Best Vulnerability Scanners in 2026

Wiz is a cloud and AI security platform that connects to an organisation's cloud environments and reports vulnerabilities, misconfigurations and other risks in the context of how each resource can be attacked. In 2026 it organised its product around three AI agents: Wiz Green, which turns risks into code fixes by opening pull requests; Wiz Red, which discovers attack paths through automated penetration testing; and Wiz Blue, which automates threat hunting and investigation.

Wiz completed its move into Google in 2026: on 11 March 2026 the company's co-founder Assaf Rappaport published a post titled "It's Official: Wiz Joins Google", nearly a year after the deal was announced. The company says its customers run on AWS, Azure, Google Cloud and Oracle Cloud Infrastructure, and that it continues to protect environments across all of them. Wiz states that more than 65% of the Fortune 100 use its platform and that it was named a Customers' Choice for cloud security posture management tools in 2026.

Alphabet, Wiz's parent, reported revenue of US$402.8 billion for 2025. Wiz is not a network or web-application scanner in the traditional sense: it covers cloud workloads, containers and code pipelines, so organisations with large on-premises estates usually pair it with a conventional scanner. Prices are not published.

Microsoft Defender Vulnerability Management (MDVM) uses the Microsoft Defender for Endpoint sensor already installed on managed devices to discover software vulnerabilities and misconfigurations continuously, without separate scan schedules. Microsoft lists real-time discovery, continuous assessments, prioritised security recommendations, the ability to block vulnerable applications, and assessments of cloud workloads.

The paid add-on extends the core capability with security baselines assessment, browser extension and digital certificate assessment, network share analysis, hardware and firmware assessment and authenticated scanning for Windows. Microsoft documentation notes that the experience is changing for preview customers using Defender XDR with Defender for Identity.

Microsoft reported revenue of US$331.8 billion for the fiscal year ended June 2026. The add-on is priced at US$2.00 per user per month and requires Defender for Endpoint Plan 2 or a suite that includes it, such as Microsoft 365 E5; Microsoft says MDVM is also available as a standalone offer. Its limitation is scope: it assesses devices running the Defender sensor and does not crawl web applications or scan unmanaged network devices the way a network scanner does.

Tenable makes Nessus, which it describes as the world's most widely deployed vulnerability assessment solution, and the cloud-based Tenable Vulnerability Management platform that builds on it. Tenable was founded in 2002 and says it serves more than 40,000 customers, including 65% of the Fortune 500, with coverage of more than 336,000 CVEs.

Nessus is sold in two paid editions. Nessus Professional, aimed at consultants and security teams, costs US$4,790 for a one-year licence, with multi-year discounts; Nessus Expert adds web application scanning and external attack surface discovery for US$6,790 a year. Tenable Vulnerability Management, the platform for organisations that need asset tracking, dashboards and remediation workflows, is sold online from US$3,700 a year, with online purchase available for up to 250 assets, and Tenable Web App Scanning costs US$6,790 a year for five fully qualified domain names. Advanced 24x365 support is an extra US$400.

Tenable reported revenue of US$999 million for 2025. Its weaknesses are the price step from a single scanner to the platform, and the fact that agents, web scanning and attack surface discovery are separate products or editions.

Rapid7 InsightVM is a vulnerability management product that combines scan engines with a lightweight endpoint agent and a cloud console for dashboards and remediation tracking. Rapid7 now sells it as the technology that powers Exposure Command, in two packages: Exposure Command Essentials, which adds attack surface management to InsightVM, and Exposure Command Ultimate, which adds cloud and application security.

Rapid7 also maintains Metasploit, which it describes as the world's most used penetration testing tool, and publishes a vulnerability and exploit database; this lets InsightVM highlight vulnerabilities with known public exploits. Remediation projects can be assigned to IT owners and tracked to closure, which suits teams that must report progress to management.

Rapid7 reported revenue of US$860 million for 2025. Package prices are not published on the pricing page, which directs buyers to a packages page and to sales. The rebranding to Exposure Command means documentation and pricing are spread across product names, which complicates comparisons.

Qualys VMDR (vulnerability management, detection and response) is the core application of the Qualys Enterprise TruRisk Platform. It discovers assets automatically, scans them from a single cloud platform, prioritises findings with the TruRisk scoring model using threat and business context, and supports remediation from the same console. Qualys says more than 10,000 subscription customers in more than 130 countries use its platform.

VMDR is delivered from the Qualys cloud. Qualys Community Edition gives a free, cloud-based version of the Enterprise TruRisk Platform for the security community, covering asset discovery, vulnerability management, web application scanning and cloud inventory, with no software to install. The Qualys Knowledgebase includes thousands of CVEs and is updated continuously.

Qualys reported revenue of US$669 million for 2025. Commercial pricing is quote-based. Users frequently cite the breadth of modules, which can make licensing and navigation complex for small teams.

Trivy is an open-source security scanner maintained by Aqua Security. It finds vulnerabilities, misconfigurations, secrets and software bills of materials in container images, code repositories, binary artifacts, container images and Kubernetes clusters, and can also check licences. It is written in Go and distributed under the Apache-2.0 licence, and a new version is released every month.

Trivy has become a default choice in many continuous-integration pipelines because it runs as a single binary with no server, and its output can fail a build when serious vulnerabilities appear. Organisations such as Mirantis cite it on the project site, and independent practitioners describe choosing it after evaluating other open-source vulnerability scanners.

Aqua Security is privately held. Trivy itself is free; Aqua sells a commercial cloud-native application protection platform for organisations that need central management, runtime protection and support. Trivy does not scan running networks or web applications, so it complements rather than replaces a network scanner.

Detectify is a software-as-a-service product that discovers an organisation's internet-facing assets and tests web applications and APIs for vulnerabilities. Its tests draw on research from security professionals with hacker experience, and it offers REST and GraphQL API scanning, application scanning and PCI ASV scanning.

Detectify publishes its pricing, which is unusual for the category. Every plan carries an annual platform fee plus a cost per scanned target: Starter from €0 for up to five users and one team, Standard from €2,500 for up to ten users, Professional from €5,000 with unlimited users across two teams, and Enterprise from €15,000 with unlimited users and teams. PCI ASV scanning costs an additional €500 a year, and expert onboarding of five hours costs €2,500.

Detectify is privately held. It focuses on external-facing assets: it does not scan internal networks or endpoints, so it suits companies whose main exposure is websites and APIs.

Greenbone is the German company behind OpenVAS, the best-known open-source network vulnerability scanner, which it has developed since 2006. The company has announced that all Greenbone products will be brought together under the OPENVAS brand: the range now includes OPENVAS FREE, the entry-level OPENVAS BASIC for small businesses, OPENVAS SCAN, OPENVAS SECURITY INTELLIGENCE and OPENVAS AI. Commercial editions are sold as hardware appliances and as virtual machines compatible with common hypervisors.

Greenbone reports more than 100,000 installations, use in more than 150 countries and more than 100 sales partners. It stresses GDPR compliance and European development, which matters to public-sector and regulated buyers in the EU. Its community feed is updated continuously, and the company publishes advisories on new vulnerabilities on its blog.

Greenbone says its solutions cost between a few euros a month and several hundred thousand euros depending on scope, and OPENVAS BASIC can be tested free for 14 days. The free edition is capable but requires Linux administration skills, and its reporting and asset management are less polished than commercial cloud platforms.

Intruder is an online vulnerability scanner aimed at what it calls "the 99%" of organisations without large security teams. It combines several scanning engines, naming Tenable, OpenVAS and Nuclei, and adds its own checks, emerging-threat scans, cloud synchronisation and attack surface monitoring. Plans cover external and internal infrastructure, web applications, APIs and cloud environments.

Intruder's model is designed for small teams: scans are scheduled automatically, results are filtered to reduce noise, and reports are formatted to support compliance with standards such as SOC 2, Cyber Essentials and ISO 27001. It also sells AI-powered web application penetration tests starting from US$3,500 per test.

Pricing combines a base fee with a small fee per target across Free, Cloud, Pro and Enterprise plans; Enterprise is custom, a 14-day free trial includes the Cloud plan's features, and annual billing saves 20%. Intruder is privately held. Because it relies partly on third-party engines, organisations already licensing Tenable may find overlap.

Invicti is an application security company focused on dynamic application security testing (DAST), which tests running web applications and APIs from the outside. It states that more than 5,000 customers use it, that it has secured more than one million apps and APIs, and that it has more than 20 years of experience in runtime testing. Its Acunetix scanner has been renamed Invicti Web + API, with the company describing the product's legacy as two decades of fast, accurate DAST.

Invicti's main differentiator is proof-based scanning, which attempts to confirm that a detected vulnerability is exploitable so that developers receive fewer false positives. The platform now consolidates DAST with code-to-runtime correlation and vulnerability management, and integrates with CI/CD tools such as Jenkins and CircleCI. It also offers an AI-driven "agentic pentester" that produces audit-ready reports in under 24 hours for US$500 or less.

Invicti is privately held. Platform pricing is quote-based. It does not scan network infrastructure, so it is usually paired with a network scanner such as Nessus or Qualys.

Burp Suite, made by PortSwigger, is the standard toolkit for manual web application penetration testing. Burp Suite Professional combines an intercepting proxy, automated vulnerability scanner, Burp Intruder for customised attacks and authenticated API scanning, and it supports a large library of user extensions. PortSwigger says Burp Suite Professional was recognised as a Gartner Peer Insights Customers' Choice for 2024.

For organisations that want scheduled, automated scanning at scale, PortSwigger sells Burp Suite DAST, which runs parallel crawl and audit, carries authenticated sessions across scans, and supports bulk operations, locked scan policy templates and portfolio-level reporting across thousands of sites. PortSwigger names SAP, Microsoft, Amazon, NASA, Salesforce, FedEx and Oracle among organisations using Burp. It also runs the free Web Security Academy for training.

Burp Suite Professional costs US$499 and can be tried free; Burp Suite DAST is quote-based. Professional is a tool for skilled testers rather than a turnkey scanner, so results depend heavily on the operator.

Nuclei is an open-source vulnerability scanner developed by ProjectDiscovery that uses simple YAML templates to describe how to detect each vulnerability. Templates are contributed by thousands of security professionals and are published quickly after new vulnerabilities become public, which makes Nuclei popular for checking an estate against trending exploits. The GitHub repository had 32.8 thousand stars when checked. Intruder is one commercial scanner that uses Nuclei as one of its engines.

ProjectDiscovery maintains a family of open-source tools, including Subfinder, HTTPx and Naabu, for reconnaissance, and sells a commercial platform called Neo that runs autonomous application and API penetration tests, attack surface discovery and vulnerability workflows, including authenticated tests with SSO and multi-factor authentication.

Neo has a free tier with one seat; paid seats cost US$200, US$400 or US$800 per month depending on usage allowance, or US$2,100, US$4,200 or US$8,400 a year, with enterprise plans priced on request. Nuclei itself requires command-line skills and produces only what its templates cover.

Snyk is a developer-focused security platform that scans source code (Snyk Code, a static analysis tool), open-source dependencies (Snyk Open Source), container images (Snyk Container) and infrastructure-as-code files (Snyk IaC). It integrates into IDEs, source control and CI pipelines so developers see vulnerabilities and fixes before code is deployed, and it has added AI security agents that run parts of an application security programme.

Snyk's free plan covers five projects with 100 Snyk Code tests a month, and the Team plan starts at US$25 a month billed monthly, raising limits to 100 projects and 1,000 code tests a month with Jira integration and next-business-day support. Larger customers buy credits at US$1 per credit, which are drawn down by each capability according to a platform rate card. Snyk offers its platform at no cost to maintainers of open-source software.

Snyk is privately held. It scans software artifacts rather than running systems, so it does not replace infrastructure or DAST scanners; buyers usually combine it with tools such as Nessus or Invicti.

ZAP, the Zed Attack Proxy, is a free and open-source web application security scanner. The project describes itself as the world's most widely used web app scanner and as a community-based GitHub Top 1000 project that anyone can contribute to; it states that ZAP is an independent open-source project.

ZAP works as an intercepting proxy between a browser and a web application, recording traffic for manual testing, and as an automated scanner that spiders an application and runs passive and active vulnerability checks. It can be scripted and run headless in CI pipelines, and it is often the first web scanner that developers and students learn, supported by the project's quick-start guide and introductory video.

ZAP has no licence cost. Its trade-offs are those of most community tools: no vendor support contract, fewer enterprise features such as portfolio dashboards, and more manual configuration for authenticated applications than commercial DAST products such as Invicti or Burp Suite DAST.