Nessus / Qualys
The vulnerability scanning platforms Cybersecurity Analysts use to systematically identify unpatched software, misconfigured systems, and exploitable weaknesses across the entire network — turning the abstract question "are we exposed?" into a prioritised list of specific risks with evidence.
What it is
About Nessus / Qualys
Nessus (by Tenable) and Qualys VMDR (Vulnerability Management, Detection and Response) are the two most widely used vulnerability scanning platforms, and they serve as the foundation of most organisations' vulnerability management programmes. Both work by actively probing network-connected assets — running thousands of plugin checks against each target to detect missing patches, outdated software versions, insecure configurations, default credentials, weak cryptographic settings, and known CVEs (Common Vulnerabilities and Exposures) — and reporting findings with severity ratings (Critical, High, Medium, Low, Informational) and remediation recommendations. The choice between authenticated and unauthenticated scanning is critical: an unauthenticated scan tests what an external attacker without credentials can find (useful for external attack surface assessment), while an authenticated scan uses provided credentials to log into each system and check installed software versions, patch levels, and local configuration settings, producing a far more complete and accurate picture of the vulnerability exposure. Nessus is the most widely deployed vulnerability scanner in the world, and Nessus Essentials (free for up to 16 IPs) makes it the dominant tool in training environments and small organisations. The Nessus plugin library — updated daily by Tenable's research team — contains over 170,000 individual checks, making it one of the most comprehensive detection libraries available. Qualys VMDR differentiates on the platform architecture: it is fully cloud-based (no scanner appliance to maintain in most deployments), uses a lightweight Cloud Agent installed on each endpoint for continuous monitoring rather than periodic scheduled scans, and integrates vulnerability data with the Qualys asset inventory, patch management module, and risk prioritisation engine in a single platform. Qualys's TruRisk prioritisation algorithm combines CVSS score, exploit availability, active exploitation in the wild, and asset criticality to produce an actionable priority score — moving the practitioner's focus from "fix everything above CVSS 7.0" to "fix the 50 vulnerabilities most likely to be exploited against our specific asset profile". Both platforms produce reports suitable for compliance frameworks: Nessus has built-in policy compliance audits for CIS benchmarks, PCI DSS, SOC 2, and ISO 27001; Qualys has comparable compliance reporting against the same frameworks.
What you can do with it
Capabilities
Run a credentialed Nessus scan against an internal Windows network segment — creating a new scan in Nessus Professional, selecting the "Advanced Scan" template, entering the target IP range (e.g. 192.168.1.0/24), adding Windows domain credentials (username, password, and domain) under the Credentials tab so Nessus can log into each host and perform local checks, scheduling the scan for a maintenance window, and reviewing the results when complete — filtering by Critical and High severity to identify the highest-priority findings
Analyse a Nessus scan result and prioritise remediation — opening a completed scan report, filtering by CVSS score 9.0 and above (Critical), reading the plugin output for each finding to understand what the vulnerability is (e.g. MS17-010 SMBv1 remote code execution — EternalBlue), checking the "Exploitable With" field to see whether a Metasploit module exists (confirming the finding is practically exploitable, not just theoretical), and producing a prioritised remediation ticket list for the patching team organised by severity and asset criticality
Configure a Qualys Cloud Agent deployment for continuous endpoint monitoring — downloading the Qualys Cloud Agent installer for Windows, deploying it via Group Policy to all domain-joined workstations, verifying that agents appear as active in the Qualys Asset Inventory, configuring a continuous monitoring policy that runs assessment profiles on each agent every 24 hours without requiring network scanning, and reviewing the first 24-hour vulnerability report showing findings across all endpoints
Use Nessus compliance auditing to assess a server against the CIS Windows Server 2022 benchmark — creating a new scan using the "Policy Compliance Auditing" template, selecting the "CIS Microsoft Windows Server 2022 Benchmark Level 1" audit file, running the scan against the target server with administrative credentials, reviewing the compliance percentage and the list of failed checks (e.g. password complexity policy not meeting benchmark, audit logging not configured for the required event categories), and documenting the findings for the hardening remediation plan
Build a vulnerability management programme dashboard in Qualys VMDR — configuring the Asset Criticality rating for business-critical servers (rating 5) and standard workstations (rating 3), enabling TruRisk prioritisation so the platform combines CVSS score, exploit maturity (proof of concept versus active exploitation in the wild), and asset criticality into a single priority score, setting a weekly remediation SLA (Critical TruRisk findings patched within 15 days, High within 30 days), and generating the monthly vulnerability management report showing progress against SLA compliance targets
How to learn it
Learning Resources
Tenable University (university.tenable.com — free for registered users) — official Nessus and Tenable.io training covering scan configuration, policy compliance auditing, report generation, and integration with other security tools; leads to Tenable certifications including Tenable Certified Security Associate
Qualys Free Trial and Training (qualys.com/training — free resources) — Qualys provides free self-paced training on VMDR, Cloud Agent deployment, TruRisk prioritisation, and compliance reporting; the 30-day free trial is sufficient to complete the core training modules on real infrastructure
Nessus Essentials home lab — the free Essentials plan (16 IPs) is enough to scan a home lab environment (a few virtual machines running intentionally vulnerable operating systems such as Metasploitable 3 or a Windows Server with missing patches) and build genuine remediation experience; scanning a real system and then patching the findings is more valuable than any course
CVE and CVSS scoring framework (nvd.nist.gov — free) — the National Vulnerability Database is the reference database that Nessus and Qualys pull CVE data from; understanding how CVSS scores are calculated (base score components: attack vector, attack complexity, privileges required, user interaction, scope, confidentiality/integrity/availability impact) is essential context for interpreting scan findings and explaining risk to non-technical stakeholders
Pro Tip
A vulnerability scan result without asset context is a list of numbers, not a risk assessment. Before presenting scan findings to the patching team or leadership, map each Critical and High finding to the specific asset it affects and ask: what does this system do, what data does it process, and what would be the business impact if this vulnerability were exploited? A Critical CVSS 9.8 finding on an internet-exposed customer database is a different conversation from the same finding on an air-gapped development workstation. Prioritisation without asset context leads to patching the wrong things first.
Skills that use this tool
Roles that use this tool
Alternatives