Free vulnerability scanner or perimeter monitoring?

OpenVAS runs Greenbone's vulnerability tests against the servers and network services you specify. Nuclei runs the templates you select against the targets you supply. If the scan works from a fixed target list, neither will tell you whether that list is complete, that is, which websites, servers and services of your company can be seen from the internet today. Keeping that inventory and deciding what to fix first is still your team's job.

A free scanner has a time cost: if you host it yourself, someone has to set it up, update it and review the results. With a few domains that rarely change, that can be little work. With agencies, subsidiaries and several hosting providers, it is usually a lot more.

We built SeguriScan, IntruForce's platform, so we have a stake in this comparison. We checked the facts about OpenVAS and Nuclei against each project's own documentation.

What OpenVAS and Nuclei check

OpenVAS checks servers and network services for known flaws. It is part of Greenbone Community Edition, open-source software. Its checks come in the Greenbone Community Feed, which is free and updated every day.

Nuclei is MIT-licensed and runs the templates you choose against the targets you give it. Each template is a YAML text file that describes a check; depending on the templates enabled, Nuclei can find known vulnerabilities, misconfigurations and exposed files. ProjectDiscovery and the community write them.
Greenbone's management service stores results and lets you schedule scans. Nuclei can be automated; finding subdomains usually takes a separate tool or data source.
Their self-hosted versions run on your own servers, and you decide what is scanned and when. Some Nuclei checks rely on an external callback service, and integrations or cloud uploads can also send data out, so review those settings first.
Greenbone's free feed leaves out the checks for enterprise products, which are in the paid one. Like any set of checks, it cannot cover every possible vulnerability.

What a scan leaves out

Suppose your marketing agency puts a campaign site on a new subdomain in March. If the scan uses a fixed January target list, it will miss the new subdomain until someone adds it. The scanner checked exactly what was on its list. More on this gap in the declared and the actual perimeter.

Greenbone can store results, schedule scans and compare reports, and Nuclei can be automated, but someone still has to set that up and act on the output. Without that process, these tasks stay with your team:

comparing each scan with the last one to see which service appeared or which flaw came back;
looking for copies of employee passwords and logins in external leak sources, which a scan of your servers cannot see (what to do about leaked credentials);
watching for domains other people registered to look like yours (lookalike domains and typosquatting);
merging results from several tools, which repeat the same issue, and removing the ones that do not apply;
deciding the order of fixes.

Deciding what to fix first means combining several signals. A CVSS Base score rates a flaw's intrinsic severity from 0 to 10. In CVSS 4.0, the Threat metrics describe how mature exploitation is. CISA, the US cybersecurity agency, lists vulnerabilities known to have been exploited in real attacks in its KEV catalog. Then you add what only your company knows: which system matters. We explain it in how to prioritize by exploitability.

The work behind a self-hosted scanner

If your team runs it, these tasks are yours:

keeping the list of domains, IP addresses and services, and adding new ones;
installing and updating the tool; Greenbone can run in containers or be built from source;
tuning the speed so your own services are not overloaded; Nuclei's default rate limit is 150 requests a second and you can change it; pick a rate that fits each target and what you are authorized to test;
scheduling scans and checking that they ran;
reading the results and removing false alarms (false positives);
re-checking after each fix and keeping the history for audits and customers.

How long this takes depends on how many systems you have and on your team's experience. Estimate it for your own systems before you compare it with a platform.

When a free tool is enough

It usually works well if your company has a few domains that rarely change, nobody outside creates services in your name, and someone on the team has time to maintain it and review the results. What your customers ask for matters too: if they want a review history and reports, someone will have to produce them.

When to add external monitoring

A platform is worth evaluating when those tasks no longer fit in your team's week, for example with:

many domains, hosting providers and cloud services;
frequent change: launches, campaigns, migrations, acquisitions;
a small security team, or one shared with IT;
management, customers or auditors who ask to see what was checked and what was fixed.

You can keep your scanner for specific tests and add a platform that regularly checks what can be seen from the internet. Neither replaces a penetration test, a scoped assessment by specialists that may include attempts to exploit flaws. On how often to check, see annual pentest or continuous monitoring.

What SeguriScan does

SeguriScan starts from a domain or authorized address ranges and goes as far as checking that fixes worked:

it looks for servers and websites nobody listed, and you confirm which are yours before they are scanned;
it matches known vulnerabilities to your software versions and tags the ones CISA lists as attacked; a version match stays a candidate until an active check confirms it;
it puts the results of several checks in one list, merges duplicates and drops typical false alarms;
it ranks findings by severity, likelihood of attack and confidence that they apply; the priority does not include how important the system is to your business, which your team adds;
it marks what changed since the last check and, when the next check no longer finds a fixed issue, moves it to Resolved;
it lists registered domains that imitate yours and, in a separate masked view for people given access, work accounts that turn up in leaks.

It installs nothing on your servers and does not check your internal network, only what can be reached from the internet. See how it works, step by step.

Frequently asked questions

Do we have to drop our scanner?

No. You can keep it and use SeguriScan to see which systems are exposed to the internet and which issues need attention first.

Does a free scanner find fewer vulnerabilities?

Not necessarily. What it finds depends on its checks, its settings and which systems it is pointed at.

Can we start free and switch later?

Yes. Keep the list of systems and the results from day one. With them you can compare and follow up on fixes when you switch.

If you want to compare with what your tool sees, request a free SeguriScan pilot with the form below. First we agree with you on the scope and the systems to assess, and confirm you may authorize the check. No active testing begins without your approval. Then you get access to the platform with the discovered assets, findings, data leak results and reports. We'll email you to agree on the next steps. No obligation to proceed.

Sources

ProjectDiscovery: Nuclei on GitHub, accessed 2 November 2026: MIT licence, community templates, default limit of 150 requests per second. Automation and discovery tools: documentation at docs.projectdiscovery.io.
Greenbone: Background, Greenbone Community Edition, accessed 2 November 2026: origin in OpenVAS, open source, management service with stored results and schedules, free Community Feed without the checks for enterprise products and without a promise of completeness. Container and source installation: guides in the same documentation.
CISA Known Exploited Vulnerabilities (KEV) catalog. CVSS: FIRST specification, version 4.0.

Free Vulnerability Scanner or Perimeter Monitoring?