Business Operations·Standings
Vulnerability Scanner Software
Vulnerability scanner software looks for security weaknesses in websites, networks, applications, or code; the right choice depends on what you need to scan and how you plan to run it.
Compare scan targets, authenticated and continuous scanning, deployment options, asset limits, report exports, and price. The board also shows a signal score out of 10 and marks for a public API, open-source code, and a free tier.
- 29 platforms
- 2 with a public API on this page
- 11 with a free tier
- Checked 28 Sept 2026
- 1 OZOWASP ZAPzaproxy.org
A free open-source tool that scans web applications with active and passive checks.
- 2 GGrypegithub.com
Free open-source software that checks images, filesystems, and SBOMs for known flaws.
- 3 MV
ManageEngine Vulnerability Manager Plusmanageengine.comVulnerability Manager Plus combines endpoint discovery, vulnerability assessment, prioritization, compliance auditing and remediation in one console.
- 4 I
Intruderintruder.ioA continuous scanner for infrastructure, web apps, and APIs with issue prioritization and remediation guidance.
- 5 T
Trivytrivy.devA free, Apache-2.0 licensed scanner for code, binaries, container images, and Kubernetes clusters.
- 6 N
Nucleinuclei.projectdiscovery.ioA free, open-source scanner for applications, infrastructure, cloud platforms, and networks.
- 7 O
OpenVASopenvas.orgA vulnerability scanner for IT systems with authenticated and unauthenticated testing.
- 8 BS
Burp Suite DASTportswigger.netBurp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
- 9 A
Acunetixacunetix.comA web and API scanner that identifies vulnerabilities in running applications.
- 10 DS
Detectify Surface Monitoringdetectify.comA monitoring service that maps internet-facing assets and flags exposed files and flaws.
- 11 KC
Kiuwan Code Securitykiuwan.comA source-code scanner with local and CI/CD scans, customizable rules, and build quality gates.
- 12 SHStackHawk HawkScanstackhawk.com
A security tool that checks web software and APIs, then logs results in StackHawk Platform.
- 13 AS
Astra Securitygetastra.comA web and API scanner with authenticated testing, including MFA and SSO.
- 14 I
Invictiinvicti.comAn application security platform that tests code, APIs, dependencies, infrastructure, and containers.
- 15 MI
Mend.iomend.ioMend.io describes its platform as securing application code, AI components, and the attack surface between them.
- 16 HAHCL AppScan Sourcehcl-software.com
A source-code scanner delivered through desktop software, IDE plugins, or automation.
- 17 SCSnyk Containersnyk.io
- 18 GCGreenbone Community Editiongreenbone.github.io
- 19 RI
Rapid7 InsightVMrapid7.comA vulnerability scanner for authenticated systems, agents, and web applications, available on Linux, macOS, and Windows.
- 20 CClairquay.github.io
- 21 TNTenable Nessustenable.com
A self-hosted tool that checks Linux, macOS, and Windows systems for security issues.
- 22 RI
Rapid7 InsightAppSecrapid7.com - 23 QVQualys Vulnerability Managementqualys.com
- 24 TS
Tenable Security Centertenable.comAn on-premises scanner with authenticated scans and agent-based assessment.
- 25 OFOpenText Fortify Software Security Platformopentext.com
A hybrid application security platform with infrastructure-as-code and container scanning.
Places #1, #2, #3, #4, #5 on this board are open to sponsors. Take #1 · Other ways to advertise
How to choose
What do you need the scanner to check?
Choose a tool that lists the scan targets you care about. Compare the available targets before deciding, since a scanner for one kind of asset may not fit another.
Do you need authenticated or continuous scans?
Check the listing for authenticated scans if the scanner needs to inspect areas that require a login. Look for continuous scanning if you want scans to run on an ongoing basis.
Where do you need the scanner to run?
Compare deployment options with your existing setup. The board lists deployment and platform information, including web, Linux, Windows, macOS, and self-hosted options.
What asset limits and report exports do you need?
Check the asset limit against the systems you plan to scan, and confirm that report exports suit the way you share findings. These details can affect whether a plan fits your work.
How can you compare price and access?
Review the free-plan and paid-from details, and check whether a free trial is offered. Pricing on request means you will need to contact the provider for a quote.
If connecting the scanner to another app matters, check for a public API mark. If you need to read or change the software itself, check its open-source status and licence.
Questions
What does vulnerability scanner software do?
It checks websites, networks, applications, code, or other scan targets for security weaknesses. Available targets vary by tool.
How do I choose a vulnerability scanner?
Start with the assets you need to scan, then compare authenticated and continuous scanning, deployment, asset limits, report exports, and price.
What is an authenticated vulnerability scan?
It is a scan that uses login access to inspect areas that require authentication. Check a tool’s listing to see whether it supports authenticated scans.
What does continuous scanning mean?
It means scans can run on an ongoing basis rather than just as a one-time check. Compare the continuous-scanning field for details.
How can I tell if a vulnerability scanner has a free plan?
Check the free-plan mark and the pricing details. A free trial is not the same as a free plan.
What does the scanner signal score mean?
It is a score out of 10 based on published signals: use, public API, documentation depth, open-source code, and a free tier to try.
Some top positions on this board can be paid placements, standing where they were sold. The facts on each platform are not for sale. How we rank · Disclosure