88 Network Vulnerability Scanning Tools
Network vulnerability scanning tools, cover a broad range of systems, often incorporating all of the devices which make up your local internal network or the devices and services you have which may be accessible externally over the internet.
There are lots of vulnerability scanning tools currently on the market. Many specialize in web applications, secure code analysis, and cloud services.
This article includes information regarding Tenable products. Forge Secure is now a Tenable partner and reseller which should be taken into account with any reviews or recommendations.
A network vulnerability scanner can assess this broad range of devices by focusing on the services and open ports that your devices run, as well as the configuration of the device and reviewing the patching and versions of the system and installed software.
Vulnerability scanning services do have their limitations. Depending on the individual tool, they may have limited ability to check your specific device or software, so it is always worth following some vulnerability scanning best practices, considering getting as much information as possible regarding the coverage of a tool, or utilizing trial versions, to ensure it will cover your specific requirements.
The following network vulnerability scanners are focused on identifying vulnerabilities within your internal and external network, although some are more specialized to the external attack surface or web application scanning, and some have additional features beyond only network scanning.
For a more detailed guide on vulnerability scans review the following, Vulnerability Scan Guide.
Network Vulnerability Scanning Tools
Company | Product | Trial/Demo | Notes | |
---|---|---|---|---|
APISec | APISec | Free Trial | APISec has a focus on API testing rather than an entire web application. | |
AppCheck | AppCheck | Free Trial | Vulnerability scanning solutions for your external and internal infrastructure and web applications. | |
Armis | Armis Centrix | Demo | Asset Management with security and patch management. | |
AT&T Business | AlienVault USM | Free Trial | Asset discovery and vulnerability scanning solution. | |
Beyond Security | BeSECURE | Demo | A VM tool designed to scan your infrastructure for vulnerabilities. | |
Camel Secure | CAVM | Demo | Vulnerability scanner focused on API testing with integrations to aid with development. | |
Carson & Saint | TR-3 | Free Trial | A cloud based scanning solution designed around small business use. | |
Carson & Saint | BB-9 | Contact Provider | An on premises vulnerability scanning appliance to install and scan your infrastructure. | |
Carson & Saint | SAINTCloud | Contact Provider | A cloud based scanning solution that can also be used for penetration testing access. | |
CISOfy | Lynis | Free Trial | Linux and Mac Vulnerability Scanning and Hardening. | |
ConnectSecure | ConnectSecure | Free Trial | Security scanning solution targeted at MSP’s. | |
CyberAnt | NetCaptain | Demo | Scan and track your infrastructure vulnerabilities. | |
Cyberteq | mUnit | Contact Provider | Detect vulnerabilities and assign tasks and assets to system owners. | |
CyberWatch | CyberWatch | Demo | Agent and Agentless scanning options for vulnerabilities and compliance, with patch management solutions included. | |
Cycognito | Cycognito | Demo | Continuous security testing with a focus on web applications. | |
Cymulate | Cymulate Platform | Demo | Identify attack surface, vulnerabilities and attack paths. | |
Cyrisma | Vulnerability Management | Demo | Vulnerability identification for your internal and external assets, with patch deployment options. | |
Dectar | ACSIA CRA | Contact Provider | Mapping and Scanning for your external attack surface. | |
Deepinfo | Deepinfo | Demo | Identify assets and vulnerabilities that make up your external attack surface. | |
Defendify | Defendify | Free Essentials Version | Scanning and prioritization for your external and internal assets. | |
Detectify | Detectify | Free Trial | Search, identify and scan your external attack surface. | |
EdgeScan | EdgeScan | Demo | Search, identify and scan your external attack surface. | |
Enginsight | Enginsight | Free Trial | External and Internal vulnerability scanning with automated responses and patching options are available. | |
ESET | ESET Protect MDR | Contact Provider | Vulnerability Scanning & Patch Management Features | |
Flexera | Flexera | Video Demo | A vulnerability and patch management solution. | |
Fortra | Frontline VM | Demo | A SaaS vulnerability management solution providing vulnerability scanning and compliance auditing. | |
Fortra | Tripwire IP360 | Demo | Provides visibility and scanning for your on-premises and cloud networks. | |
Fortra | Alert Logic | Demo | Identify vulnerabilities in your network devices, web applications, and cloud solutions. | |
FullHunt | FullHunt | Free Trial | Identify assets and vulnerabilities that make up your external attack surface. | |
GFI | LanGuard | Demo | Network discovery and vulnerability scanning, which allows you to categorize your assets into groups for different teams. | |
Greenbone | OpenVAS | Free | An open-source vulnerability scanning tool for your infrastructure | |
Havoc Shield | Havoc Shield | Demo | Vulnerability scanning for your devices and applications. | |
Holm Security | S&N Scanning | Free Trial | Scan external and internal infrastructure using a cloud or on-premises solution. | |
IBM Security | Randori Recon | Free Trial | Maps out external attack surface and vulnerabilities | |
Infiltration Systems | Infiltrator | Free | Network scanning and auditing tool for your internal devices. | |
Intruder | IVS | Free Trial | An Agent based scanning solution to install on each of your assets. | |
Intruder | EVS | Free Trial | An external scanning solution to target your IP’s and Web apps. | |
ITrust | IKare | Free Trial | Detect and scan your network assets, allocating devices into logical groups. | |
Lupasafe | Lupasafe | Free Trial | Vulnerability scanning for your devices, web apps, and networks, with the addition of monitoring for data breaches. | |
Mageni | Mageni | Free | Scanning for your internal and external devices. | |
ManageEngine | Vulnerability Manager Plus | Free Trial | Vulnerability scanning and device management solution. | |
Microsoft | EASM | Contact Provider | Identify assets and vulnerabilities that make up your external attack surface. | |
Microsoft | Microsoft Defender Vulnerability Management | Free Trial | Device management and vulnerability identification solution for Microsoft Windows devices. | |
NetVigilance | WebScan | Contact Provider | External infrastructure and web application vulnerability scanning. | |
NetVigilance | External Scan | Contact Provider | External infrastructure vulnerability scanning. | |
NetVigilance | Internal Scan | Contact Provider | Agent-Based vulnerability scanning for your Windows devices. | |
NinjaOne | Vulnerability Management | Free Trial | Endpoint vulnerability identification, with device management capabilities, including alerting of issues and applying patching and mitigation. | |
OnSecurity | Scan | Free Trial | Continuously identify, scan and monitor your external attack surface. | |
Outpost24 | Sweepatic | Free Scan | Discovery, mapping, and vulnerability identification of your internet-facing assets. | |
Patrowl | Patrowl | Demo | External attack surface identification and vulnerability scanning. | |
Pentera | Pentera Core | Demo | Internal Network Vulnerability Scanning and Attack Chain Mapping | |
Pentera | Pentera Cloud | Demo | Cloud Infrastructure Vulnerability Scanning and Attack Chain Mapping | |
Penteston | Penteston | Contact Provider | Vulnerability scanning for your external network and applications. | |
Peris.ai | Bima | Contact Provider | Identify vulnerabilities and track progress within a vulnerability management program. | |
Positive Technologies | MaxPatrol 8 | Contact Provider | Vulnerability scanning for your devices and software with options for pen-testing conducted using the installed system. | |
Positive Technologies | XSpider | Contact Provider | Vulnerability scanning for your devices, software and web applications. | |
Positive Technologies | MaxPatrol VM | Contact Provider | Vulnerability scanning for your devices and software. | |
Qualys | VMDR | Free Trial | Scan, prioritize and remediate your vulnerabilities. | |
Rainforest Tech | Rainforest Infra | Demo | Cloud based device and network scanning solution. | |
Rapid7 | InsightVM | Free Trial | An Agent and Server scanning solution for your infrastructure assets and integrating with dozens of other solutions to aid in reporting and vulnerability management. | |
Rapid7 | Nexpose | Free Trial | An on-premises vulnerability scanning solution with a range of supported integrations. | |
RapidFire Tools | VulScan | Demo | External and internal network scanning with ticket creation options for remediation. | |
Reconfirm | Reconfirm | Demo | External attack surface mapping and vulnerability identification with data breach detection options. | |
Red Maple | FractalScan | Free Version | External attack surface mapping and vulnerability identification. | |
ResilientX Security | ResilientX | Free Trial | External attack surface identification and vulnerability scanning of your external assets. | |
Ridge Security | RidgeBot | Demo | Security scanning and adversary emulation to identify attack paths. | |
RoboShadow | Vulnerability Scanner | Free Option | External vulnerability scanning and device endpoint scanning. | |
SecOps Solution | SecOps | Free Trial | An agentless vulnerability scanning and management solution that can aid in patching and remediation. | |
SecPod | SanerNow | Free Trial | Vulnerability scanning and management for your assets. | |
SecPoint | Penetrator | Free Trial | Scan external and internal assets through a cloud solution and Microsoft Hyper-V option. | |
SecPoint | Cloud Penetrator | Free Scan | Scan external assets through this cloud only solution of the vulnerability scanner. | |
Security For Everyone | Security For Everyone | Free Trial | Continuous vulnerability scanner for your external assets. | |
Secyour | Secyour Scanner | Demo | External vulnerability scanning and attack surface discovery. | |
Shield Cyber | Shield | Demo | Attack surface mapping and vulnerability identification. | |
SyxSense | SyxSense Secure | Demo | Vulnerability scanning and device management. | |
Tac Security | ESOF VACA | Free Trial | Scanning options for vulnerabilities and configuration, with patch management solutions included. | |
Tanium | XEM | Free Trial | Vulnerability identification and prioritization platform. | |
TechBridge | tbVA | Demo | Scanning options for vulnerabilities, configuration and compliance for your internal and external infrastructure in addition to web applications. | |
Tenable | Nessus Essentials | Free | The free version of the Nessus vulnerability scanner, although limited to 16 IP Addresses. | |
Tenable | Nessus Professional | Free Trial | A vulnerability scanner focused on identifying infrastructure vulnerabilities. | |
Tenable | Nessus Expert | Free Trial | A further developed Nessus Vulnerability scanner, incorporating Web Application scanning and External attack surface scanning. | |
Vicarius | vRx | Free Trial | Vulnerability scanning, with patch deployment and mitigation methods. | |
Vulners | Linux Scanner | Contact Provider | A Linux vulnerability scanning tool to install on each required device. | |
Vulners | Windows Scanner | Contact Provider | A Windows vulnerability scanning tool to install on each required device. | |
Vulners | Perimeter Control | Free Scan | A vulnerability scanning tool for your external perimeter. | |
WithSecure | Elements Vulnerability Management | Free Trial | Agent and Network based scanning to cover your whole infrastructure. | |
WizNucleus | CyberWizPro | Demo | A vulnerability management platform for identification, tracking and remediation | |
XM Cyber | XM Cyber | Demo | Vulnerability identification and attack path mapping. |
Choosing the right tool for you
Do you have lots of remote workers?
Where you have a large number of remote workers and equipment that isn’t set up in a central location, a single vulnerability scanning device that scans all other devices, may not be the most effective solution.
When scanning remotely your devices may not always have access to a VPN for their office, connections may drop, and the scanner may consume a large amount of bandwidth and run slowly.
Where this is the case, scanning solutions that offer Agent-based options might be your preferred choice. This allows you to install software on each of your remote devices, so the devices scan themselves and then submit the results to a central location at regular intervals.
Do you have devices that you cannot install software on?
For other businesses, you may have a large amount of networked devices that do not have the option to install software on. For these situations, a central server that acts as your vulnerability scanner and creates a network connection to remotely log in to your other devices will be your preferred option.
External or Internal Vulnerability Scanning Tools
Depending upon where the majority of your infrastructure and services are located, you may gain more benefit from a vulnerability scanning software that is focused around your external attack surface and includes options to discover and map out services you may not be aware of.
For a more in-depth review of two vulnerability scanning tools, a comparison of Nessus and OpenVAS can be referred to here.
Additional Features Beyond Vulnerability Scanning
Many tools are now designed as a complete vulnerability management solution, allowing you to not only scan for vulnerabilities but also to assign remediation tasks to your teams, track the progress of devices and vulnerabilities over time, and even deploy patching and configuration changes to your devices.
The solution you choose may need to take into account these additional features so that you can identify vulnerabilities in your systems and also implement a solution to manage your devices and their security threats.
Multiple User Accounts and Permission Levels
If you are working as part of a large team or need other users to have access to the results but not to set up their own scans, having a solution with varying account permissions available can be a useful feature to work with the output of the vulnerability scanner.
Create A Prioritized List Of Vulnerabilities
Where multiple vulnerabilities need to be addressed, a useful feature of any vulnerability scanning tool can be to create ordered lists of vulnerabilities based upon their priority to be addressed.
These ordered lists can take into account multiple factors beyond impact severity and also allow organizations to add their own specific business context to a vulnerability.
A more complete description of vulnerability prioritization is provided under the post, “What is Vulnerability Prioritization“.
Assign Tasks and Track Vulnerabilities
Ensuring your team is being allocated the appropriate jobs and that patches and mitigation actions are being deployed is vital as part of a vulnerability management program. Being able to track this information within a single platform can be a useful feature if operating as a vulnerability manager.
Integration With Your Current Solutions
Many vulnerability scanners offer options to integrate with your existing solutions, acting as additional sources of data and information. This could be through ticketing options such as Jira or making API calls to display the vulnerability data within another platform.
Other solutions have integrations to incorporate data from other sources into their own platform, intending to be the primary dashboard you interact with, but including data from secondary sources.
Depending on the solutions you already have in place, integration options should be considered when choosing your vulnerability scanner.
Patching and Mitigation Deployment Options
While some vulnerabilities may require more planning and testing before deploying a patch, for some issues the ability to identify and deploy patches all from a single console can be a valuable and time-saving feature when maintaining a secure infrastructure.
Compliance and Configuration Scanning Solutions
If you are working towards a compliance certification or have your own standards that you want to ensure are maintained for all of your devices, a compliance and configuration scanning option and some scanning best practices can help to ensure you are alerted to any devices that fall outside your intended security standard.
Automated Vulnerability Scanning Schedule or Continuous Vulnerability Scanning
For many modern vulnerability scanners, a useful option is to be able to configure your scanning protocols at the start, and have these scans run on a scheduled loop or continuously running one after another, to search for any newly identified threats.
Alerts for Recently Disclosed Vulnerabilities
Vendors will often disclose recently discovered vulnerabilities that are known to impact their systems. Vulnerability scanning tools which make use of these news feeds to alert you of potential security risks, can be useful to proactively secure your business.
Checks Against Known Data Breaches
For many security tools that focus on your internet-facing assets, options are available for searching through known data breaches and looking for records that relate to your company and domains. This can be a useful indication of where issues may have occurred in the past which impact your business, and provide useful mitigation strategies, such as changing affected accounts or updating company policies to avoid further data breaches.
Vulnerability Scanning Software Limitations
Vulnerability Scanning and Penetration Testing
Some tools aim to simulate the activities of Penetration Testing, this can be through gathering information about your devices and vulnerabilities and aiming to draw an exploitation path through your network.
This visual representation of how an attacker may exploit one issue and use this to further escalate their access to other devices and areas of your business can be useful when planning defense-in-depth strategies and taking preventative actions to eliminate attack paths.
While this feature can be very useful with vulnerability scanning, particularly with internal network vulnerability scanners, there are still limitations in their capabilities and the types of vulnerabilities and connections they can make. While these tools and features have begun to approximate certain actions a penetration tester may make, they still shouldn’t be considered a complete replacement for all the different types of security testing.
Over the next few years, with further development of tools and the incorporation of AI technologies, the gap between automation and manual testing may begin to close.
Vulnerability Scans and False Positives
False Positives occur when your network vulnerability scanner tools report security vulnerabilities that your devices are not affected by.
This type of issue can occur when a specific setting, device response, or identified patch is reported incorrectly. Sometimes a repeat vulnerability scan is enough to determine the error, although some scanners will consistently report the same issue.
Although this can be frustrating it is an issue that is quite common across many vulnerability scanning tools and is often the reason some businesses choose a managed vulnerability scanner, as typically these results will be manually verified before reported.
While some companies may advertise they have “100% zero false positives”, this may indicate a smaller number of vulnerabilities that are identified and reported by the scanner, which is itself a limitation of the scanner’s capabilities.
Vulnerability Scanning for Non-Standard Solutions
As vulnerability scanners are designed around the most common network devices, operating systems, and software solutions, where you have systems that fall outside of this standard, you may find you have blank spots in your coverage for security threats.
While this may not be a common occurrence for many businesses it can pose a particular challenge for some, and highlights some of the limitations of security scanning tools.
In these situations it is likely manual penetration testing would be required to assess your systems security vulnerabilities, although it should also be pointed out that an uncommon solution may not be familiar to a penetration tester either, in which case you may need to be selective with your security testing partner and ask for prior experience working on similar solutions.
Conclusion
Investing in a network vulnerability scanning tool can be a difficult decision when trying to find a tool that meets your requirements, helps to improve your security, and provides useful information and features.
In many cases, a single vulnerability scanner will not be enough to meet all of your requirements. If this is the case a preferred option may be to use freely available resources where possible and to invest in tools where necessary.
Alternatively, you can find a security testing partner who already uses multiple vulnerability scanners and can assess all of your systems saving the requirement of purchasing multiple tools, however, you will likely have less regular security testing conducted, so there is a need to find a balance between price and regular vulnerability scanning that works for your requirements.
Where you have any further questions regarding different cybersecurity solutions, our consultants are available to address any concerns you may have.