17.9
ManageEngine Vulnerability Manager Plus identifies and assesses network vulnerabilities, then helps teams prioritize and remediate them.
Free planWebAPILinux
Best Vulnerability Scanner Software in 2026
Vulnerability scanners check software, websites, networks or other assets for security weaknesses. Use this list to compare scan coverage and the results a tool can produce. Check whether a scanner has an Android app if you want to work from a Xiaomi, Redmi or POCO phone.
27.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
37.4
Grype is a free, Apache-2.0-licensed vulnerability scanner for container images, filesystems, SBOMs, and individual packages.
Free planOpen sourceLinuxmacOSSelf-hosted
- 4
Intruder
Intruder provides continuous vulnerability scanning for infrastructure, web applications, APIs and cloud environments, with issue prioritization and remediation guidance.
Free planWebAPILinuxmacOS7.4Free plan - 5
OpenVAS
OpenVAS is a vulnerability scanner for finding weaknesses in IT systems.
Free planWebAPILinuxmacOS7.2From €2,524 a year - 6
Trivy
Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters.
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 7
Detectify Surface Monitoring
Detectify Surface Monitoring continuously monitors internet-facing subdomains for exposed files, vulnerabilities, and misconfigurations.
Free planWebAPI6.9From €2,500 a year - 8
Kiuwan Code Security
Kiuwan Code Security is a static application security testing tool that finds and prioritizes vulnerabilities in source code and offers remediation…
WebAPILinuxmacOS6.8From $49 a month - 9
Nuclei
Nuclei is a free, open-source vulnerability scanner for applications, infrastructure, cloud platforms, and networks.
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 10
StackHawk HawkScan
StackHawk HawkScan is a dynamic application security testing scanner for web applications and APIs.
WebAPILinuxmacOS6.8From $10 a month - 11
Acunetix
Acunetix, now Invicti Web + API, scans running web applications and APIs for exploitable vulnerabilities.
WebAPILinuxSelf-hosted6.7$500 one-time - 12
Astra Security
Astra Security describes its product as a continuous penetration testing platform for web applications, APIs, and cloud infrastructure.
WebAPI6.5From $699 a year - 13
Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
WebAPILinuxSelf-hosted6.4 - 14
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 15
Mend.io
Mend.io is a paid application security platform for code, AI components, and the attack surface connecting them.
Web6.1From $250 a year - 16
Rapid7 InsightVM
WebLinuxmacOSWindows5.9From $1.62 a month - 17
Tenable Nessus
Tenable Nessus is on-premises vulnerability-scanning software for assessing IP addresses, operating systems, network devices, databases, applications, and SCADA systems.
LinuxmacOSWindows5.8From $4,790 a year - 18
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 195.6From $2,195 a month
- 20
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 21
Tenable Security Center
WebLinux5.0 - 225.0
- 23
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9 - 24
OpenText Fortify Software Security Platform
OpenText Fortify Software Security Platform is a web-based application security product for hybrid deployment environments.
Web4.9 - 254.9
Choosing well
Compare free access and paid plans
Check the free-plan label, paid-from price and whether a free trial is available. Pricing may be listed as a fixed starting price or as pricing on request.
A free plan can help you assess the workflow before paying, while a trial gives time-limited access. Confirm the terms for the scanner you are considering.
Match scan targets to your assets
Compare the scan targets supported by a tool with what you need to review, such as applications, websites or other assets.
Authenticated scans can inspect areas that require login. Check whether this scan mode is included before choosing a service.
Choose a deployment that fits
Deployment options in this category include web services, Windows, Linux, macOS, self-hosted setups and APIs. Pick the connection method that fits your devices and workflow.
If phone access matters, verify Android support directly; it is not included in the listed platform facts.
Check limits and report exports
Review the asset limit to see how much you can monitor under a plan. Limits can affect the cost and setup as your environment changes.
Compare report export formats and options if you need to share findings, archive results or connect scanner output to another system.
Review code and scan continuity
Open-source code is available from tools in this category, so check the licence and whether the project fits your requirements before adopting it.
Continuous scanning can look for changes over time instead of relying on a single run. Confirm that this capability is provided on the plan you want.
Questions people ask
Do these vulnerability scanners have Android apps?
Android support is not included in the listed platform facts. Check the individual product before expecting an Android app.
Can I use a free vulnerability scanner?
Free plans are offered by tools in this category. Check the plan details, scan targets, asset limit and report exports before relying on it.
What is an authenticated scan?
An authenticated scan uses login access to inspect protected areas. Compare whether this feature is available for the scanner and plan you choose.
Which deployment types are available?
Listed deployment platforms include web, Linux, Windows, self-hosted, API and macOS. Product support differs, so verify the option you need.
Why do asset limits matter?
An asset limit sets how much you can scan or monitor under a plan. Compare it with your environment and check how it changes between plans.