Best Vulnerability Scanning Software in 2026
Updated
In short: Intruder is ranked #1 of 36 as of 4 October 2026, ahead of ManageEngine Vulnerability Manager Plus and OpenVAS. The best-ranked option with a free plan is ManageEngine Vulnerability Manager Plus. The lowest first paid tier on this page is Rapid7 InsightVM at $1.62/mo.
Choosing a vulnerability scanner starts with knowing which assets and targets it covers and how it approaches scanning. This ranking compares supported targets and asset limits alongside authenticated and continuous scanning, compliance frameworks and deployment model. Intruder, OpenVAS and ManageEngine Vulnerability Manager Plus are the first entries; Holm Security Vulnerability Management and NSAuditor AI also appear near the top. Consider which scanning modes and frameworks fit your needs, then check free-plan availability and paid-from pricing. The listed criteria give you a way to weigh coverage, deployment and cost, while the ranking order provides another basis for comparing the options.
36 vulnerability scanning software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
36ranked
8free plans on this page
$1.62/molowest paid tier
4 Oct 2026last checked
Input list Vulnerability Scanning Software 25 channels on this page · 108 of 200 spec lines stated by the makers
Ch Tool Free planPaid fromDeployment modelSupported targetsAuthenticated scanningContinuous scanningAsset limitCompliance frameworks Spec sheet Score
01 Intruder Free planYesPaid fromnot statedDeployment modelhybridSupported targetsexternal IP addresses, domains, subdomains, internal Windows/macOS/Linux devices, web applications, APIs, cloud environments, container imagesAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksSOC 2, ISO 27001, PCI DSS, HIPAA, Cyber Essentials 6/8spec lines stated 7.8
02 ManageEngine Vulnerability Manager Plus Free planYesPaid fromnot statedDeployment modelhybridSupported targetsnot statedAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 3/8spec lines stated 7.8
03 OpenVAS Free planYesPaid fromnot statedDeployment modelon premisesSupported targetsnetwork services, servers, applications, endpoints, container imagesAuthenticated scanningYesContinuous scanningYesAsset limit150 assetsCompliance frameworksCIS Benchmarks, IT-Grundschutz 7/8spec lines stated 7.8
04 Nmap Free planYesPaid fromnot statedDeployment modelnot statedSupported targetsnot statedAuthenticated scanningnot statedContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 1/8spec lines stated 7.6
05 Qualys External Attack Surface Management Free planNoPaid fromnot statedDeployment modelhybridSupported targetsrouters, switches, firewalls, servers, workstations, databases, printers, wireless access devices, cloud assets, containers, mobile devices, OT and IoT assetsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksPCI DSS, HIPAA, CIS 6/8spec lines stated 7.5
06 Pentest-Tools Port Scanner Free planYesPaid from$95/moDeployment modelcloudSupported targetsnetwork hosts, hostnames, IP addresses, public-facing infrastructure, internal networks, private cloudsAuthenticated scanningYesContinuous scanningYesAsset limit5 assetsCompliance frameworksISO 27001, NIS2, SOC 2, DORA, CRA 8/8spec lines stated 7.4
07 Ivanti Neurons for Zero Trust Access Free plannot statedPaid fromnot statedDeployment modelcloudSupported targetsnot statedAuthenticated scanningnot statedContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 1/8spec lines stated 7.3
08 NSAuditor AI Free planYesPaid fromnot statedDeployment modelnot statedSupported targetsnot statedAuthenticated scanningnot statedContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 1/8spec lines stated 7.3
09 Nuclei Free planYesPaid fromnot statedDeployment modelnot statedSupported targetsnot statedAuthenticated scanningnot statedContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 1/8spec lines stated 7.3
10 OWASP Nettacker Free plannot statedPaid fromnot statedDeployment modelon premisesSupported targetsIPv4 addresses, IPv4 ranges, IPv4 CIDR blocks, domains, HTTP and HTTPS URLsAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 3/8spec lines stated 7.2
11 Rapid7 Surface Command Free plannot statedPaid from$1.62/moDeployment modelhybridSupported targetsnot statedAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 3/8spec lines stated 7.2
12 Tenable One Attack Surface Management Free planNoPaid fromnot statedDeployment modelcloudSupported targetsIP addresses, operating systems, network devices, databases, applications, SCADA systemsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksCIS Benchmarks, DISA STIG, PCI DSS 6/8spec lines stated 7.1
13 Tanium Deploy Free plannot statedPaid fromnot statedDeployment modelhybridSupported targetsnot statedAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 2/8spec lines stated 7.0
14 VAddy Free planNoPaid fromnot statedDeployment modelcloudSupported targetsWeb applications; authenticated applications; multi-FQDN applications; intranet sites; SPAs; API servers; local development serversAuthenticated scanningYesContinuous scanningYesAsset limit3 assetsCompliance frameworksIPA Safe Web Site checklist; OWASP Top 10; OWASP ASVS 7/8spec lines stated 7.0
15 Holm Security Vulnerability Management Free planNoPaid fromnot statedDeployment modelhybridSupported targetsnot statedAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 3/8spec lines stated 6.9
16 ConnectSecure Free planNoPaid from$300/moDeployment modelhybridSupported targetsnetworks, endpoints, applications, websites, APIs, ports, cloud assets, Microsoft 365, Google Workspace, Active Directory, Entra ID, firewallsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksPCI DSS, HIPAA, GDPR, NIST CSF, NIST 800-53, NIST 800-171, CIS, ISO 27001, ISO 27002, CMMC, Cyber Essentials, Essential Eight, HITRUST, WISP, SMB1001 7/8spec lines stated 6.7
17 Datto Endpoint Backup Free planNoPaid fromnot statedDeployment modelhybridSupported targetsnetworks, endpoints, systems, applications, internet-facing assetsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksnot stated 5/8spec lines stated 6.7
18 Outpost24 Attack Surface Management Free planNoPaid fromnot statedDeployment modelhybridSupported targetsnetwork hosts, IP addresses, FQDNs, ports, cloud environmentsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksPCI DSS, HIPAA, GDPR, NIST, DORA, NIS2 6/8spec lines stated 6.6
19 Tenable Nessus Free planNoPaid fromnot statedDeployment modelon premisesSupported targetsIP addresses, operating systems, network devices, databases, applications, SCADA systemsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksCIS Benchmarks, DISA STIG, PCI DSS 6/8spec lines stated 6.5
20 N-able Risk Intelligence Free plannot statedPaid fromnot statedDeployment modelcloudSupported targetsWindows, macOS, Linux devices, servers, workstations, and mobile devicesAuthenticated scanningnot statedContinuous scanningYesAsset limitnot statedCompliance frameworksPCI DSS, HIPAA 4/8spec lines stated 6.4
21 Rapid7 InsightVM Free plannot statedPaid from$1.62/moDeployment modelhybridSupported targetsnot statedAuthenticated scanningYesContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 3/8spec lines stated 6.4
22 Sirius Free planYesPaid fromnot statedDeployment modelon premisesSupported targetsnetwork infrastructure, hosts, cloud, agentsAuthenticated scanningnot statedContinuous scanningYesAsset limitnot statedCompliance frameworksnot stated 4/8spec lines stated 6.4
23 NSAuditor AI Free planYesPaid fromnot statedDeployment modelon premisesSupported targetsNetwork hosts, CIDR subnets, AWS, Azure, GCP, TLS, DNS, and OT targetsAuthenticated scanningYesContinuous scanningYesAsset limitnot statedCompliance frameworksSOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 6/8spec lines stated 6.3
24 Vicarius vRx Free planNoPaid fromnot statedDeployment modelhybridSupported targetsnot statedAuthenticated scanningnot statedContinuous scanningnot statedAsset limitnot statedCompliance frameworksnot stated 2/8spec lines stated 6.0
25 Vornin Free planYesPaid fromnot statedDeployment modelcloudSupported targetsHostnames, IP addresses, IP ranges, URLs, web applications, APIs, networks, code repositories, containers, Kubernetes clusters, and cloud accountsAuthenticated scanningYesContinuous scanningYesAsset limit5 assetsCompliance frameworksNIS2, DORA, ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, CIS Controls v8, NIST 800-53 7/8spec lines stated 6.0
Compare all 25 in a table
| # | Tool | Score | Free plan | From | Free plan | Paid from | Deployment model | Supported targets |
|---|---|---|---|---|---|---|---|---|
| 1 | Intruder | 7.8 | Free plan | Free | Yes | — | hybrid | external IP addresses, domains, subdomains, internal Windows/macOS/Linux devices, web applications, APIs, cloud environments, container images |
| 2 | ManageEngine Vulnerability Manager Plus | 7.8 | Free plan | $57.92/mo | Yes | — | hybrid | — |
| 3 | OpenVAS | 7.8 | Free plan | €210.33/mo | Yes | — | on_premises | network services, servers, applications, endpoints, container images |
| 4 | Nmap | 7.6 | Free plan | $9,980/mo | Yes | — | — | — |
| 5 | Qualys External Attack Surface Management | 7.5 | No | — | No | — | hybrid | routers, switches, firewalls, servers, workstations, databases, printers, wireless access devices, cloud assets, containers, mobile devices, OT and IoT assets |
| 6 | Pentest-Tools Port Scanner | 7.4 | Free plan | $95/mo | Yes | 95 /mo | cloud | network hosts, hostnames, IP addresses, public-facing infrastructure, internal networks, private clouds |
| 7 | Ivanti Neurons for Zero Trust Access | 7.3 | No | — | — | — | cloud | — |
| 8 | NSAuditor AI | 7.3 | Free plan | $3.25/mo | Yes | — | — | — |
| 9 | Nuclei | 7.3 | Free plan | Free | Yes | — | — | — |
| 10 | OWASP Nettacker | 7.2 | Free plan | Free | — | — | on_premises | IPv4 addresses, IPv4 ranges, IPv4 CIDR blocks, domains, HTTP and HTTPS URLs |
| 11 | Rapid7 Surface Command | 7.2 | No | — | — | 1.62 /mo | hybrid | — |
| 12 | Tenable One Attack Surface Management | 7.1 | No | — | No | — | cloud | IP addresses, operating systems, network devices, databases, applications, SCADA systems |
| 13 | Tanium Deploy | 7.0 | No | — | — | — | hybrid | — |
| 14 | VAddy | 7.0 | No | ¥19,800/mo | No | — | cloud | Web applications; authenticated applications; multi-FQDN applications; intranet sites; SPAs; API servers; local development servers |
| 15 | Holm Security Vulnerability Management | 6.9 | No | — | No | — | hybrid | — |
| 16 | ConnectSecure | 6.7 | No | $300/mo | No | 300 /mo | hybrid | networks, endpoints, applications, websites, APIs, ports, cloud assets, Microsoft 365, Google Workspace, Active Directory, Entra ID, firewalls |
| 17 | Datto Endpoint Backup | 6.7 | No | — | No | — | hybrid | networks, endpoints, systems, applications, internet-facing assets |
| 18 | Outpost24 Attack Surface Management | 6.6 | No | — | No | — | hybrid | network hosts, IP addresses, FQDNs, ports, cloud environments |
| 19 | Tenable Nessus | 6.5 | No | $399.17/mo | No | — | on_premises | IP addresses, operating systems, network devices, databases, applications, SCADA systems |
| 20 | N-able Risk Intelligence | 6.4 | No | — | — | — | cloud | Windows, macOS, Linux devices, servers, workstations, and mobile devices |
| 21 | Rapid7 InsightVM | 6.4 | No | $1.62/mo | — | 1.62 /mo | hybrid | — |
| 22 | Sirius | 6.4 | No | — | Yes | — | on_premises | network infrastructure, hosts, cloud, agents |
| 23 | NSAuditor AI | 6.3 | No | — | Yes | — | on_premises | Network hosts, CIDR subnets, AWS, Azure, GCP, TLS, DNS, and OT targets |
| 24 | Vicarius vRx | 6.0 | No | — | No | — | hybrid | — |
| 25 | Vornin | 6.0 | No | — | Yes | — | cloud | Hostnames, IP addresses, IP ranges, URLs, web applications, APIs, networks, code repositories, containers, Kubernetes clusters, and cloud accounts |
Is your tool on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which vulnerability scanning software is ranked first on Specifiction?
Intruder is ranked #1 of 36 with a score of 7.8. ManageEngine Vulnerability Manager Plus is second and OpenVAS third.
How many of these have a free plan?
8 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Rapid7 InsightVM has the lowest first paid tier we found: $1.62/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing. Paid placements never change a rank.
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Software Composition Analysis Software 65Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56