28

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?

AviD
  • 72,138
  • 22
  • 136
  • 218
atdre
  • 18,885
  • 6
  • 58
  • 107
  • @Rory mentioned the GUI below, so additionally, pretend that I use the CLI version of each for the sake of argument ;> – atdre Nov 14 '10 at 23:38

4 Answers4

14

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation.

In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to include authenticated (audit) style checking. In several scenarios this is likely to produce more accurate results than unauthenticated scanning. Having looked at these scanners authenticated scanning capabilities, Nessus does seem more advanced here than OpenVAS

EDIT : Just thought I'd add another couple of things I've noticed which could be relevant to people looking to evaluate these two. If you're looking at Database Scanning (Oracle/SQL Server) Nessus offers credentialed scanning for these, with DB level creds, which will find some vulnerabilities.

That said if you're interested in database vuln scanning NeXpose could be well worth considering, it seems to have good authenticated and unauthenticated database scanning.

Rory McCune
  • 60,923
  • 14
  • 136
  • 217
  • I was under the impression that OpenVAS had more plugins than Nessus, and that OpenVAS also included authn checking with SLAD -- http://openvas.org/compendium/security-local-auditing-daemon.html? – atdre Nov 14 '10 at 23:37
  • 1
    @dre Well I've not done a detailed look at coverage but going on the numbers on their pages http://www.openvas.org/openvas-nvt-feed.html mentions 18000 NVTs, for nessus there's mention of 40000 plugins here http://www.tenablesecurity.com/plugins/index.php?view=all – Rory McCune Nov 16 '10 at 12:15
  • 1
    We use Nessus, and have gotten a lot of milage out of the audit files. If you actually have configuration guidelines then being able to build your own audit files is a great help. – Scott Pack Dec 08 '10 at 14:55
11

A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures:
Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget)

Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); 7 were only spotted by some and 4 were missed completely.

Tenable responded with an article on The Right Way To Configure Nessus For Comparison.

jtpereyda
  • 1,430
  • 2
  • 16
  • 26
s3ctester
  • 126
  • 1
  • 2
  • This article "The Right Way To Configure Nessus For Comparison" is dated Paul Asadoorian August 24, 2012 so that doesn't really qualify as recent. – kkron Mar 27 '20 at 22:58
2

Though Nessus comes at a hefty price whereas OpenVAS is free and open-source but Nessus has a larger range of common vulnerabilities and exposures (CVE) coverage. Nessus even has better server-side compatibility. Also, OpenVAS doesn't offer policy management whereas Nessus does.

schroeder
  • 123,438
  • 55
  • 284
  • 319
MichaelF823
  • 21
  • 2
0

From years of Nessus usage (against competitors such as Retina, OpenVAS etc) it is not perfect, but it is still better than the competition for coverage, and ease of translation into real-world results.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320