OpenVAS Scanner: How the Open Vulnerability Assessment Scanner Works

OpenVAS Scanner is the scan engine at the heart of the Greenbone Community Edition — an open-source vulnerability scanner that checks hosts, services, and applications against a continuously updated feed of vulnerability tests. If you are evaluating it for a lab, a small business, or a larger environment, this guide covers what it actually does, how it is deployed, and where it fits alongside other security checks.

What Is OpenVAS Scanner?

OpenVAS Scanner: How the Open Vulnerability Assessment Scanner Works - What Is OpenVAS Scanner?.

OpenVAS stands for Open Vulnerability Assessment Scanner. It is a full-featured vulnerability scanner maintained by Greenbone, the German company that has driven the project forward since 2006. The scanner itself is one component: it executes a feed of Vulnerability Tests (VTs) that is updated daily, and it is used both in the open-source Greenbone Community Edition and in Greenbone's commercial enterprise appliances.

Key capabilities documented by the project include:

• Unauthenticated and authenticated testing — scanning from the outside, or logging in to a host for deeper checks.
• Broad protocol coverage — high-level and low-level internet protocols plus industrial protocols.
• Performance tuning — configuration options for large-scale scans.
• An internal scripting language — used to implement custom vulnerability tests.

In short: it is a general-purpose, feed-driven scanner rather than a single-purpose port checker.

How the Scanner and the Feed Work Together

OpenVAS Scanner: How the Open Vulnerability Assessment Scanner Works - How the Scanner and the Feed Work Together.

A vulnerability scanner is only as useful as its test library. OpenVAS separates the engine from the content:

1. The scan engine (the openvas-scanner component) schedules and runs tests against targets.
2. The feed delivers new and updated Vulnerability Tests, so detection keeps pace with newly disclosed issues.
3. Supporting modules in the Greenbone Community Edition handle management, scheduling, and reporting around the scanner.

That architecture is why the project emphasizes the feed's long history and daily updates — a scanner without fresh tests quickly becomes a historical record rather than a security control.

Authenticated vs Unauthenticated Scans

OpenVAS Scanner: How the Open Vulnerability Assessment Scanner Works - Authenticated vs Unauthenticated Scans.

This is the single most important decision when planning a scan, because the two modes answer different questions.

Mode	What it sees	Best for
Unauthenticated	Exposed services, banners, misconfigurations visible from the network	External attack-surface checks, quick exposure reviews
Authenticated	Installed packages, missing patches, local configuration weaknesses	Internal hardening, patch compliance, deeper audits

Unauthenticated scanning mirrors what an attacker on the network could observe. Authenticated scanning requires credentials on the target and returns far more detail — missing patches and insecure local settings that never appear in a network-only view. Most mature programs run both: authenticated scans for depth, unauthenticated scans to confirm what is actually reachable.

Deployment Options

OpenVAS Scanner can be run in several ways, and the right choice depends on your team's comfort with building and maintaining software.

Build from source

The scanner repository is buildable with standard tooling:

cmake .
make install

Detailed requirements and setup steps live in the project's INSTALL.md. This path gives maximum control but puts update and dependency management on you.

Containers

Prebuilt images are published to the Greenbone registry, for example ghcr.io/greenbone/openvas-scanner:stable, and you can also build locally from the provided Dockerfile. A fully containerized Community Edition setup is available as well. Note that the community containers have historically been described as under development, so validate stability before relying on them in production.

Prepared virtual appliance

If compiling from source is not appealing, Greenbone offers a prepared virtual machine (the Enterprise TRIAL) with a ready-to-use setup — a practical way to evaluate the scanner before committing to an architecture.

Commercial platform

The commercial OPENVAS SCAN product family adds hardware and virtual deployment options, agent-based scanning, container image scanning, and integrations with platforms such as ServiceNow, Splunk, Nagios, and CyberArk. It is aimed at organizations that need distributed scanning, automated workflows, and compliance reporting rather than a standalone engine.

A Practical First Scan Workflow

A sensible rollout looks like this:

1. Inventory targets. Decide which hosts and subnets you are authorized to scan. Scanning systems you do not own is both ineffective and potentially illegal.
2. Start unauthenticated. Get a baseline of exposed services and obvious misconfigurations.
3. Add credentials. Move to authenticated scans on the hosts that matter most, so patch-level findings appear.
4. Tune performance. Large ranges need scheduling and concurrency adjustments; the scanner supports performance tuning for exactly this reason.
5. Prioritize and remediate. Rank by exploitability and exposure, not raw finding count.
6. Rescan to verify. A closed ticket is not a fixed vulnerability until a follow-up scan confirms it.

Where OpenVAS Fits in a Broader Security Stack

A vulnerability scanner covers one layer: known weaknesses in hosts and services. It complements, rather than replaces, other controls. Firewalls and endpoint protection reduce reachable attack surface; a scanner tells you what is still exposed and unpatched. Greenbone's own positioning makes this point — the visibility a scanner adds is what lets you close gaps before they become incidents.

Two practical complements worth pairing with any scanning program:

• External exposure checks. Before or after a scan, confirm what your network actually presents to the internet. A quick port scanner run from outside your network helps you see which services are reachable, which is useful context when triaging scan results.
• Browser and network privacy verification. Scanning finds server-side weaknesses; it says nothing about whether your own connection leaks your real IP. Tools that check for DNS and WebRTC leaks, and that analyze your browser fingerprint, cover a different part of the risk picture — particularly for remote teams and VPN users. If you work with IP data regularly, understanding how IP to location lookups behave also helps you interpret geolocation findings accurately.

For teams building automated pipelines around scan data, an API for IP data can enrich findings with ISP, proxy, and geolocation context — useful when a scan flags an unexpected service on an address you thought you knew.

Common Pitfalls and How to Avoid Them

• Scanning without authorization. Always get written permission for the ranges you target.
• Treating finding counts as a score. A thousand low-severity items matter less than one remotely exploitable critical.
• Skipping authenticated scans. Network-only scanning misses the majority of patch-level issues.
• Letting the feed go stale. Daily updates are the point; an outdated feed undermines the entire exercise.
• No verification loop. Schedule rescans, or you cannot prove remediation worked.

OpenVAS Scanner vs Other Approaches

• Versus a simple port scanner: a port scanner tells you what is open; OpenVAS tells you what is open and whether it is vulnerable. Use the former for a fast reachability check, the latter for assessment.
• Versus commercial scanners: the open-source Community Edition is capable but requires you to run and maintain it. Commercial platforms trade cost for managed feeds, support, agents, and integrations.
• Versus manual testing: automated scanning is repeatable and broad; manual testing finds logic flaws automation misses. Mature programs use both.

Related reading

• IP to Location: How It Works, Accuracy, and Privacy - Learn how IP to location lookup works, why city-level accuracy varies, what data you can get, and how to check your own IP with free privacy tests.
• API for IP Data: Geolocation, VPN & Threat Lookup Guide - Learn how an API for IP data works: geolocation, ISP, proxy and VPN detection, threat feeds, rate limits, privacy, and how to verify results.
• PrivacyTools.io Download Guide: Find & Install Private Apps - Learn how PrivacyTools.io download works: browse the catalog, pick open-source apps, install safely, and verify your privacy setup with free tests.

Sources and further reading

• OPENVAS - Open Vulnerability Assessment Scanner - OPENVAS is a full-featured vulnerability scanner. Its capabilities include unauthenticated and authenticated testing, various high-level and low-level internet and industrial protocols, performance tuning for large-scale scans and a powerful internal programming language to implement any type of vulnerability test. The scanner obtains the tests for detecting vulnerabilities from a feed that has a long history and daily updates.
• OPENVAS SCAN - Identify vulnerabilities & strengthen security - Automated vulnerability detection for maximum IT security 🔐 Reduce risks and protect your systems.
• GitHub - greenbone/openvas-scanner: This repository contains the scanner component for Greenbone Community Edition. - This repository contains the scanner component for Greenbone Community Edition. - greenbone/openvas-scanner

Frequently Asked Questions

Is OpenVAS free?

The scanner and the Greenbone Community Edition are open source, licensed under GPL terms (the Rust implementation carries an OpenSSL exception and some files are additionally MIT-licensed). Commercial OPENVAS SCAN products are separate, paid offerings.

What is the difference between OpenVAS and Greenbone?

OpenVAS is the scanner technology. Greenbone is the company that develops and maintains it, and Greenbone Community Edition is the open-source product family that bundles the scanner with other modules.

Can OpenVAS scan containers?

Container image scanning is a documented capability of the commercial OPENVAS SCAN platform. The open-source scanner focuses on network services, hosts, and applications.

Do I need credentials to get useful results?

You can get useful results without them, but authenticated scans reveal missing patches and local misconfigurations that unauthenticated scans cannot see. For internal hardening work, credentials are strongly recommended.

How often should I scan?

Feed updates arrive daily, so many teams scan continuously or on a weekly cadence for critical assets. The right frequency depends on how quickly your environment changes and how much risk a delayed finding represents.

Conclusion

OpenVAS Scanner is a mature, feed-driven vulnerability scanner with a long development history and a clear split between the open-source engine and commercial platform features. Its strengths are breadth, daily test updates, and flexibility in deployment — from a source build to containers to a prepared virtual appliance. Its demands are equally clear: you need authorized targets, a maintenance plan, and a verification loop.

Pair it with external exposure checks and privacy verification so you are not only finding weaknesses in your systems, but also confirming that your own connection and browser are not quietly working against you.