Open-Source Security Tools
OpenVAS/Greenbone: The Open-Source Vulnerability Scanner
OpenVAS is the open-source vulnerability scanner at the heart of the Greenbone suite: network-level scanning of live services across a feed of tens of thousands of vulnerability tests, with authenticated probes (SSH, SMB) that reach deeper than a port scan ever can. It is the free answer to Nessus-class commercial scanning, and its discipline lives in scan scheduling and false-positive review.
Key points
- Architecture is manager-scanner-feed: the GVM stack (gvmd, openvas scanner, redis, GSA web UI) runs as an appliance or docker deployment; the feed (Greenbone Community Feed) syncs Network Vulnerability Tests continuously, and keeping feed sync healthy is the first operational habit, since a stale feed silently scans last year's world.
- Scan types have real semantic differences: unauthenticated scans probe services from outside (what an attacker sees), while credentialed scans (with SSH/SMB credentials) enumerate installed software versions and local configuration, which is the mode that actually answers the patching question; plan both schedules.
- The results are a project, not a report: false positives and duplicate findings come standard, so grading (severity floor, exploitability, remediation owner), exception handling, and a watch-folder for retest verification turn output into actionable tickets; an untuned weekly scan becomes noise that nobody reads.
- Performance/sizing shapes scheduling: host discovery before deep scans, concurrency caps, and scan windows that avoid the nightly backup crunch; a 500-host estate wants distributed scanners (GVM sensors/appliances) with the manager centralizing results, not one box grinding through a month-long cycle.
- Compliance fit is real: OpenVAS output maps to PCI-DSS 11.3-class requirements, CIS benchmark coverage via SCA-class checks, and evidence documentation that auditors accept; many teams pair OpenVAS raw findings with Wazuh SCA-class agent checks (our dedicated article) so scanners and agents cross-confirm.
- Where it sits in our security-tools set: OpenVAS answers 'what is vulnerable in my live estate' (complementing Trivy for artifacts and Falco for runtime behavior); among open-source options it is the most complete Nessus alternative, with the honest caveat that setup and feed management consume real ops time at the entry.
Field note
An OpenVAS credentialed scan on a 'patched' client estate found 14 hosts missing last quarter's updates behind a change freeze nobody lifted. The unauthenticated scans had looked clean all year. Credentials are the difference between an audit and a comfort ritual.
Frequently asked questions
OpenVAS or Nessus for professional work?
OpenVAS for budget estates and internal audits where open-source posture matters; Nessus's plugin speed/maturity and commercial support feed matter for client-facing pentesting businesses; many outfits run both, since OpenVAS catches a lot of the same signatures.
Why are credentialed scans night-and-day better?
Because installed software (not just listening services) drives most vulnerability surface; with credentials the scanner enumerates package versions and local config directly instead of inferring from banners, which takes false positives down and real findings up.
How often should we scan?
Credentialed scans weekly-to-monthly per asset class depending on change velocity, plus ad-hoc scans after major changes; a scheduled unauthenticated scan adds outer-perimeter evidence but credentialed coverage is the real patch question.
What is the first-week setup checklist?
One appliance/stack deployed, feed sync confirmed healthy, discovery scan of the CB-scope (what assets actually exist), a first credentialed scan against a small host set, then report tuning (severity floors and exception policy) before scaling the scope.
How Kinetikatech helps with open-source security tools
Here's the deal: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. Hand it to our Penetration Testing and Linux Server Security service and it's covered, assessed properly, implemented cleanly, monitored around the clock.