OpenVAS

Overview

OpenVAS is vulnerability-scanning software for organizations that need to find weaknesses across network services, servers, applications, endpoints, and container images. Its free appliance is best suited to private use and non-professional IT environments; organizations relying on regular updates, operational features, or vendor support should look to the commercial options. The choice is less about whether to scan than whether the free edition’s constraints fit the work.

Key features

Scanning can be authenticated or unauthenticated, covers internet and industrial protocols, and can be tuned for large scans. The vulnerability-test feed is updated daily, while continuous scanning is also supported. These capabilities make OpenVAS relevant to teams seeking ongoing visibility, not just occasional checks. Checks cover vulnerabilities, misconfigurations, and missing patches, and the named compliance frameworks are CIS Benchmarks and IT-Grundschutz.

OPENVAS SCAN covers network services, servers, applications, container images, and authenticated endpoints. Integrations with ServiceNow, Splunk, Nagios, Sourcefire, and CyberArk can connect scanning to existing operational or security workflows. Hardware and virtual appliances can run entirely within the customer’s environment, a fit for organizations that want on-premises deployment.

Pricing

OPENVAS FREE: free. This is a free virtual appliance with the Community Feed and limited enterprise features, aimed at private use and non-professional IT infrastructures. It has no default enterprise support; product questions go to the Greenbone Community Portal, where help is voluntary. The appliance itself cannot be updated, and it lacks schedules, notifications, integrated backups, and air-gap support. Its self-signed TLS certificate triggers browser security warnings and requires an exception. Those are substantial operational and security-friction trade-offs for anything beyond personal or non-professional use.

OPENVAS BASIC: €2,524 a year, billed per year. This entry-level vulnerability-management plan is a paid step up, but it excludes API access, sensors, remediation tickets, and Greenbone Support. It may suit buyers who need a commercial entry point and can do without those capabilities; teams that need vendor assistance or those integrations should compare it with OPENVAS SCAN.

OPENVAS SCAN: custom pricing by quote for a hardware or virtual appliance. Commercial support includes German- and English-language assistance, software upgrades, and access to the Enterprise Feed, which provides daily updated vulnerability tests and information. This is the stronger fit when current enterprise checks and support matter, but the quote-based price means buyers must request pricing rather than compare a fixed annual rate.

Platforms

OpenVAS supports API, Linux, macOS, self-hosted, web, and Windows platforms. The deployment model is on-premises; the commercial appliance can be hardware or virtual, while the free edition is a cross-platform virtual appliance. The listed asset limit is 150 assets, a key constraint for readers sizing a deployment.

Who it's for

OpenVAS Free makes sense for private users and non-professional IT environments willing to accept an un-updatable appliance, community feed, and lack of default support. Basic is for organizations seeking entry-level vulnerability management that do not need API access, sensors, remediation tickets, or Greenbone Support. OpenVAS Scan is better suited to organizations that need daily enterprise-feed updates, supported upgrades, and commercial assistance while keeping deployment within their own environment. If the free edition’s limitations would interrupt routine operations, it is not the practical choice.

Pros and cons

Broad scanning scope: authenticated and unauthenticated tests span internet and industrial protocols, with checks for vulnerabilities, misconfigurations, and missing patches.

Useful commercial deployment options: hardware and virtual appliances can stay entirely within the customer’s environment.

Named integrations and frameworks: ServiceNow, Splunk, Nagios, Sourcefire, and CyberArk integrations, plus CIS Benchmarks and IT-Grundschutz, give buyers concrete compatibility points to assess.

Free edition has consequential limits: no appliance updates, no default enterprise support, and no schedules, notifications, integrated backups, or air-gap support make it difficult to rely on for professional operations.

Basic omits important capabilities: no API access, sensors, remediation tickets, or Greenbone Support may push teams with those needs toward the quote-priced Scan plan.

Free certificate friction: the browser-insecure self-signed TLS certificate requires an exception.

Alternatives

Consider ManageEngine Vulnerability Manager Plus if you want to compare another freemium option with a free edition and a Professional On-Premises plan priced at $695 a year.

Intruder is worth considering when its free plan’s five infrastructure targets, weekly external scans, and exclusion of web apps fit a small, limited-scope need.

NSAuditor AI is another freemium option, with a free Community plan capped at 27 scanners.

Qualys External Attack Surface Management may suit readers who want to evaluate a 30-day trial of CyberSecurity Asset Management with EASM; it has no free plan.

NSAuditor AI offers a Community edition with 27 scanner plugins under the MIT license and a Pro annual plan at $39 a year.

Nuclei is a free, MIT-licensed CLI intended primarily as a standalone tool.

ScanTitan is an alternative with a Professional plan at $119 a year for vulnerability and exposure scanning, malware monitoring, and uptime, vulnerability, and exposure monitoring.

Tripwire IP360 offers a 30-day evaluation license for up to 100 IP addresses, subject to business-use restrictions and vendor review.

For broader comparisons, see Network Vulnerability Scanners and Vulnerability Scanning Software.

Verdict

Choose OpenVAS if you need a broad-scoping vulnerability scanner, especially when on-premises appliance deployment and commercial support matter. The free edition is a reasonable fit for private and non-professional environments, but its frozen appliance, Community Feed, feature gaps, and browser certificate warning make it a poor substitute for supported commercial scanning. Buyers who need professional operations should price OPENVAS SCAN against Basic’s clear exclusions before committing.