The Top 5 Network Vulnerability Scanning Tools for 2022
Having a good network vulnerability scanner and properly implementing it is foundational to having a high performing and successful vulnerability management program. These are the top five network vulnerability scanning solutions for 2022 that are most widely used, along with some analysis of each product’s strengths and weaknesses based on real world experience.
Tenable
Tenable is the longest-running network scanning tool on this list, with its Nessus scanner having arrived on the market in 1998. Tenable is one of two vendors who claim and deliver six-sigma accuracy, and they are always on any credible top five list of vulnerability scanners with great scanning coverage. They have one of the largest vulnerability signature databases on this list, which helps minimize the problem of false negatives. We talk a lot in vulnerability management about false positives, but false negatives, where a vulnerability exists but the scanner fails to detect it, are also a big problem, plus harder to notice and investigate. Nessus remains the ideal budget option, while its on premise Tenable.SC is its most complete and mature option. Its cloud-based Tenable.io is often seen as less feature-complete than Tenable.SC, but can be deployed very quickly and easily.
Qualys VM
Qualys, the first cloud-based network vulnerability scanner, is nearly as old as Nessus. It has a large vulnerability signature database, plus claims and delivers six-sigma accuracy. Its cloud agent is its greatest strength, with very low CPU utilization without requiring scheduled scans. The agent scans opportunistically, making it a good choice for distributed and remote work environments. If you have a strong work from home contingent, the cloud agent is Qualys’ biggest selling point. Its user interface gets mixed reviews but, with their free training, you will find the scanning tool much easier to use.
Rapid7 InsightVM
Rapid 7 InsightVM is known for its speed and being able to handle frequent scans more quickly than most scanners, especially when configured to scan the most common network ports rather than all 65,535 ports. However, its speed and lighter footprint will sometimes come at the cost of accuracy. You will find a slightly higher false positive rate with InsightVM, so you will have to weigh that trade-off. InsightVM also offers an agent, and it checks in with the cloud periodically without a need to schedule scans, making it a good choice for distributed and work from home environments, such as user’s laptop and desktop devices.
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a relative newcomer to vulnerability management scanning, but it is rapidly gaining adoption. Unlike the big three traditional vulnerability scanners, it is entirely agent based. This also makes it a good choice for remote work and work from home environments. A unique feature of Defender is that it scans assets on the same network as the agent host by default, which can cause consternation for work from home use cases. One of our favorite Microsoft Defender features is its ability to convey whether a system is still alive on the network or not via its metadata, which is a feature that most scanners lack in doing by default.
CrowdStrike Falcon Spotlight
Crowdstrike Falcon Spotlight is another newcomer, but it is gaining popularity because it can ride the coattails of Crowdstrike’s popular EDR product. They provide an agent-only offering and it only scans the host it’s running on, so if you like the idea of using something other than one of the big three network scanners and you don’t want it to scan the surrounding network, this is a logical choice. The drawback to the Crowdstrike offering is that it gives minimal detail on what it found, which makes investigating suspected false positives much more difficult. We see a consistent trend of EDR vendors entering the vulnerability management space using their existing agents.
How to Evaluate Vulnerability Scanning Tools
When evaluating vulnerability scanners, it’s tempting to spin up a few hosts in a lab, leave a few patches off, run some scans, see how intuitive the user interface is, and call it good. However, you will miss fine details that way. Ask your IT department for some recently retired desktop and laptop machines. If you have some images of retired servers, think about bringing those back in the lab. Any scanner will do an excellent job of scanning freshly built systems, but you will start to notice the difference between them when you scan old and tired systems. Some of them will find things another one misses. Some will put the system under more duress than others.
Also, this is the perfect time to evaluate both network and agent scanning. Agent scanning has a reputation for being harder on a system than network scanning. However, when you evaluate on old and tired systems, you will find that agent scanning is frequently easier on a system than network scanning.
Here are five things you will want to evaluate in the lab before you make your final decision:
- Check CPU and network utilization during a scan, as some will use more than others
- Examine the scan results, especially the section stating what the scanner looked for, what it was expecting, and what it found. This is invaluable information for a remediator
- Compare the number of vulnerabilities each scanner finds. Note any significant differences between the network and the agent scan, and whether any of the scanners are missing anything the other scanners find
- Try installing an update that requires a reboot, but don’t reboot. Rescan with each scanner and note the differences
- It will probably be difficult to extrapolate scan times in production from your lab results, but note any significant differences in how long it takes for scans to complete
You will probably notice significant differences between the various scanners. Someone else using the same methodology on their own systems may come to a different conclusion. While there is general agreement about which scanners work well, there is not agreement on which one is always best. If the solution you are considering offers training, we highly recommend you take the training and get the certification so you can learn how to best operate the scanning tool. It may take a week to finish the training, but you will save more than a week’s worth of troubleshooting trying to figure out how the tool works.
Taking a Risk-Based Vulnerability Management Approach
Having a good network scanner is the start to a strong vulnerability management program. In order to deliver vulnerability management in today’s fast-paced environments, it takes more than just a single scanner. By taking a risk-based approach to vulnerability management, organizations can aggregate, prioritize, and remediate high-risk vulnerabilities.
Nucleus aggregates your asset and vulnerability data into a single unified vulnerability and asset inventory across network scanners, SAST, DAST, SCA, Asset Management tools, Cloud scanners and more. Watch a demo of Nucleus to learn more.