OpenVAS

Overview

OpenVAS is a vulnerability-scanning platform from Greenbone, aimed at private users and organizations that want to scan systems within their own environment. Its free appliance makes it accessible, but its community feed, limited features, and lack of default support make it a poor substitute for the commercial offering in professional operations.

Scanning supports authenticated and unauthenticated checks across internet and industrial protocols, with performance tuning for large scans. Greenbone was founded in Germany in 2008 and is headquartered in Osnabrück.

For category comparisons, see Vulnerability Scanning Software and Network Vulnerability Scanners.

Key features

OPENVAS SCAN checks network services, servers, applications, container images, and authenticated endpoints for vulnerabilities, misconfigurations, and missing patches. A daily updated vulnerability-test feed and continuous scanning support ongoing vulnerability management; authenticated scanning can reveal issues that unauthenticated checks cannot. CIS Benchmarks and IT-Grundschutz are the named compliance frameworks.

The commercial product lists integrations with ServiceNow, Splunk, Nagios, Sourcefire, and CyberArk. It comes as a hardware or virtual appliance and can run entirely within the customer's environment, a fit for organizations that need on-premises deployment. The supported target list and 150-asset limit give buyers a concrete scope to evaluate.

Pricing

OPENVAS FREE costs nothing and provides a virtual appliance using the Community Feed. It is intended for private use and non-professional IT infrastructures, not as a fully supported business scanner. The appliance cannot itself be updated, and it omits schedules, notifications, integrated backups, and air-gap support. There is no default enterprise support; product questions go to the Greenbone Community Portal, where help is voluntary. Its self-signed TLS certificate also requires a browser security exception.

OPENVAS BASIC costs €2,524 a year, billed per year. It offers entry-level vulnerability management, but excludes API access, sensors, remediation tickets, and Greenbone Support. Those exclusions matter for teams needing integrations, distributed scanning, workflow support, or vendor assistance.

OPENVAS SCAN uses a hardware or virtual appliance with custom pricing by quote. Commercial support includes German- and English-language support, software upgrades, and access to the Enterprise Feed, whose vulnerability tests and information are updated daily. Organizations needing those capabilities should request a quote rather than assume BASIC includes them. The pricing note also offers a 14-day trial.

Platforms

OpenVAS supports API, Linux, macOS, self-hosted, web, and Windows environments. Its listed deployment model is on-premises, and the appliance approach suits organizations that want scanning to remain within their own environment.

Who it's for

OPENVAS FREE is best for private users and non-professional IT environments willing to accept a community-maintained feed, limited enterprise features, and informal support. BASIC fits buyers seeking entry-level vulnerability management who can work without API access, sensors, remediation tickets, or Greenbone Support. Organizations scanning a broader set of targets or requiring supported upgrades and the Enterprise Feed should consider OPENVAS SCAN, while weighing its quote-based cost.

Pros and cons

• Pro: Authenticated and unauthenticated scanning across internet and industrial protocols gives teams flexibility in how they assess systems.
• Pro: Commercial scanning covers services, servers, applications, endpoints, and container images, with named integrations for common operational tools.
• Pro: Appliance deployment can keep scanning entirely inside the customer's environment.
• Con: The free edition cannot update itself and lacks schedules, notifications, backups, and air-gap support, limiting its fit for managed operations.
• Con: No default enterprise support and a browser-flagged self-signed certificate add support and setup friction.
• Con: BASIC omits API access, sensors, remediation tickets, and Greenbone Support despite its annual price.

Alternatives

Intruder is worth comparing for readers seeking a freemium option whose free plan covers five infrastructure targets, weekly external scans, and one connected cloud account, but excludes web apps.

ManageEngine Vulnerability Manager Plus is another freemium alternative, with a free edition and a Professional on-premises plan priced at $695 a year.

NSAuditor AI offers a free Community plan; its maker says it has provided network security and recovery software since 2004.

ConnectSecure is a paid alternative with usage-based tiers starting as low as $300 a month and a free trial.

Holm Security Vulnerability Management is a paid alternative licensed by assessed assets, with contracts usually lasting one to three years.

Vornin is another freemium option.

Rapid7 InsightVM is a paid alternative whose displayed $1.62 a month pricing is for 500 assets and includes unlimited user accounts, shared data across tools, single sign-on, and 24/7 technical support.

Nuclei is a free, MIT-licensed Linux, macOS, self-hosted, and Windows CLI, primarily intended as a standalone tool.

Verdict

Choose OpenVAS if you want an on-premises vulnerability scanner and can match the free edition to private or non-professional use, or budget for commercial capabilities and support. Its breadth of scan targets and appliance deployment are compelling; the free edition's update and support limitations, and BASIC's excluded operational features, are the main reasons professional teams may need to look elsewhere or step up to the quote-priced SCAN offering.