OpenVAS Vulnerability Scanner for IT Teams and MSPs: What the Free Edition Covers, How to Run It and How It Compares

Updated: November 2026. Releases, licenses, feed coverage and setup steps checked against Greenbone's docs, GitHub repos, product pages and community forum, and Tenable's Nessus Essentials page, on 11 November 2026.

You need to know what's unpatched on your network, and a commercial scanner license is a hard sell on a small budget. The free name every thread suggests has changed its branding, setup and free feed since 2025, so older guides can point you the wrong way. Here's what the OpenVAS vulnerability scanner is in 2026, what Greenbone's free feed still covers, how to run it and how it compares with Nessus.

TL;DR

• What it is. OpenVAS is Greenbone's network vulnerability scanner, free as the Community Edition.
• The 2026 feed change. Greenbone confirmed that new free-feed tests now center on Notus and select Linux distributions.
• Running it. Greenbone's Docker Compose setup is the current route, though its guide says it isn't for production.
• Vs Nessus. Nessus Essentials caps at 5 IPs for non-commercial use; OpenVAS states no cap, and the upkeep is yours.
• Who it fits. Linux-heavy internal scans fit, while Windows patch checks, network gear and client work need more than the free edition.

What Is the OpenVAS Vulnerability Scanner?

The OpenVAS vulnerability scanner is Greenbone's network scanner. It runs tests against the hosts you point it at, with or without login credentials, and reports the known vulnerabilities it finds. The tests come from a feed that updates daily, and the project dates back to 2006.

In plain terms, it's the free branch of the Nessus family tree. In 2005, the Nessus developers moved Nessus to a proprietary model. Forks appeared in 2006, and OpenVAS, short for Open Vulnerability Assessment System, is the one that stayed active.

Greenbone was founded in Osnabrueck, Germany, in 2008 to drive OpenVAS forward. Its founders had already worked on Nessus tools with support from Germany's federal security agency, the BSI. The company became Greenbone AG in 2023. Its docs say the free software is developed as part of the commercial Enterprise line.

A scan lists known weaknesses. It doesn't try to break in and chain them together, which is the job our network penetration testing guide covers.

OpenVAS vs GVM vs Greenbone Community Edition

Greenbone's own docs list five meanings for the name: the scanner, the framework, the Greenbone-led project, a source release and the community. Here's the map.

Since 30 July 2025, OPENVAS in capitals is Greenbone's product brand, and Greenbone AG stays the company name. So if a guide calls Greenbone the new name for OpenVAS, it has the direction backwards.

How OpenVAS Works

Greenbone's docs split the stack into three parts: scanners that run the vulnerability tests, a manager daemon called gvmd, and a web interface called the Greenbone Security Assistant (GSA).

The scanner is openvas-scanner plus ospd-openvas, a wrapper that takes orders from gvmd over a protocol called OSP. It runs the feed's NASL tests, scripts in Greenbone's own test language, and keeps test data and results in Redis.

Notus runs during every regular scan. Instead of one NASL script per vulnerability, it compares a host's installed software against a list of known vulnerable versions. In the current containers, a Rust service called openvasd provides it, and openvasd is meant to replace the whole scanner stack one day.

gvmd is the brain. It controls the scanner, stores settings and results in PostgreSQL, handles users, groups and roles, and runs scheduled scans. Everything else talks to it over the XML-based Greenbone Management Protocol (GMP).

GSA is the web app you click through. In the 2026 containers, nginx serves it over HTTPS with a self-signed certificate, and gsad runs as the API behind it. For scripts, gvm-tools gives you command line and Python access over GMP and OSP.

The feed also ships SCAP data and CERT-Bund and DFN-CERT advisories as separate data containers. For how CVE records and their scores get made upstream, see our NVD explainer.

Community Feed vs Enterprise Feed

Both editions run the same scanner. The feed decides what it can find. Greenbone's feed comparison page, read on 11 November 2026, splits them like this.

The split isn't new. In 2017, Greenbone renamed the public feed the Greenbone Community Feed and moved it from a 14-day delay to daily updates, minus tests for enterprise products. The comparison page's FAQ pitches the free feed as a starter level of coverage.

The 2026 Community Feed Cutback

On 21 July 2026, a user running a source-built Community Edition asked on Greenbone's forum why new tests had dried up. By that user's own count, the feed added 121 new NASL tests in December 2025 and 39 in January 2026. Each month they listed after that added 1 to 3. They also found that new tests for Microsoft's security bulletins and for Microsoft Edge stopped after January.

A Greenbone Team member answered on 28 July. The change is "intentional but not necessarily permanent", meant to raise awareness of Greenbone's Enterprise offerings. Community coverage now goes mainly to Notus and select Linux distributions.

Existing Windows tests stay in the feed, and the comparison page still lists Microsoft Office under Community coverage. What stopped, by that user's count, is new tests for Microsoft's monthly bulletins. The user also pointed out that Feed Status shows green and the sync still runs daily, so nothing in the web UI flags the change. If that count holds, a free-feed scan may not flag a missing Windows patch from after January.

Missing enterprise coverage shapes buying decisions too. In March 2026, an r/sysadmin poster ruled out a hosted OpenVAS service because it came without the enterprise feed. Replies split between paying for Nessus, running OpenVAS yourself and accepting the upkeep, and free tools like Wazuh.

OpenVAS License and Trademarks

OpenVAS doesn't sit under one license. Each component carries its own, per its GitHub repo on 11 November 2026.

For an internal team scanning its own network, none of this costs anything. Two points matter once clients are involved. Greenbone and OPENVAS are Greenbone AG trademarks, and the code licenses grant no trademark rights, which matters if either name goes on a service you sell. And gvmd and GSA are AGPL, so read those terms with counsel before you build a client service on a modified copy. This is context, not legal advice.

How to Run OpenVAS in 2026

There are four routes. The big difference is who keeps each one working.

Paid support covers the Enterprise line only, per Greenbone's FAQ, and developers answer the free forum on a voluntary basis. The FAQ also warns that distribution packages, Kali's included, can lag behind or break.

These container steps come from Greenbone's Community Containers guide as of 11 November 2026. Test them on a spare VM first, and re-check the guide, because the compose file changes.

1. Install Docker, then add your user to the docker group with sudo usermod -aG docker $USER && su $USER.
2. Create a folder with export DOWNLOAD_DIR=$HOME/greenbone-community-edition && mkdir -p $DOWNLOAD_DIR, then download the compose file with curl -f -O -L https://greenbone.github.io/docs/latest/_static/compose.yaml --output-dir "$DOWNLOAD_DIR".
3. Pull and start the containers with docker compose -f $DOWNLOAD_DIR/compose.yaml pull, then docker compose -f $DOWNLOAD_DIR/compose.yaml up -d.
4. Replace the default password with docker compose -f $DOWNLOAD_DIR/compose.yaml exec -u gvmd gvmd gvmd --user=admin --new-password='<password>'.
5. Once the feed has loaded, open

in a browser.

Hardware and First Setup

Greenbone's minimum for the containers is 2 CPU cores, 4 GB of RAM and 20 GB of storage. It recommends 4 cores, 8 GB and 60 GB. Supported hosts are Debian stable, Ubuntu 24.04 LTS, Fedora 35 and 36, and CentOS 9 Stream.

Three defaults need attention on day one. The containers create a user admin with the password admin, which the guide calls insecure, so run step 4 before anything else. nginx publishes the web UI on 127.0.0.1 only. Keep it local, or open it to an internal network with the compose change on Greenbone's Workflows page, never to the internet. And ospd-openvas runs with NET_ADMIN and NET_RAW and with seccomp and AppArmor unconfined, so give it a dedicated VM.

Then wait. A feed sync downloads the data and loads it into the daemons, and each part can take minutes up to hours on the first run. Scans started before then give incomplete and wrong results, so check Feed Status under Administration first.

Your First Scan

Only scan systems you own or have written permission to test. Start small, such as one server subnet, and know what's exposed before you scan it. Our attack surface guide covers that mapping.

In GSA, go to Scans, then Tasks, then New Task. Create a target with the IP addresses or hostnames the scanner can reach, and add credentials for an authenticated scan. Greenbone's manual says checks of installed software and patch levels only run once the scanner can log in. Start with the Full and fast scan config and the All IANA assigned TCP port list, both created once the feed loads.

Greenbone's own walkthrough from June 2023 covers logging in, running the scan wizard against a local IP and formatting a basic report. The scan steps still match, but the Docker install it points to predates the 2026 compose changes.

Updates and Feed Sync

Upstream moves fast: openvas-scanner shipped four releases, v23.52.8 to v23.52.11, between 29 October and 10 November 2026. Put updates on a schedule.

For the containers, download the latest compose.yaml first, then rerun the pull and up -d commands. Since February 2026, a pg-gvm-migrator container handles PostgreSQL major version upgrades. Feed sync works the same way: pull the feed data containers, start them and let the daemons load the data.

On a source build, never mix component versions from different releases. Greenbone's FAQ says to use the latest releases or the same release branch throughout. On Kali, the gvm-feed-update script comes from Kali's and Debian's packagers, not Greenbone.

OpenVAS vs Nessus and Other Scanners

Nessus is the scanner OpenVAS forked from, and Tenable's free tier is the usual comparison. Prices and terms below were read on 11 November 2026.

The free tiers aim at different jobs. Tenable says Nessus Essentials isn't engineered for enterprise or production environments, and older guides quoting a higher IP limit are out of date. OpenVAS states no IP cap, but its free feed trails on new Windows checks and the upkeep is yours. The paid step up is OPENVAS BASIC or Nessus Professional, which has no IP cap. Our CrowdStrike vs Tenable comparison covers Tenable's wider platform.

In an r/cybersecurity thread from April 2026, the top-voted suggestions are Wazuh and Nuclei, with Grype and Trivy further down. On OpenVAS, one user moved to Tenable after poor results, and another says the free version lacks enterprise device plugins such as Cisco. A third says it gives good results if you put in the setup and upkeep.

One reply in that thread notes that Wazuh covers endpoints but not networks. Our Wazuh review has the detail.

Is OpenVAS Right for IT Teams and MSPs?

Greenbone points businesses to BASIC and SCAN. The free edition still fits work where the job matches the feed.

For pre-sales work, a scan is one piece of the picture. Our network assessment checklist covers what goes around it.

An MSP scanning client networks takes on more. Each client needs written permission and its own targets, users and reports, kept apart with separate instances or gvmd roles. Someone also has to patch every instance. If you buy the Enterprise Feed, Greenbone's license requires a subscription for each instance that uses it and bars passing the feed to third parties. So price it per instance.

A scan only finds the problem. The fix runs through triage, a ticket and a patch, tracked until someone confirms it. Our vulnerability management roundup shows how paid platforms handle that handoff.

For the patching half, our patch management roundup compares the tools. OpenFrame, built by Flamingo, which publishes OpenMSP, covers part of that patch-and-ticket work.

OpenVAS in Short

OpenVAS is Greenbone's free scanner, and in 2026 its free feed narrowed to new tests mainly for Notus and select Linux distributions. Run it on a dedicated VM with a new admin password and an internal web UI. For Windows patches and network gear, add a paid feed or a second scanner. OpenFrame is open, AI-native infrastructure for IT and security, and it isn't a vulnerability scanner. To see OpenVAS next to Nuclei, Trivy and three other free scanners, read our six-scanner comparison table.