11 Popular Vulnerability Scanning Tools to Consider 

Vulnerability scanning is a key control within frameworks like SOC 2, ISO 27001, NIST 800-53, and can even apply to privacy-centric standards like GDPR. 

Since we covered the basics in our vulnerability scanning guide, in this article, we thought we’d go over the two main types of vulnerability scanners, some common options among our customers and IT professionals, and reasons why you may prefer one over the others.  

What is a Vulnerability Scanner?

Without getting too in-depth, a vulnerability scanner is just an application that automatically tries to collect information about the devices it interacts with. 

Vulnerability scanners do this by trying to communicate with any device they are targeted at—whether that is a single device or an entire network. These applications communicate with these devices and then pull in information about them based on the responses they receive. 

An example of this is operating system identification. Each operating system will respond to packets sent to them in a slightly different way, and using these differences, the vulnerability scanner can then profile those devices. If a vulnerability scanner is scanning your network, it should be able to detect which devices are running Windows and which are running a Linux Distribution.

The vulnerability scanner then takes this information and compares the information it was able to collect, such as operating system, operating system version, open ports, running services, etc. and compares this information with a database or multiple databases which contain known vulnerabilities. So if a device on your network is running an outdated version of Apache, the vulnerability scanner will list out the vulnerabilities that are known for that version of Apache.

Types of Vulnerability Scanners

There are two main types of vulnerability scanners, server-based and agent-based vulnerability scanners. Here’s a quick look at both of them: 

Server-based Vulnerability Scanners

Server or network-based vulnerability scanners run vulnerability scans from a single device or host. In this configuration, a single device attempts to communicate with all the devices it’s set to scan. 

The benefit of this type of configuration is that most of the processing and resource utilization is limited to a single device on the network. The downside is that these scans can be slower and have the potential to overwhelm the resources provisioned to that single device.

Agent-based Vulnerability Scanners

Agent-based scans are scans which require an agent to run on each device in the network (or in-scope for your vulnerability scans). These agents will scan the device they run on, and then send information to a central server or other device to be aggregated to generate a report. 

An upside of this type of configuration is that no device within the network will be overwhelmed because scanning is spread across devices. However, a small part of the resources on every device in the network will be consumed by running this agent and require more configuration. Additionally, agent-based scans have the potential to consume more bandwidth on the network than server-based scans.

What Vulnerability Scanner Should I Use?

This will depend on your organization, the type of scan you want to run, the familiarity of your team with specific software, and other factors. But we have listed some of the most common options below:

1. Nessus/Tenable.io/Tenable.sc 

These are considered some of the most comprehensive vulnerability scanners around. 

All three products are made by Tenable: 

• Nessus is a downloadable vulnerability scanner that runs like a traditional application.

• Tenable.io is a cloud-based scanner which fulfills the same purpose.

• Tenable.sc is a scanner that puts multiple scanning agents across your network and performs scans using those instead of a single scanner. 

Overall, these three are the industry gold-standard vulnerability management software with easy-to-use interfaces, however, they have the potential to cost more than other tools due to the features they provide.

2. AWS Inspector

AWS Inspector is an Amazon Web Services service which can be enabled within your AWS environment and is a good option for those organizations who are cloud native and would prefer to utilize services built into AWS. It’s a paid service and is not as feature rich as other options, but is easy to use.

3. Azure Defender for Cloud

Azure Defender for Cloud is the equivalent of AWS Inspector in the Azure world. It does come with more features than AWS Inspector, but for the purpose of this article, it does include vulnerability scanning. It’s easy to use and has roughly the same profile as AWS Inspector in that it’s good for organizations in Azure who would prefer to stay within Azure services.

4. GCP Security Command Center

GCP’s Security Command Center is GCP’s version of AWS Inspector and Azure Defender for Cloud. GCP Security Command Center is closer to Azure Defender for Cloud, in that it also includes additional features not related to vulnerability scanning. But like the offering from AWS and Azure, has the same profile, it’s easy to use and will allow you to stay within the GCP environment.

5. Intruder.io

Intruder.io is a highly comprehensive vulnerability scanner with a focus on prioritizing the highest risk vulnerabilities. Intruder is a good solution for integrating with cloud platforms natively and may make sense if your organization uses multiple cloud platforms simultaneously and wants to scan all platforms using a single tool. 

Intruder.io is a paid service which can perform both internal and external scans as well as more specific scan types such as web application scanning.

6. Qualys

Qualys is another popular vulnerability scanning solution, and was actually the first vulnerability scanner to be delivered using the Software-as-a-Service (SaaS) distribution model. 

Qualys is great for performing internal scans on large or complex internal networks as well as scanning cloud environments. It also provides an easy-to-use dashboard for tracking the results of scans. It’s a paid service and is comparable to the Tenable suite of products in terms of cost.

7. Nexpose

Nexpose is another industry standard vulnerability scanner sold by Rapid7. Nexpose has a feature set comparable to Tenable’s offerings or Qualys, but one area in which Nexpose shines is through its ability to scan mobile devices for vulnerabilities. 

If mobile device scanning is important to your organization, Nexpose may be the solution to choose.

8. OpenVAS

OpenVAS is actually an open-source fork of Nessus. When Nessus (which started as an open source product) was made into a proprietary, closed-source application, a team of developers opted to fork the open-source code prior to the change and continued development. OpenVAS is a completely free product with features comparable to Nessus, however, one thing to note is that as a free product, it does require more configuration than the packaged products listed above.

9. Nikto

Nikto is another open-source, command line vulnerability scanner which is completely free. 

Nikto is designed primarily to perform web application/web server vulnerability scans. If you’re looking for a free tool for web application vulnerability scanning, Nikto is a tool to consider.

10. OWASP ZAP

OWASP’s ZAP tool is another great tool for vulnerability scanning. It’s a free and open-source tool for web application vulnerability/security scanning, created and maintained by OWASP. So if your organization is looking for a free tool for web application security/vulnerability scanning, ZAP is another solid option to consider.

11. Snyk

Snyk is a vulnerability scanning tool which is focused on code security scanning as well as container vulnerability scanning. 

Snyk is good if you want to focus on those two types of scanning, or want to focus on scanning infrastructure as code. Snyk integrates with a wide range of tools both on the code side, such as scanning code automatically within your IDE and integrating with Docker deployments to automatically scan containers as they are deployed. 

Snyk is an easy-to-use commercial/paid tool that integrates with your technology stack and provides easy-to-understand reports to help manage vulnerabilities which other platforms might miss.

Bonus: NMAP and Burp Suite

Other tools can of course be used, as long as they perform vulnerability scanning. 

Some commonly used tools like this are NMAP or Burp Suite. These were not included in the list above, as NMAP is primarily a network mapping tool, which does offer some level of vulnerability scanning. If you plan to use NMAP, you should clear it with your auditor first. 

Burp Suite is a very comprehensive tool which includes a vulnerability scanning application. However, the product itself includes multiple tools which extend far beyond just vulnerability scanning. You can easily use Burp Suite’s vulnerability scanner, but the full suite of tools may be too much to pay for if you only need a vulnerability scanner.

If you’re looking to automate SOC 2, ISO 27001, or NIST 800-53 compliance—while getting expert guidance on things like choosing the right vulnerability scanner for your organization—book some time with our team.