Alternatives to Nessus
Widely used commercial vulnerability scanner. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Nessus
Widely used commercial vulnerability scanner.
Replacements
Listings that take over the same core job as Nessus.
OpenVAS
Full-featured open-source vulnerability scanner.
OpenVAS is free and GPL-2.0 open source with a community feed and built-in scheduling, but runs on Linux and installation and feed synchronisation are involved.
Qualys Community Edition
Free, cloud-based edition of the Qualys security platform for asset discovery and vulnerability assessment.
Qualys Community Edition is a cloud-hosted free tier limited to a few IPs, storing scan data with Qualys instead of running a local scanner.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Nuclei is a free MIT-licensed command-line scanner driven by readable YAML templates that fits CI, but coverage depends on the template library.
Vuls
Assess known vulnerabilities on Linux and FreeBSD systems.
Vuls is a free GPL-3.0 command-line tool assessing known vulnerabilities on Linux and FreeBSD hosts without an agent, not a network-wide scanner.
Pentest-Tools.com
An online toolkit of vulnerability scanners and penetration testing tools that produces customizable reports.
Pentest-Tools.com is a hosted toolkit of scanners that validates findings with exploits and produces audit-ready reports.
OpenSCAP
Open source tools for scanning systems against SCAP security policies and hardening baselines.
OpenSCAP scans against SCAP policies and hardening baselines rather than a general vulnerability plugin library.
Also worth comparing
These listings name Nessus as their own alternative, so the relationship runs both ways.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
Nessus is a closed-source commercial scanner with a large plugin library and compliance auditing; its free Essentials edition is capped at sixteen IP addresses.
Similar software
Related functionality, not a direct replacement.
Metasploit Framework
The standard open-source exploitation framework for authorised penetration testing and verifying that a vulnerability is real.
DefectDojo
An open source, self-hosted vulnerability management platform that collects and tracks findings from security scanners.
CIS-CAT Lite
A free tool from the Center for Internet Security that checks systems against CIS Benchmarks.
Shodan
A search engine that indexes internet-connected devices and the services they expose.
Trivy
Scan software and infrastructure for known security issues.
