Nessus: Complete Guide to Scanning, Installation, and Vulnerabilities

Nessus: How Tenable's Vulnerability Scanner Works #

Nessus is a vulnerability scanner developed by Tenable. It scans hosts, operating systems, applications, and network devices for vulnerabilities, misconfigurations, and outdated software, using a large and continually growing catalog of plugins (NASL). It supports both non-credentialed (without system access) and credentialed (with direct login to the target) scans.

In a vulnerability assessment, Nessus can be integrated into the phase following initial discovery and enumeration: before manually validating or attempting to exploit anything, it provides a prioritization map of what is potentially vulnerable.

When to use it: Authorized vulnerability assessments, periodic security assessments, HTB labs, OSCP/OSEP preparation, compliance (PCI-DSS, SOC 2, ISO 27001). What this guide covers: What it is and how it works, installation, credentialed vs. non-credentialed scanning, custom policies, tuning to reduce false positives, Nessus Agent, compliance scanning, comparison with Nmap. What it doesn't cover: Tenable Vulnerability Management (cloud platform) and external ASV scanning for PCI—requires an approved vendor, not standalone Nessus.

What is Nessus? #

Nessus identifies vulnerabilities, misconfigurations, and outdated software on systems, servers, and network devices. It uses thousands of plugins to perform local and remote checks and can perform both non-credentialed and credentialed scans. It is one of the most well-known and widely used vulnerability scanners in the cybersecurity industry, but it is not the only tool available for this task.

Nessus vs. Tenable: What's the Difference? #

Tenable is the company that develops Nessus. Nessus is the vulnerability scanner; Tenable also offers broader vulnerability management and exposure management platforms and services.

What is Nessus used for? #

• Vulnerability assessment
• Patch assessment (verifies that security patches are actually installed)
• Configuration assessment (weak or incorrect configurations)
• Compliance assessment (PCI-DSS, SOC 2, ISO 27001, with Professional/Expert edition)
• Post-remediation security validation (rescan)

Nessus isn't primarily an exploitation tool: it identifies potentially vulnerable conditions, which then need to be validated and prioritized—a point we return to later in this guide.

Nessus Essentials: What It Is and What It Includes #

Essentials is free, supports both non-credentialed and credentialed scans, and is sufficient for everything needed in this guide except the compliance section. It does not include compliance scanning templates; those require Professional or Expert.

Where to download Nessus #

The official download is available only from the Tenable website: tenable.com/downloads/nessusBefore downloading, please select the correct operating system and architecture (.deb for Debian/Ubuntu/Kali, .rpm for RHEL/CentOS, .msi for Windows, .dmg (for macOS). Avoid mirrors or packages from third-party sources: since this is software that runs with elevated privileges, the package's provenance matters.

Prerequisites #

Supported systems: Linux (Debian/Ubuntu/RHEL/CentOS), Windows Server/Desktop, macOS. The Nessus server runs on any of these; the client is a browser only (no dedicated app).

Permissions required:

• On the Nessus server: Administrator/root privileges to install and start the service
• On targets: No permissions for non-credentialed scans; privileged account (local or domain) for full credentialed scans
• Network: The Nessus server must reach the targets on the ports to be scanned — if you are behind a firewall or need to reach an internal subnet, you need to pivoting

How to install Nessus #

On Kali Linux / Debian / Ubuntu #

# Scarica il pacchetto per la tua distro dal sito Tenable
wget https://www.tenable.com/downloads/api/v2/pages/nessus/files/Nessus-<version>-debian10_amd64.deb

# Verifica checksum (sempre, non saltare)
sha256sum -c sha256sum_nessus

# Installa
sudo dpkg -i Nessus-<version>-debian10_amd64.deb

# Abilita e avvia il servizio
sudo systemctl enable --now nessusd

How to start Nessus on Kali (if the service doesn't start automatically):

sudo systemctl start nessusd

How to check if Nessus is active:

sudo systemctl status nessusd

On Windows #

Download the installer .msi From the Tenable website, run it as administrator, and follow the graphical wizard. The service starts automatically after installation (Tenable Nessus in Windows Services).

On macOS #

Download the package .dmg From the Tenable website, open and follow the installation wizard. Nessus runs as a system daemon; startup and shutdown are managed from the app or from launchctl.

Access (same on all OS) #

https://127.0.0.1:8834

The certificate is self-signed—accept the browser warning. Sign up for Nessus Essentials (free) or enter a Professional/Expert license.

Downloading and compiling plugins on first launch takes time—on slow connections, it may take longer than expected. Don't interrupt the process.

How does Nessus work? #

In short, Nessus:

1. Identify active hosts on the target network
2. Detect ports and listening services
3. Runs security plugins relevant to those services
4. Correlate the results with known vulnerabilities and configurations, classifying them by severity

With a credentialed scan, point 3 is extended: Nessus can directly access the system and perform local checks (version of installed patches, security configurations), instead of relying only on information exposed by the network.

Nessus Scanning: The Scan Pipeline #

Discovery
   ↓
Port scanning
   ↓
Service detection
   ↓
Plugin checks
   ↓
Credentialed checks (se configurati)
   ↓
Vulnerability detection
   ↓
Risk classification
   ↓
Report

Phase 0 — Understanding the logic before the commands #

Nessus works on three concepts:

1. Scan — the actual execution against a target
2. Policy — the reusable configuration (which plugins, which ports, what intensity)
3. Plugin — the single check (NASL, Nessus Attack Scripting Language) that detects a specific vulnerability

A well-crafted policy is the difference between a useful report and a sea of ​​false positives that nobody reads.

Host Discovery (first and foremost) #

Never run a blind vulnerability scan on an entire range. Find out who's alive first:

1. New Scan → Host Discovery template
2. target: 192.168.1.0/24 (CIDR, range, or comma-separated)
3. Lancia

This avoids wasting time scanning for dead IPs in range. On networks with unreliable host discovery (firewalls that drop ICMP), disable the ping check:

Discovery → Host Discovery → Ping the remote host: Off

Without this, Nessus could mark live hosts as dead just because they don't respond to ICMP.

Your First Scan: Basic Network Scan #

1. New Scan → Basic Network Scan
2. Descriptive name (e.g. “Assessment-ClienteX-2026”)
3. Targets:

# Singolo host
192.168.1.100

# Range
192.168.1.1-254

# CIDR
192.168.1.0/24

# Misto (comma-separated)
192.168.1.0/24, 10.0.0.1-50, host.internal.local

1. Save → Launch

Monitor progress from My Scans. A Basic Network Scan on a medium-sized network with default ports takes minutes to about an hour; a full port scan (1-65535) on the same network takes much longer—plan accordingly.

The Complete Workflow (Not Just “Launch the Scan”) #

Nessus alone is useless unless it's looped. The actual flow is always this:

1. DISCOVERY
   Host Discovery scan → chi è vivo sulla rete

2. SCAN
   Basic/Advanced Scan (credentialed se possibile) → cosa è vulnerabile

3. TRIAGE
   Filtra per severity, distingui vero positivo da falso positivo,
   prioritizza in base a exploitability + criticità dell'asset

4. REMEDIATION
   Il team IT/dev applica patch, cambia configurazioni,
   chiude i finding confermati

5. RESCAN
   Rilancia lo stesso scan (o la stessa policy) sugli stessi target
   → verifica che i finding siano stati davvero chiusi, non solo "segnati come fatto"

The step almost everyone skips is step 5—rescan. Without verifying it, you don't know if the remediation actually worked or if someone simply closed the ticket without applying the patch. In a structured assessment, the final rescan is often explicitly requested by the customer as proof of closure.

Credentialed vs. Non-Credentialed (The Difference That Really Matters) #

This is the single configuration that most impacts report accuracy.

A credentialed scan consistently finds many more vulnerabilities than a non-credentialed one, because it confirms whether a patch is actually installed instead of guessing from the service banner.

SSH credentials setup (Linux target) #

Scan → Credentials → SSH

If you're unclear about the basics of the protocol, see the SSH guide . Three authentication methods:

Password       — username/password, sconsigliato in produzione (credenziali salvate in Nessus)
Public Key     — raccomandato, genera coppia di chiavi dedicata
Kerberos       — per host Linux joinati ad Active Directory

Best practices — dedicated, non-root account:

# Crea account dedicato per lo scanning
sudo useradd -m -s /bin/bash nessus-scan

# Aggiungi la chiave pubblica
sudo mkdir -p /home/nessus-scan/.ssh
echo "ssh-rsa AAAA... nessus-scanner" | sudo tee -a /home/nessus-scan/.ssh/authorized_keys

# Concedi sudo mirato (non full root) per i comandi che Nessus deve eseguire
# Configura /etc/sudoers.d/nessus-scan con NOPASSWD solo sui comandi necessari

Windows Credential Setup (SMB) #

Scan → Credentials → Windows
Tipo: Password, oppure Kerberos per ambienti AD

A local (or domain) administrator account on the target is required for a full audit. To better understand what Nessus queries at this stage, see the SMB guide.

Port Range and Performance #

Discovery → Port Scanning → Port scan range: 1-65535

For targeted scans on specific services:

Discovery → Custom → Port scan range: 80,443,3389,445

Policy Custom (beyond the default templates) #

The built-in templates (Basic Network Scan, Advanced Scan, Web Application Test, Malware Scan, Credentialed Patch Audit) cover most cases, but for targeted assessments a custom policy is required.

Example: Web Application Audit #

Policies → New Policy → Web Application Tests

Enable:
- CGI scanning
- Web form testing
- Credenziali HTTP (se disponibili)

For the manual validation part of web applications found to be vulnerable, Burp Suite remains the reference tool.

Example: Dynamic filter for specific CVE #

New Scan → Advanced Dynamic Scan

Dynamic Plugins tab:
  Left dropdown: CVE
  Middle dropdown: Equals
  Right field: CVE-2021-3156
  → Preview Plugins

Combina filtri (opzionale):
  Filter 2 - Left: Plugin Family
  Filter 2 - Right: Ubuntu Local Security Checks
  → Preview Plugins

Useful when you need to quickly check if a specific CVE (e.g. recently published) is present on your machine, without running a full scan.

False Positive Reduction (Real Tuning) #

False positives are the most common problem for those starting out with Nessus — they waste testing time.

Never disable Safe Checks in production—some destructive testing plugins can cause crashes on vulnerable services. Reserve it for isolated labs.

Interpreting the Results #

After completion, open the scan → Vulnerabilities tab.

Each finding includes: Plugin Name (the specific check performed), Severity (Critical/High/Medium/Low/Info), Description , Solution (concrete remediation steps), References (CVE, CVSS score, external links).

Triage strategy: Don't get overwhelmed by hundreds of Info/Low results. First, filter by Critical and High by disabling grouping (gear icon → Disable Groups) for a detailed view.

Typical findings in a Credentialed Patch Audit: missing OS/application patches (by version and patch number), vulnerable applications (Firefox, curl, etc.), “Local Security Checks” plugin family, configuration issues, privilege escalation risks (learn more about Linux privilege escalation and Windows privilege escalation ).

Real-world example: reading a critical finding #

Plugin Name: MS17-010: Security Update for Microsoft Windows SMB Server
Severity: Critical
CVSS: 9.3
Host: 192.168.1.50

Description:
  Il sistema remoto è affetto da una vulnerabilità di esecuzione
  codice remoto nell'implementazione SMBv1 (EternalBlue).

Solution:
  Applicare la patch MS17-010, oppure disabilitare SMBv1.

References:
  CVE-2017-0144, CVE-2017-0145

How do you read it:

1. Severity Critical + CVSS High → highest priority, don't wait
2. Specific host → you know exactly where to intervene
3. Description → tells you the mechanism (SMBv1, RCE) — if you know the CVE, you already know that it is publicly documented
4. Solution → direct action, in this case patching or disabling the protocol

How do you decide if it's a true positive or a false positive:

• Scan credentialed? If so, and the plugin checked the installed patch version (not just the SMB banner), it's almost certainly a true positive.
• Non-credentialed scan? The plugin may have inferred the vulnerability from the protocol response alone — please verify manually before reporting it as critical (e.g. nmap --script smb-vuln-ms17-010 for cross-confirmation, see the guide at Nmap)
• Is the service actually reachable by the attacker? A Critical finding on a host unreachable from outside the internal network has a different priority than one exposed to the Internet.

A CVE known as EternalBlue (MS17-010) with a credentialed scan that confirms the patch version is a textbook case: true positive, immediate action.

Export and Reporting #

Available report templates: Detailed Vulnerabilities By Host (complete findings by host), Complete List By Host (summary without extensive details), Executive Summary (high-level overview for management), Custom templates.

Export formats: HTML, CSV, Nessus (.nessus), Nessus DB.

CSV is ideal for: import into ticketing systems (Jira, ServiceNow), trend analysis on multiple scans over time, SIEM integration (Splunk, QRadar).

Nessus Agent: What is it for? #

Nessus Agent is a component installed directly on the endpoint that collects security information from the system without relying solely on traditional remote scanning — useful for devices that are not always reachable over the network (e.g., company laptops) or to reduce the network load generated by large-scale remote scans.

Compliance Scanning and PCI-DSS (Professional/Expert) #

Compliance templates are not available in Nessus Essentials — you need Professional or Expert.

One point to keep in mind: the external ASV (Approved Scanning Vendor) scans required for PCI compliance cannot be performed with Nessus standalone—you need a vendor approved according to PCI Security Standards Council requirements (e.g., Tenable Vulnerability Management, the cloud platform, or another certified ASV). Nessus standalone can perform internal readiness scans, but it does not replace the external ASV required quarterly.

Nessus vs. Nmap: What's the Difference? #

Nmap is primarily a discovery and enumeration tool; Nessus is primarily designed for vulnerability assessment. The two tools complement each other, not as alternatives: a typical workflow uses Nmap for initial discovery and Nessus for vulnerability assessment of the services it finds.

Which Nessus scan should I choose? #

Best Operational Practices #

Safe Checks: Always enabled, except in completely isolated labs where you knowingly accept the risk of crashes on fragile services during aggressive testing. Never disable it on any client or production environment.

Full-range scan (1-65535): For in-depth periodic assessments (e.g., quarterly) or when you suspect non-standard services on unusual ports. For routine weekly scanning, a targeted range on common ports is sufficient and much faster.

Schedule periodic scans:

Scans → New Scan → [template] → Schedule tab
Frequency: Daily / Weekly / Monthly

Common pattern: Host Discovery daily or nearly daily (light and fast), Full Vulnerability Scan weekly or monthly (depending on internal patching cycle), targeted post-remediation rescan on demand.

Performance tuning for large networks: On networks with hundreds of hosts, consider batching the scan by subnet instead of one huge scan — it's easier to monitor, and a partial failure won't compromise the entire result.

Real Limits of Nessus #

“Found” doesn't mean “exploitable.” Nessus reports that a vulnerable condition exists (a software version known to have a CVE, a weak configuration)—it doesn't confirm that it's actually exploitable in your specific context. Some plugins perform active verification (i.e., actually attempt to exploit safely), others simply perform version checking. The Plugin Output section of the finding often clarifies which of the two is true.

Banner grabbing can get the version wrong. On non-credentialed scans, some findings come from the service banner (e.g. HTTP header Server: Apache/2.4.41). If the administrator has modified the hardening banner, or if the service has been patched without updating the declared version (security backport), Nessus may report a false positive or, worse, miss a real problem.

Plugins don't always validate the complete exploitation chain. An RCE vulnerability reported as Critical may require preconditions that Nessus doesn't verify (e.g., a service only reachable from a specific subnet, prior authentication). The CVSS score reflects the theoretical severity, not necessarily the practical exploitability in your scenario.

Practical conclusion: Use Nessus for discovery and prioritization, not as a replacement for manual validation. A Critical finding with CVSS 9.8 always deserves human verification before ending up in a report as a "confirmed exploitable vulnerability."

Common Mistakes #

Nessus in a Pentest Workflow #

Nessus is not an isolated tool — it sits at a specific point in the assessment chain:

RECON
  Enumerazione passiva/attiva della superficie (Nmap, subdomain enum, OSINT)
  → Nessus non sostituisce questa fase, la presuppone

ENUMERATION
  Nessus entra qui: scan di vulnerabilità su quello che la recon ha trovato
  Output: lista di CVE/misconfigurazioni potenziali per host

VALIDATION
  Qui Nessus si ferma. La validazione manuale (o con tool exploit-specific)
  conferma quali finding sono davvero sfruttabili nel contesto reale

EXPLOITATION
  Metasploit, exploit custom, manual testing — usando i finding Nessus
  come mappa, non come garanzia

REPORTING
  I finding Nessus (grezzi o validati) confluiscono nel report finale,
  spesso correlati con le prove di exploitation raccolte manualmente

The exact role of Nessus: it greatly speeds up enumeration and provides a prioritization map, but it is neither the starting point (recon is needed first, e.g., with Nmap ) nor the end point (validation with tools like Metasploit and exploitation are needed afterwards). Confirmed findings can then be organized into a report using a dedicated tool like Dradis . Anyone who treats Nessus output as a final report without going through validation is delivering a document of false positives mixed with real risks, indistinguishable from each other.

Final Cheat Sheet #

FAQ #

What is Nessus? A vulnerability scanner developed by Tenable that identifies vulnerabilities, misconfigurations, and outdated software on hosts, servers, and network devices.

What is Nessus for? A vulnerability assessment, patch assessment, configuration assessment, compliance assessment and post-remediation validation.

Is Nessus free? There's a free edition, Nessus Essentials, with a scannable IP limit and no compliance templates. The Professional and Expert editions are paid.

What is Nessus Essentials? The free edition of Nessus, designed for personal labs and studios, with a limit on the number of scannable IPs and no compliance scanning.

How to install Nessus on Kali Linux? Download the package .deb from the Tenable site, install it with dpkg -i, then enable and start the service with sudo systemctl enable --now nessusd.

How to run Nessus on Kali? With sudo systemctl start nessusd, verifiable with sudo systemctl status nessusd.

What is the gate of Nessus? The web UI is reachable on https://127.0.0.1:8834.

What's the difference between credentialed and non-credentialed scanning? Non-credentialed scanning only sees what's exposed by the network (banners, ports); credentialed scanning accesses the system directly and verifies local patches and configurations, with much higher accuracy.

Can Nessus find CVEs? Yes, plugins are often mapped directly to specific CVEs, and you can also filter a scan to check for a specific CVE (Advanced Dynamic Scan).

Does Nessus replace Nmap? No. Nmap is geared toward discovery and enumeration, while Nessus is geared toward vulnerability assessment. They are used in combination, not as an alternative.

Can Nessus execute exploits? That's not its primary purpose: it reports potentially vulnerable conditions, which must be validated with dedicated tools (e.g., Metasploit) or manually.

Can Nessus be used for PCI-DSS compliance? Yes, for internal preparation scans (requires Professional or Expert for dedicated templates), but it doesn't replace the external ASV scan required by PCI, which must be performed by an approved vendor.

What's the difference between Nessus and Nessus Agent? Nessus (scanner) operates remotely over the network; Nessus Agent is installed directly on the endpoint and collects security data locally, useful for devices that aren't always accessible over the network.

How long does a Nessus scan take? It depends on the port range, number of hosts, and whether it's credentialed. A basic network scan on a medium-sized network with default ports takes anywhere from minutes to about an hour; a full port scan (1-65535) takes much longer.

Official sources #

• Tenable Nessus Documentation: complete official documentation
• Nessus Scan Tuning Guide: reference for the reduction of false positives
• Tenable – Download Nessus: official download page
• PCI Security Standards Council: Official reference for PCI-DSS and ASV requirements
• ADHDecode – Vulnerability Scanning: Nessus CVSS Triage: Practical reflection on false positives/negatives and tuning in real-world environments
• Jonathan's Blog – Nessus Tutorial: independent guide with operational notes on safe checks and performance