OpenVAS

Definition

OpenVAS is an open-source vulnerability scanning framework that probes networks, hosts, and services for known security weaknesses and misconfigurations. It forms the scanning core of Greenbone's vulnerability management products and is used by security teams to run scheduled or on-demand scans that identify missing patches, weak configurations, and exposed services across an organization's infrastructure, reporting findings ranked by severity so remediation work can be prioritized.

Overview

OpenVAS addresses the problem of tracking which systems in a network are actually vulnerable to known, publicly disclosed security flaws, at a scale where manual checking is not feasible. Rather than testing for a single issue, it runs a continuously updated feed of thousands of vulnerability tests against target hosts and reports back which checks failed, giving security and IT teams a prioritized list of what to patch or reconfigure before an attacker finds it first. Mechanically, OpenVAS works by combining a scan engine with a large library of Network Vulnerability Tests, small scripts written in a dedicated scripting language that each check for one specific condition, such as a service running an outdated version, a default credential still in place, or a configuration flag left at an insecure default. The scanner first performs discovery and service fingerprinting against a target range, then selects the relevant tests based on what it finds, executes them, and correlates results against public vulnerability identifiers so findings map cleanly to known advisories. Results are scored by severity and rolled up into reports that can be filtered, exported, or fed into a ticketing system. OpenVAS sits in the vulnerability-scanning category alongside commercial products like Nessus and Qualys, but distinguishes itself by being fully open source with a community-maintained core, while Greenbone layers a commercial feed and enterprise management console on top. Compared to a tool like Nuclei, which is template-driven and optimized for fast, targeted checks often used in bug bounty and reconnaissance workflows, OpenVAS is built for broader, scheduled infrastructure audits with a heavier scan footprint and a longer history in compliance-driven vulnerability management programs. In practice, organizations deploy OpenVAS as a recurring scanning service, running it weekly or monthly against internal networks, DMZ hosts, and cloud assets to satisfy vulnerability management requirements found in standards like PCI DSS or ISO 27001. Security teams also use it ad hoc after a new host is provisioned or a critical vulnerability is disclosed, to quickly determine exposure across the estate. The main limitations are scan duration and noise: a full OpenVAS scan against a large network can take hours and generates a volume of findings that requires triage, since not every flagged issue is exploitable in context. It also depends heavily on an up-to-date test feed, so stale installations miss recently disclosed vulnerabilities, and, like any active scanner, it can disrupt fragile or legacy systems if run without care, which is why production scans are typically scheduled during maintenance windows and scoped carefully.

Key Features

• Large, regularly updated feed of Network Vulnerability Tests covering thousands of known issues
• Automated service discovery and fingerprinting before test selection
• Severity scoring aligned to CVSS for prioritizing remediation work
• Scheduled and on-demand scanning against defined host or network targets
• Report export in formats suitable for compliance and ticketing workflows
• Web-based management console for configuring scan policies and targets
• Credentialed scanning support for deeper, authenticated vulnerability checks
• Integration with broader Greenbone vulnerability management tooling

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity