Vulnerability scanners: OpenVAS and Nessus (concepts)

What a vulnerability scanner does

Doing enumeration and CVE look-ups by hand for every service would take forever. A vulnerability scanner automates it: it probes the target, matches what it finds against a large, regularly updated database of known issues, and produces a report with severities. It is a force multiplier, not a replacement for thinking.

The big caveat: false positives and false negatives

A false positive is when the scanner reports a problem that is not really there. A false negative is when it misses a real one. Both happen. A scanner might flag a version as vulnerable when the fix was backported, or miss a logic flaw it was never taught to see. So every scanner finding must be verified by a human before it goes in a report. Handing a client a raw scanner dump is poor work.

Where scanners fit in a test

Scanners are great for breadth: quickly covering many hosts and catching the obvious, known issues. They are weak at depth: business-logic flaws, access-control mistakes and chained attacks usually need a human. A good test uses a scanner to clear the easy ground, then spends human effort where the tool cannot go.

Detection and defence

Detection: scanner traffic is loud and distinctive, and defenders often see it immediately. Defence: the real defence is the same patching and configuration the scanner is checking for — run your own authorised scans regularly, fix what they find, and keep systems updated so an attacker's scan returns little. Internal, authorised vulnerability scanning is a standard part of good security hygiene.