZAP section below shows.
OpenVAS (Greenbone): Network Scanning With a 250,000-Test Feed
OpenVAS is the open-source heart of Greenbone’s vulnerability management line, and in October 2026 Greenbone announced that all of its products are now united under the OPENVAS brand. The commercial lineup includes OPENVAS SCAN hardware appliances, OPENVAS SCAN virtual appliances, and OPENVAS BASIC, the entry-level paid product. Appliances use the OPENVAS ENTERPRISE FEED, which Greenbone says contains more than 250,000 vulnerability tests.
For a team that wants to see the scanner before paying, Greenbone offers two on-ramps. OPENVAS BASIC is advertised with a 14-day free trial, and OPENVAS SCAN includes a two-week trial of the Enterprise Feed. Greenbone does not publish a standard public price list in the product material the sources reviewed, so expect to request a quote. Official material also reportedly refers to a free, self-managed option labeled OPENVAS FREE, built around the community feed.
What changed in October 2026
Greenbone shipped a cluster of Greenbone OS releases in October. Greenbone OS 25.0.5 added agent-based scanning as a Technology Preview for OPENVAS SCAN G90, G30, G10 and the virtual model. Greenbone OS 25.0.7 fixed a crash in the administration menu on older appliance models. Greenbone OS 25.0.8 followed as the newest release, and the new OPENVAS SCAN SENSOR model uses asset-based licensing instead of the older fixed device limit. The 25.0.5 release also updated gvm-tools to 26.0.6 and python-gvm to 27.3.1, which matters if you automate scans through the API.
Note the word “preview.” Greenbone describes the agent as a Technology Preview, so it is not yet a generally available feature. Treat it as something to test in a lab, not a replacement for network scans in production.
Where OpenVAS fits best
OpenVAS suits organizations with internal networks, European data-residency needs, or a preference for an open-source core. Greenbone has kept its feed current on fast-moving threats. According to the company’s own posts, it added Enterprise Feed checks for an actively exploited FortiMail flaw (CVE-2026-104286) on October 12 and detection tests for exploited Atlassian Data Center products on October 14. Those dates come from single posts, so verify them against Greenbone’s feed notes before citing them in an audit.
If you decide to try it, the walkthrough on installing the OpenVAS Greenbone scanner covers the setup in order, from the virtual appliance to the first authenticated scan.
Tenable Nessus: The Free Tier and Where It Stops
Nessus remains the scanner many security teams learn first. Tenable’s documentation identifies Nessus 10.12.x as the current branch, with the user guide updated in late October 2026, and the paid standalone edition is named Tenable Nessus Professional. Tenable describes Nessus as an actively developed product within its wider exposure-management portfolio, and an October 27 announcement that Atos selected Tenable to power a continuous threat exposure management service confirms the vendor is investing, not winding down.
The free tier is where beginners start. Nessus Essentials scans up to five IP addresses and receives its plugin feed on a 30-day delay. Nessus Essentials Plus raises the cap to 20 IP addresses, adds real-time plugin updates, PDF reporting and concurrent scans, though the retrieved documentation did not show a current price for it. Tenable aims both tiers at students, educators and individuals rather than production use, so a company that runs Essentials against its own servers is stretching the license.
What Nessus Professional costs
Tenable’s purchase page reportedly listed Nessus Professional at $4,790 for one year, $9,330.95 for two years and $13,637.54 for three years in late October 2026. These figures appear in one source set, so confirm them on the live page before budgeting, and check the renewal prices there too before comparing terms. The same pages reportedly show Advanced Support at $400, and Tenable’s site lists the Nessus Fundamentals plus Nessus Advanced training bundle at $385.
For a hands-on start, the guide to setting up Nessus Essentials walks through activation and a first scan. Anyone weighing Nessus against the large commercial suites can read the broader Tenable vs Qualys vs Rapid7 comparison for plugin counts and platform pricing.
The honest weakness of Nessus is the license boundary. The free tier is small by design, and the jump to a paid license is steep for a two-person team. If that jump bothers you, OpenVAS is the closest like-for-like alternative, and the OpenVAS vs Nessus choice usually comes down to whether you value a polished commercial plugin pipeline or an open-source core you can inspect.
OWASP ZAP: Free Web Application Scanning
ZAP, short for Zed Attack Proxy, is the standard free vulnerability scanner for web applications. It sits between your browser and the target as an intercepting proxy, crawls the site, and runs passive and active checks. Its founder, Simon Bennetts, describes the project’s licensing in unambiguous terms.
ZAP is a tool for finding vulnerabilities in web applications like all other projects it’s completely free and completely open source.
Simon Bennetts, OWASP ZAP founder and project leader, in a recorded interview (the source page carries no date)
Bennetts also staked a bold claim about adoption in that same interview.
We’re pretty sure we’re fairly certain that ZAP is the most frequently used web application scanner in the world and that includes all the commercial tools as well.
Simon Bennetts, OWASP ZAP founder and project leader, same interview
Treat that as the project leader’s belief, not an independent measurement, since no usage survey in the sources backs it up. A second interview, published by Armored Code, explains who ZAP was built for.
I specifically released it for developers and functional testers, and was quite surprised when it was taken up so enthusiastically by professional pentesters.
Simon Bennetts, OWASP ZAP founder and project leader, Armored Code interview (undated)
You can use it to create security regression tests.
Simon Bennetts, OWASP ZAP founder and project leader, same Armored Code interview
That second point is why ZAP pairs so well with CI. A scan that runs on every build behaves like any other automated test, and the cost of adding one is a few lines of pipeline configuration.
Recent ZAP changes you should know
The October 2026 announcements are practical rather than flashy. On October 21 the ZAP Browser Extension and standalone Recorder reached version 0.3.0, adding a Script Viewer that lets you view, edit, replay, load and save Zest scripts. On October 22 a new passive scan rule began flagging PHP2Shell and more than 60 other known PHP vulnerabilities from server-version information, and the team promoted it straight to release status because PHP2Shell was described as actively exploited.
That PHP rule comes with a useful warning. ZAP’s own post explains that a server banner such as PHP/8.1.2 may belong to a build that a distribution already patched, even though the PHP team never released a fix for the 8.1 branch. The guidance is to check whether fixes were actually applied before reporting the findings as confirmed. Good scanners tell you how much to trust their output, and ZAP does.
Configuration changes matter too. By September 2026 the AJAX Spider and the DOM XSS active scan rule add-ons had been removed from ZAP’s nightly and weekly Docker releases, and the Client Spider became the recommended crawler for JavaScript-heavy applications on July 6, 2026. The OWASP PTK integration moved from alpha to beta in June, and the Global Scan Policy Manager entered its first phase in September. In August the Alert Filters add-on gained an optional LLM extension for reviewing alerts. If you maintain old automation plans that call the AJAX Spider, update them.
To get running quickly, follow the steps in how to set up OWASP ZAP. If you are choosing between free and paid web scanners, the DAST tools comparison of Burp, ZAP, Invicti and StackHawk puts ZAP next to its commercial rivals.
Trivy: Container and IaC Scanning, With a Supply-Chain Scar
Trivy is the scanner developers reach for when the question is “what is inside this image?” It covers container images, filesystems, Git repositories, Kubernetes, infrastructure-as-code, SBOM generation, misconfiguration scanning and secret detection. Trivy v0.76.1 is the newest confirmed release, following v0.76.0, and the project’s GitHub activity in October included better display of cryptographic findings and a refactor of Terraform module resolution. Any claim that Trivy is abandoned contradicts that record.
Aqua Security maintains Trivy and sells a commercial platform around it. No official public price list for Aqua’s offerings turned up in the research. One third-party diligence page puts annual Aqua deployments at $25,000 to $40,000, but that is an outside estimate and not an Aqua price, so do not budget from it.
The March 2026 compromise
Trivy’s biggest 2026 story is a security incident, not a feature. According to reports summarized by QASkills, a threat actor compromised parts of the Trivy release pipeline in March 2026, and the malicious components targeted secrets such as SSH keys, cloud credentials, Kubernetes tokens and environment variables. Other reports describe a malicious v0.69.4 release and repointed tags on the trivy-action GitHub Action, with 76 of 77 tags reportedly affected. Those specifics come from secondary reporting, so read the project’s own advisory for the authoritative account.
The lesson is not “avoid Trivy.” The lesson is that a scanner running in your CI has access to your CI secrets, so treat it like any other privileged dependency. Pin the action to a full commit SHA, verify release artifacts, and avoid unpinned installer scripts. Reporting on October 27 and 28 still described the March event as a major supply-chain breach in the Trivy ecosystem, which tells you the community has not forgotten.
Aqua’s stated position, as reported in October, is that issues involving implicit configuration loading and Rego policies fall outside Trivy’s security boundary because Trivy treats configuration as trusted. In practice, that means you should not scan untrusted repositories with a privileged token in the environment. The setup tutorial for Trivy container scanning shows a sensible baseline configuration.
Nuclei: Template-Driven Scanning for Known Issues
Nuclei, from ProjectDiscovery, works differently from the other four. Instead of one large engine with built-in knowledge, it runs small YAML templates that each describe a single check, such as a specific CVE, a misconfigured panel or an exposed file. That design makes it quick to add a check for a brand-new vulnerability, and quick to run that check across thousands of URLs. The template library is at v10.5.0 in the sources reviewed, and reports put Nuclei itself at v3.11.1.
The latest template release reportedly added 295 new templates, a figure from a single project issue, so treat it as approximate. ProjectDiscovery’s cloud library also lists an active crash-detection entry for PHP2Shell dated October 21, which shows how fast a template-based tool can respond when a CVE has a simple remote signal.
Security hardening in 2026
Running other people’s templates is a risk, and ProjectDiscovery has acted on it. Nuclei v3.11.0 introduced a breaking change on July 6, 2026: custom templates using the javascript protocol must now be digitally signed, and unsigned ones are skipped. If a template that worked in June stopped working in July, that is the reason. A separate October issue reported that release builds used a Go version missing the fix for CVE-2026-111943, with patched versions identified as 1.26.10 and 1.27.3, and a change requiring Go 1.27.3 or newer was merged into the development branch in late October. Check the release notes before you build from source.
ProjectDiscovery has also grown beyond the scanner. It launched Neo v1, an autonomous security platform, and, per SiliconANGLE, added Neo Triage to confirm which vulnerabilities are actually exploitable. Whether you want that layer depends on your backlog. The open-source Nuclei engine stays useful on its own, and the guide to setting up the Nuclei scanner covers templates, severity filters and rate limits.
Benchmarks: What Each Vendor Shipped During PHP2Shell Week
Here is the uncomfortable truth about vulnerability scanner benchmarks: no independent, recent, head-to-head detection test of these five tools turned up in the research. Vendor-run scans of vendor-chosen targets prove little. The most honest comparison available is behavioral, so this section measures how each ecosystem responded to the same disclosure, PHP2Shell, using dated public pages from three sources.
| Date (2026) | Source | What it published |
|---|---|---|
| Oct. 21 | Greenbone | First post on PHP2Shell, CVE-2026-109618 and CVE-2026-109619 |
| Oct. 22 | ZAP project | Passive rule that flags PHP2Shell and 60+ other PHP vulnerabilities from version banners |
| Oct. 23 | Greenbone | Step-by-step guide to detecting PHP2Shell, plus EPSS values |
| Oct. 26 | Tenable | Blog on discovering and remediating PHP2Shell exposure |
| Oct. 27 | Greenbone | Ready-made scan configurations for Linux and Windows |
| Oct. 28 | Greenbone | CISA KEV listing added to the post, EPSS values refreshed |
Three observations follow from that timeline. First, Greenbone and ZAP published within a day of each other, and ZAP’s rule went straight to release status instead of waiting for a scheduled build. Second, Greenbone’s post kept growing for a week, adding configs and the KEV listing, which is the kind of follow-through that matters for compliance evidence. Third, Tenable’s how-to arrived five days after Greenbone’s first post, so a team that relies on a single vendor’s write-up may wait longer for guidance than a team that watches several.
The severity data is the second benchmark. Greenbone’s post lists one of the two flaws at CVSS 9.2 with an EPSS exploitation-probability score of 100.0 percent, the 100th percentile, and notes that the PHP team fixed the issues in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ZAP’s post adds that older end-of-life branches (5.x, 7.x, 8.0 and 8.1) are affected and will not be fixed. A scanner that knows the difference between “patched upstream” and “no fix exists” gives you a better to-do list.
The third benchmark is scale of detection content. Greenbone’s more than 250,000 tests, Nessus’s plugin feed, and Nuclei’s community template library all measure something different, and the raw counts cannot be compared one-to-one. A single Nuclei template is a narrow check, a Nessus plugin often wraps a family of checks, and a ZAP rule targets a class of web bugs. Count coverage of your own assets instead. Run two tools on the same test host for a week and compare what each one reports and misses.
Vulnerability Scanner Pricing and Licensing
Pricing is where this category confuses buyers most, because the free tier of one tool and the paid tier of another often solve the same problem. The table summarizes what the sources confirm. For dollar figures, see the Nessus section above, where single-source prices are flagged.
| Tool | Free option | Paid options | Public price list |
|---|---|---|---|
| OpenVAS | Self-managed community option | OPENVAS BASIC, OPENVAS SCAN appliances and sensor | No standard list, quote required |
| Nessus | Essentials, 5 IPs, 30-day delayed feed | Essentials Plus (20 IPs), Professional, Expert | Professional shown on Tenable’s purchase page |
| OWASP ZAP | Entire tool | None required | Not applicable |
| Trivy | Entire scanner | Aqua commercial platform | No official list found |
| Nuclei | Open-source engine and templates | ProjectDiscovery platform (Neo) | See Nuclei section |
Hidden costs matter more than license lines. A free vulnerability scanner still needs a person to triage results, and a two-person team that scans weekly will spend more hours on false positives than on license fees. Budget time first, then money. Appliance-based tools like OPENVAS SCAN add hardware or virtualization costs, and cloud-hosted scanners add data-transfer and egress costs that rarely show up on the pricing page.
Licensing boundaries are the other trap. Nessus Essentials is non-commercial, so a company that adopts it for production scans risks a compliance problem on top of a security one. Greenbone’s move to asset-based licensing for the sensor model means costs scale with what you analyze, not with how many boxes you rack. Open-source licenses come with no asset caps, but they also come with no support contract, and that tradeoff is a business decision, not a technical one.
Six Real-World Examples From 2026
Specs tell you what a tool can do. These six events from 2026 show how the tools and their maintainers behaved when it counted. Each is drawn from the source material above, with single-source details flagged.
1. PHP2Shell, October 21 to 28. Anyone with PHP in production needed to find vulnerable versions fast, and each tool offered a different angle. Greenbone’s authenticated checks read package versions directly, ZAP’s passive rule flagged public sites that leaked old version banners, and Tenable published its own detection walkthrough. The takeaway is that authenticated host scanning and external banner checks answer different questions, and a careful team runs both. The wider cybersecurity coverage on this site tracks how flaws like this one develop.
2. The Trivy pipeline compromise, March 2026. Reports say a threat actor published a malicious release and repointed GitHub Action tags, then went after SSH keys, cloud credentials and Kubernetes tokens held by CI jobs. The incident showed that a CI scanner is privileged code with access to secrets. It did not end Trivy’s usefulness, since releases continued through October, but it ended the habit of pulling security tooling by floating tag without further checks.
3. Nuclei’s signed-template rule, July 6. With v3.11.0, custom JavaScript-protocol templates must carry a digital signature or Nuclei skips them. Teams with homegrown templates of that type needed to sign them to keep those checks in their reports. The change makes it harder for a tampered template to execute code on a scanner host, which is the same class of risk the Trivy incident exposed.
4. ZAP’s AJAX Spider retirement, summer 2026. The Client Spider became the recommended crawler on July 6, and by September the AJAX Spider and DOM XSS add-ons were gone from nightly and weekly Docker releases. Pipelines that still called the old spider needed a plan update. According to ZAP’s September update, Quickstart and the bundled automation profiles already moved to the headless Firefox Client Spider, so anyone on defaults got the change for free.
5. Greenbone’s feed response to exploited edge devices, October 2026. The company reported FortiMail checks on October 12, Atlassian Data Center checks on October 14, and a BeyondTrust Remote Support banner check for CVE-2026-102764 within days of its CISA KEV listing around October 19 to 22. For a network-focused team, that cadence is the main argument for a managed feed over a do-it-yourself template pile.
6. Atos and Tenable, October 27. Tenable announced that Atos selected it to power a continuous threat exposure management program. That is a services contract, not a Nessus change, but it shows where the vendor is steering: from point-in-time scans toward continuous exposure programs. Teams planning multi-year budgets should read it as a signal that the standalone scanner is one product inside a larger platform story.
Use-Case Recommendations: Which Scanner for Which Job
Match the tool to the job, then add layers as your program matures. These six recommendations assume a small to mid-sized team without a dedicated vulnerability management platform.
- Home lab or student learning: Nessus Essentials covers five IP addresses at no cost and teaches the standard scan workflow. Its non-commercial terms fit this audience exactly.
- Small business with internal servers: OpenVAS with an OPENVAS BASIC trial gives you a managed feed without a large contract. Request a quote after the 14-day trial and compare against Nessus Professional.
- Web app or API team: Start with ZAP in a baseline scan on every pull request, then schedule a deeper active scan against staging. ZAP costs nothing, and its automation fits CI.
- DevOps and container shops: Run Trivy against images before they reach a registry, pin the version, and fail the build on high and critical findings you can fix.
- Incident response and bug bounty: Use Nuclei to sweep large URL lists when a new CVE lands. Keep templates signed and source-controlled.
- Compliance-driven environments: Choose a commercial network scanner (Nessus Professional or an OPENVAS SCAN appliance) and keep scan evidence in a tracker such as DefectDojo, which aggregates findings from many scanners.
Most real programs combine two or three of these. A sensible starter stack costs nothing in licenses: OpenVAS or Nessus Essentials for hosts you are allowed to scan, ZAP for web apps, and Trivy for images. Add Nuclei when response speed becomes the problem.
Migration Guide: Moving From One Scanner Setup to Another
Swapping scanners means more than installing a new tool. You are moving scan scope, credentials, schedules and a history of findings. This plan works for the common moves in this article, such as outgrowing Nessus Essentials, replacing an old ZAP spider setup, or adding Trivy to a pipeline.
Step 1: Inventory what the old scanner does
Export your target lists, scan schedules, credentials (by name, not value), and any custom policies. If you are leaving Nessus Essentials because of the five-IP cap, record which five hosts you chose and why. The list is the seed for your new asset inventory.
Step 2: Run both scanners in parallel for two weeks
Scan the same targets with both tools on the same days. Compare critical and high findings, and look for overlap, misses and false positives. This is the only reliable benchmark for your environment, since no public head-to-head test covers it.
Step 3: Pin, sign and isolate
Given the 2026 incidents, harden the scanner before you trust it. Pin container images and GitHub Actions to digests or full commit SHAs, sign custom Nuclei templates, and run scanners in an account with narrow permissions. The commands below show a minimal pattern for a CI job. They use real flags, but check each tool’s current documentation before you copy them.
# Container scan that fails the build on fixable high and critical findings
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 registry.example.com/app:1.0
# ZAP baseline scan against a staging site, using the stable Docker image
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.example.com
# Nuclei run limited to high and critical templates against a URL list
nuclei -l targets.txt -severity high,critical -o nuclei-results.txtStep 4: Move findings into one tracker
Different scanners use different severity labels, so normalize them in one place. Pick a rule such as “fix criticals within seven days,” and write it down. Importing historical findings is optional, but import open ones so nothing quietly disappears in the switch.
Step 5: Retire the old scanner on a date
Set a cut-over date, tell stakeholders, and revoke the old tool’s credentials the same day. A scanner left running with valid service accounts becomes an unmonitored privileged identity, which is exactly the type of asset attackers like.
Pros and Cons Side by Side
| Tool | Pros | Cons |
|---|---|---|
| OpenVAS | Open-source core, 250,000+ test Enterprise Feed, authenticated Linux and Windows checks, trials available | Appliance or VM needed, no public price list, agent scanning still a preview |
| Nessus | Familiar workflow, free tier to learn on, active development, 10.12.x branch | Essentials capped at 5 IPs and non-commercial, steep jump to paid tiers |
| OWASP ZAP | Free and open source, strong CI fit, fast rule releases, active project | Web only, needs tuning for JavaScript apps, banner-based PHP findings need verification |
| Trivy | Covers images, IaC, SBOM and secrets, quick CI runs, active releases | March 2026 supply-chain incident, treats configuration as trusted, no public commercial pricing |
| Nuclei | Very fast, easy to add checks, wide target sweeps, signed-template safeguard | Narrow checks, weak for authenticated host audits, breaking changes between versions |
Read the table by risk, not by length of list. OpenVAS and Nessus carry cost and licensing risk. ZAP, Trivy and Nuclei carry configuration and supply-chain risk. Neither kind of risk is bigger in the abstract, and which one hurts depends on your team.
Verdict: Which Vulnerability Scanner Tool to Run
For a team of one to five people, the answer is a short stack, not a single winner. Run OpenVAS or Nessus against hosts, ZAP against web apps, and Trivy in your build pipeline. Add Nuclei when you need to sweep many targets for one fresh CVE within hours. That combination costs nothing in licenses if you accept Nessus Essentials’ five-IP limit or use the community option of OpenVAS.
If you must pick exactly one, pick by your largest exposure. A company with mostly internal servers should start with OpenVAS because of its feed size and authenticated checks. A SaaS company with a public web app should start with ZAP. A platform team shipping containers daily should start with Trivy, pinned and verified. A learner or hobbyist should start with Nessus Essentials. The scorecard is simple: 5 tools, 4 distinct jobs, 0 universal winners.
The tool to trust least is any one whose output you do not verify. ZAP’s own warning about PHP version banners, the Trivy incident, and Nuclei’s signed-template change all point at the same lesson. Scanners are software with privileges, and they produce hints, not proof. Run them, test their findings, and keep the pipeline around them boring.
Frequently Asked Questions
What is the best free vulnerability scanner?
It depends on the target. For web applications, OWASP ZAP is the strongest free option. For containers and infrastructure code, Trivy leads. For hosts and network devices, OpenVAS’s community option and Nessus Essentials (five IP addresses) are the main free choices.
Is Nessus Essentials free for business use?
No. Tenable positions Nessus Essentials for students, educators and individuals. It scans up to five IP addresses with a feed delayed by 30 days. Businesses should look at Nessus Professional or another licensed or open-source scanner.
How does OpenVAS compare with Nessus?
Both scan hosts and networks. OpenVAS has an open-source core and a commercial Enterprise Feed of more than 250,000 tests. Nessus is a commercial product with a capped free tier. OpenVAS is more flexible for self-hosting, and Nessus is more familiar to many auditors.
Is Trivy still safe to use after the 2026 compromise?
Trivy remains actively maintained, with v0.76.1 as its newest confirmed release. Reports say its release pipeline was compromised in March 2026, so pin versions, verify artifacts, use full commit SHAs for the GitHub Action, and avoid unpinned installer scripts.
Can ZAP find PHP2Shell?
ZAP added a passive rule on October 22, 2026 that flags PHP2Shell and more than 60 other PHP vulnerabilities from disclosed server-version information. It reads version banners, so a patched distribution build may still be flagged. Verify before you report.
Do I need more than one vulnerability scanner?
Usually yes. Host scanners, web scanners and container scanners look at different layers. A small team can cover most risk with a network scanner, ZAP and Trivy, and add Nuclei for rapid sweeps.
Does OpenVAS publish prices?
Greenbone does not publish a standard public price list in the product material reviewed. OPENVAS BASIC has a 14-day free trial and OPENVAS SCAN includes a two-week Enterprise Feed trial, so you can test before requesting a quote.
