OpenVAS

OpenVAS is Greenbone’s vulnerability-scanning offering, spanning a free virtual appliance and commercial on-premises appliances. It best suits teams that want to scan varied IT targets within their own environment; the free edition is a much narrower fit for private and non-professional use.

Overview

OpenVAS detects weaknesses in IT systems through authenticated and unauthenticated tests across internet and industrial protocols. Performance tuning for large scans helps address scale, while the daily-updated vulnerability-test feed gives scanning a regular stream of checks. That daily cadence applies to the feed; the free edition uses a Community Feed and cannot itself be updated.

Greenbone was founded in Germany in 2008 and is headquartered in Osnabrück. Its commercial OPENVAS SCAN can run entirely within a customer’s environment as a hardware or virtual appliance, a practical advantage for organizations that need an on-premises deployment.

Readers comparing Vulnerability Scanning Software or Network Vulnerability Scanners should weigh the broader commercial scanning scope against the free edition’s restricted feed, features, and support.

Key features

OPENVAS SCAN covers network services, servers, applications, container images, and authenticated endpoints, checking for vulnerabilities, misconfigurations, and missing patches. Authenticated scanning is supported, and continuous scanning is listed. CIS Benchmarks and IT-Grundschutz are the named compliance frameworks. Together, these capabilities make the commercial product relevant to teams that need more than a one-off network check.

Integrations include ServiceNow, Splunk, Nagios, Sourcefire, and CyberArk. Commercial support includes software upgrades and access to the Enterprise Feed, with daily-updated vulnerability tests and information. Support is available in German and English.

OPENVAS FREE is a cross-platform virtual appliance for private use and non-professional IT infrastructures. It lacks schedules, notifications, integrated backups, and air-gap support. Its self-signed TLS certificate triggers browser security warnings and requires an exception, while product questions rely on voluntary help through the Greenbone Community Portal rather than default enterprise support. Those constraints make it a poor substitute for a supported commercial deployment.

Pricing

OpenVAS uses a freemium model, with a free plan and a 14-day trial.

The free tier’s Community Feed cannot be updated from the appliance, and the plan omits several operational features. BASIC also makes material trade-offs: no API, sensors, remediation tickets, or Greenbone Support. Teams that need those capabilities or Enterprise Feed access should consider OPENVAS SCAN and its quote-based pricing. A 150-asset limit is stated for OpenVAS; no plan allocation for that limit is given.

Platforms

OpenVAS supports API, Linux, macOS, self-hosted, web, and Windows. The commercial deployment model is on-premises, with hardware and virtual appliances. The free edition is also delivered as a virtual appliance.

Who it's for

OpenVAS is strongest for organizations that want broad vulnerability checks across network services, servers, applications, endpoints, and container images, especially when deployment must remain inside their environment. The commercial support and Enterprise Feed are the more suitable route for teams that depend on updates, upgrades, or vendor assistance. The free appliance is better reserved for private or non-professional environments; its update, feature, and support limits make it unsuitable where those needs are central.

Pros and cons

• Pros: Authenticated and unauthenticated scanning across internet and industrial protocols covers different testing needs.
• Pros: Commercial scanning spans servers, applications, endpoints, container images, misconfigurations, and missing patches.
• Pros: On-premises appliance deployment lets customers keep the commercial scanning environment within their own infrastructure.
• Cons: The free appliance uses a Community Feed that cannot be updated from the product, limiting its usefulness for ongoing vulnerability management.
• Cons: Free users get no default enterprise support, and the self-signed TLS certificate requires a browser exception.
• Cons: BASIC excludes API access, sensors, remediation tickets, and Greenbone Support, so the paid entry tier still has notable operational gaps.

Alternatives

Intruder is worth considering for readers seeking a freemium alternative with a free plan; its free tier has five infrastructure targets, excludes web apps, runs weekly external scans, and connects one cloud account.

ManageEngine Vulnerability Manager Plus is another freemium option with a free edition and a Professional on-premises plan, for readers comparing alternatives that offer both free and paid tiers.

NSAuditor AI offers a free Community plan and runs on Linux, macOS, and Windows; it is an option for readers who want to compare a free alternative across those platforms.

NSAuditor AI also has a free Community plan and a Pro annual plan at $39 a year, for readers comparing a free tier with a priced upgrade.

Nuclei is a free, MIT-licensed CLI intended primarily as a standalone tool, making it a different fit for readers who prefer that format.

OWASP Amass is a free, Apache License 2.0 framework for readers considering an open-source option.

Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM period rather than a free plan, which may suit readers seeking a time-limited evaluation.

ShadowSecurityScanner is a free option using an open-core model.

Verdict

Choose OpenVAS if you need broad vulnerability scanning and value keeping a commercial appliance within your own environment, with enterprise-feed access and support available through OPENVAS SCAN. Look elsewhere if you need the free edition to provide current, appliance-updatable checks, operational features, or default support; its limits are substantial, and BASIC also omits key integrations into vulnerability-management workflows such as API access and remediation tickets.