TrustRadius: an HG Insights company
Back to Overview

Tenable Nessus Reviews and Ratings

Rating: 8.7 out of 10
Score
8.7 out of 10

Community insights

TrustRadius Insights for Tenable Nessus are summaries of user sentiment data from TrustRadius reviews and, when necessary, third party data sources.

Pros

Accurate Vulnerability Scans: Many users have praised Nessus for its ability to perform accurate vulnerability scans and provide precise findings. They have found it to be reliable in identifying vulnerabilities and delivering accurate assessments.

Multiple Profiles/Policies: Several reviewers appreciate that Nessus offers multiple profiles/policies for different types of scans, such as PCI-DSS, malware, web application, and bad shell shock detection scans. This flexibility allows users to tailor their scanning approach based on specific needs and compliance requirements.

Risk-based Classification: Users value the fact that Nessus classifies vulnerabilities into risk-based categories, ranging from critical to informational. This feature helps prioritize remediation efforts by focusing on the most severe vulnerabilities first. It sets Nessus apart from other vulnerability scanners that may not offer this level of categorization.

Reviews

10 Reviews

Tenable Nessus Review

Rating: 8 out of 10
Incentivized

Use Cases and Deployment Scope

We use Tenable Nessus to scan for vulnerabilities and insecure misconfigurations to improve our security posture. Nessus identifies missing patches and firmware updates and provides basic information on the CVEs to help with remediation. I sleep better at night knowing we are proactively preventing breaches and unauthorized access. It is also valuable tool to achieve compliance and provides evidence for our auditors.

Pros

  • Identifies vulnerabilities and misconfigurations across many platforms.
  • Helps us achieve compliance with our auditors
  • Helps us prioritize remediation based on severity of the CVE/misconfiguration

Cons

  • There are some legacy systems that we are unfortunately not able to patch. There is no way to flag these so they are not in all our reports. We still need to track these but they don't need to be included in the weekly scan every time.
  • The Service Now integration is very complex.
  • We get quite a few false positives, especially when scanning network infrastructure such as siwtches and firewalls.

Likelihood to Recommend

Tenable Nessus is good for any organization that is concerned with tier on-prem IT security, especially those with any kind of regulatory compliance requirements. It does have a learning curve and takes quite a bit of time to set up and monitor, so having a dedicated security staff would be necessary to get its full value. I don't think I would recommend it for organizations that are cloud-native or don't have much in the way of on-prem infrastructure.

VU
Verified User
Engineer in Information Technology (1001-5000 employees)
Vetted Review
Tenable Nessus
2 years of experience

Great Product.

Rating: 10 out of 10

Use Cases and Deployment Scope

We use Tenable for vulnerability management for our network and virtual machines. This helps us find configuration issues and software vulnerabilities in the software and hardware that we use. It enables us to run a virtual machine, perform scans to identify out-of-date configurations, and provides steps to resolve issues in our environment.

Pros

  • Shows you how to fix certain vulnerabilities and the commands to run.
  • Gives you the CVEs that the vulnerabilities are matched to.
  • Easy to understand the vulnerabilities list, giving reasons why the issues need to be patched or fixed.

Cons

  • No places of improvement I can find.

Likelihood to Recommend

It is helpful to run scans on your network equipment and have it scan for configuration vulnerabilities. Additionally, it is helpful in running compliance scans, such as NIST scans or SCF scans. This makes configuring your equipment to baselines very useful, ensuring all potential holes are covered.

PJ
Phil Jackson
System Admin in Information Technology at a.i. solutions (201-500 employees)
Vetted Review
Tenable Nessus
5 years of experience
View profile

Reliable and cost effective vulnerability managements with Nessus.

Rating: 9 out of 10

Use Cases and Deployment Scope

We utilize Nessus as a primary vulnerability assessment tool to identify security weaknesses across organizations. It enables us to perform scheduled scans to comply with requirements and also helps us assess our organization's security posture. We use Nessus to scan our External and internal networks, servers, endpoints, web applications, and configurations to identify risk and compliance gaps.

Pros

  • Highly customizable Scanning.
  • Clear reporting and risk prioritization.
  • Integration capabilities.

Cons

  • Manual remediation tracking.
  • Scan preforming on large network.
  • False positive and context gaps.
  • User management and role based access.

Likelihood to Recommend

It is an excellent tool for scanning servers, workstations, and network devices to identify missing patches and misconfiguration; we regularly use it to confirm patch effectiveness after the update; it also helps us for preparing audits such as iso 27001, and regulatory requirements, it also helps us to identify open ports and services that violate security.

AG
Akhilesh Ghosh
VAPT-Teamlead in Information Technology at Digitaltrack Solutions (501-1000 employees)
Vetted Review
Reseller
Tenable Nessus
6 years of experience

Why Nessus is such a great tool

Rating: 9 out of 10

Use Cases and Deployment Scope

We are an MSSP and use Nessus to conduct vulnerability assessments to our smaller clients who cannot afford the larger products

Pros

  • Vulnerability assessment tool

Cons

  • I love the product only downside is that the reporting can be upgraded to make custom reporting easier

Likelihood to Recommend

Nessus is perfect for smaller companies and consultants. As the its a annual license to scan unlimited amount of IP's

Sv
Stephan van der Merwe
Cyber Security Analyst in Information Technology at SSMT IT Security (1-10 employees)
Vetted Review
Reseller
Tenable Nessus
10 years of experience
View profile

Nessus - Always stay compliant

Rating: 8 out of 10
Incentivized

Use Cases and Deployment Scope

Nessus vulnerability tool is being used by IT Admin team to scan for vulnerabilities in the workstations and servers, routers, and switches which are planted all over the network both in LAN as well as WAN. Nessus helps to secure the network by running scans on outdated patch versions as well as it helps to implement best practices.

Pros

  • Vulnerability scanning
  • Implement Best Practices

Cons

  • Slowness when scanning large datasets and applications
  • Consumes more resources when scans deep

Likelihood to Recommend

As an organization which is PCIDSS complied, keeping all IT infrastructure up to date is mandatory. Before Nessus was implemented, it was really hard to monitor the updates continuously. Automated Nessus scans run vulnerability assessments and sends emails with all the vulnerabilities. The reports are also highly customizable and can be exported to PDFs, HTMLs, XMLs etc.

VU
Verified User
Team Lead in Information Technology (1001-5000 employees)
Vetted Review
Tenable Nessus
3 years of experience

Nessus

Rating: 9 out of 10
Incentivized

Use Cases and Deployment Scope

We use Nessus within our information security department to scan our network for vulnerabilities. Afterwards we ensure to patch the necessary vulnerabilities. We also use Nessus for PCI scanning as required for PCI compliance.

Pros

  • Vulnerability scanning.
  • PCI scanning.

Cons

  • Could use an upgrade within reports.
  • Scans can take a long time to complete. Have to break them down in small sections.

Likelihood to Recommend

Nessus is great, if not the best, at vulnerability scanning. We use it for PCI scanning as well to ensure we are PCI compliant.

VU
Verified User
Engineer in Information Technology (1001-5000 employees)
Vetted Review
Tenable Nessus
2 years of experience

Nessus in for auditing infrastructure

Rating: 9 out of 10
Incentivized

Use Cases and Deployment Scope

Nessus is one of the best vulnerabilities assessment tools. We use it to evaluate, as one of our primary controls, to know how secure or insecure is our infrastructure (networks, servers, switches configurations) are and also identifying the different vulnerabilities in web applications we use. So with the help of the results (reports), we can explain to the managers and the technologies administrators the risks that exist in their software and hardware. For the company is very useful for the audit areas and security area. Those areas work together in the assessment and evaluation. We trust in the info and results gave by Nessus.

Pros

  • Vulnerabilities assessment.
  • Configuration file evaluation.
  • Reporting.

Cons

  • Interaction with some other tools like Metasploit.

Likelihood to Recommend

When you want to know about how strong the hardening of your software is. Also, when installing a router, switch or another network device, Nessus helps you by indicating if the configuration has some vulnerabilities or maybe if it requires some other options to make a strong configuration and avoid attacks.

OI
Omar Israel Sánchez Monroy
Auditor de Seguridad de la Información in Information Technology at Peñoles (5001-10,000 employees)
Vetted Review
Tenable Nessus
8 years of experience
View profile

Without a doubt, one of the best vulnerability scanners on the market

Rating: 8 out of 10
Incentivized

Use Cases and Deployment Scope

I have used Nessus for performing the vulnerability scans largely. It is largely used for doing vulnerability assessments and penetration testing activities. No matter if you are a security researcher or a security consultant working for some organization, Nessus is known to everyone and is a really helpful tool.

Pros

  • Nessus is best at performing vulnerability scans, in fact, it gives findings and moreover accurate findings of the assessments. It does not do penetration testing or exploit the vulnerabilities because it is concerned about scanning the systems/applications.
  • In fact, Nessus has multiple profiles/policies to perform different types of scans such as, scans oriented for PCI-DSS, malware scans, web application scans, bad shell shock detection scan to name a few.
  • Nessus has the ability to classify the vulnerabilities into risk-based categories from critical to even informational which I think is one of the things that separates Nessus from other vulnerability scanners.

Cons

  • Starting with the cost of Nessus, though it is available for free also it has some restrictions for the free version. Nessus essential which is a free version does not allow to perform internal/external PCI scan policies, config audits which I think is a drawback. As many security researchers, small organizations use this tool for vulnerability scans I think some additional features should be added into free version as Nessus professional version is not cost-friendly for everyone.
  • I think Nessus can improve the way it shows scan status while the scan is ongoing. Once scans are started and running, it sometimes failed to show exactly how much percent of scan is completed, for example, it shows scan status from 0% completed to 100% completed directly without showing the in-between completion percentage.

Likelihood to Recommend

Nessus is perfectly suitable for performing comprehensive vulnerability assessment scans being a vulnerability scanner. It is less appropriate for performing penetration testing since it is not a penetration testing tool, it does not have the ability and modules to exploit the vulnerabilities of the system.

TG
Tejas Gandhi
Associate Security Consultant in Information Technology at SISA Information Security (201-500 employees)
Vetted Review
Tenable Nessus
1 year of experience
View profile

A great, easy-to-use security application!

Rating: 10 out of 10
Incentivized

Use Cases and Deployment Scope

I use Nessus to conduct periodic vulnerability scans of our primary production servers and plan to implement scheduled scans of all nodes in batches at some point in the future.

Pros

  • Identifying known vulnerabilities.
  • Scoring discovered vulnerabilities appropriately.
  • Presenting vulnerabilities and remediation recommendations on an easy to read format.

Cons

  • While it is easy to use, it assumes a certain level of knowledge from the user, therefore, it could explain things a little better as the user moved through the program.

Likelihood to Recommend

Nessus is quick and easy to implement as long as the user has some general knowledge of information security and vulnerability scoring.

VU
Verified User
Technician in Information Technology (201-500 employees)
Vetted Review
Tenable Nessus
2 years of experience

Secure information of organization, easy recognition of vulnerability and its assessment.

Rating: 9 out of 10
Incentivized

Use Cases and Deployment Scope

Our company personnel are mostly depending on Nessus for performing vulnerability assessment on servers and Network Devices of clients, most of our clients are banking networks, government bodies looking for securing their networks and compliance in accordance with information security standards. Nessus is very advanced tool for mainly highlighting server's configuration level, software level issues and missing security patches and for network devices it lists any configuration issues, outdated practice or patches required for improvement of information security.

Pros

  • With Nessus we can find the missing critical patches for a server or workstations.
  • Nessus points out any vulnerable or outdated software Technologies used in the system, thus eliminating any chances for security flaws being turned up.
  • Nessus typically points any configuration level issues in accordance with the OWASP guidelines. Even the configuration of SSL related which are most of the time handled by some vendors or 3rd parties.
  • Nessus not only lists out these Vulnerabilities but describes clearly the vulnerabilities in details with its thousands of plugins updated regularly, the tool also recommends solution with practical details of easy implementation.

Cons

  • The tool has lots of options for setting up before scanning any device, this methodology could be simplified further with default configuration for various devices predefined, anyhow we can use this technique by making use of policies.
  • For advanced users we cannot disable the plugins inside the plugin groups, we can enable the whole set of plugins at a time, for few hundreds its ok, but thousands of plugins are of waste of resource and time.

Likelihood to Recommend

Nessus is quite suitable foe any network devices like switches, routers, firewalls or proxy, for different servers also the tool is very operable, it has plugins for almost every operating system and managed devices, only thing is before using on to the intended device the tool should be updated which takes much time to compile plugins.

SZ
Sohail Zende
Network Security Consultant in Information Technology at Digitalage Strategies Pvt LTD (51-200 employees)
Vetted Review
Tenable Nessus
2 years of experience