OpenVAS

What Is OpenVAS?

If you’re responsible for a network and you don’t have continuous visibility into known vulnerabilities, you’re operating on hope. OpenVAS is built for the unglamorous, necessary job of finding exposed services, missing patches, weak configurations, and known CVEs across hosts—then turning that into actionable scan results you can track over time.

Under the hood, “OpenVAS” is best understood as the scanning engine and (in practice) the broader Greenbone Vulnerability Management stack that wraps it. Greenbone’s own community documentation describes the Greenbone Community Edition as the open-source Greenbone Vulnerability Management software stack, “also known as OpenVAS.” In other words: people say “OpenVAS,” but the thing you deploy for real vulnerability management usually includes the scanner plus the manager and UI.

Who it’s for: security teams and sysadmins who want an on-prem (or self-hosted) vulnerability scanner with a real vulnerability test feed and a workflow for organizing targets, launching scans, and reviewing results. What makes it distinctive is its modular architecture and the fact that Greenbone maintains both the scanner and the surrounding management components (manager, web UI, tooling) as an open-source stack, while offering commercial feed and product options for organizations that need stronger coverage and support.

OpenVAS Features and Performance

OpenVAS is not “one binary you run.” It’s a stack. The scanner component (“OpenVAS Scanner”) runs vulnerability tests; the manager (“gvmd”) is the central service that coordinates scans, stores results, and mediates access for clients and the UI. Greenbone’s documentation describes gvmd as the central service that consolidates scanning into a full vulnerability management solution, controlling the OpenVAS Scanner via Open Scanner Protocol (OSP). If you only install the scanner, you don’t get the full management experience.

Web UI, API, and automation hooks

For most users, day-to-day operation happens through a web interface called Greenbone Security Assistant (GSA). Greenbone’s manuals describe the web interface as GSA, and the GSA repository itself labels it as the web frontend for the Greenbone Community Edition.

If you want to script or integrate scans into pipelines, Greenbone exposes vulnerability management functionality through the Greenbone Management Protocol (GMP). Greenbone’s documentation for OPENVAS SCAN explicitly states that vulnerability management functionality is available via GMP, and that “gvm-tools” provides tooling to access GMP functionality. This matters if you need repeatable scans, CI-style checks, or integration with ticketing/asset systems.

Vulnerability test content (the part that makes or breaks results)

OpenVAS runs “Network Vulnerability Tests” (NVTs). The scanner’s installation documentation is blunt: to run vulnerability scans you need a collection of NVTs that OpenVAS can execute. Those tests are typically authored in NASL (Nessus Attack Scripting Language), which OpenVAS supports as its vulnerability test scripting language (the project even includes a NASL manpage and community guidance on VT development in NASL).

Greenbone splits test content into feeds, and this is where the “free” reality gets complicated:

• TechRadar summarizes that OpenVAS comes in two feeds: a cost-free, open-source “Greenbone Community Feed,” and a commercial “Greenbone Enterprise Feed.”
• Greenbone’s own comparison materials state that the professional Enterprise Feed includes all vulnerability tests developed in-house, while the Community Feed does not.

Translation: the free community setup can work well, but your coverage and update/service expectations should be calibrated to the feed you’re actually using.

Deployment models: native installs and containers

Greenbone publishes community documentation for running the stack in containers, and the container references show distinct services for the manager (gvmd), scanner, and web front-end (gsad/gsa). This modularity is powerful (you can scale, separate roles, or isolate scanners), but it also increases operational complexity compared to “single installer” commercial scanners.

Performance: what realistically affects scan speed

OpenVAS performance is workload-dependent: number of hosts, open ports/services, credentials (credentialed scans can be heavier), and which test families are enabled. What’s important from an architectural standpoint is that scanning and management are separated—gvmd manages tasks and results, while the scanner executes tests—so bottlenecks can show up in different places (scanner CPU/network, manager database/storage, and feed/test selection). Greenbone’s own docs emphasize this separation and the interfaces between components.

If you’re looking for “VPN-style speed” claims, you won’t find them here—this is a vulnerability scanner, not a privacy tunnel. The honest expectation is: OpenVAS can be comprehensive and customizable, but heavy scans can take time, and tuning matters more than raw “speed specs.” TechRadar’s review frames OpenVAS as more complex and customizable than beginner-friendly alternatives, which matches what most teams experience in practice.

Pricing and Plans

Pricing model (verified): free.

In practice, there are multiple “OpenVAS-branded” options depending on what you mean by “OpenVAS”:

• Open-source Community Edition / Community Feed: Greenbone positions the Community Edition as the open-source software stack (often referred to as OpenVAS) and documents it openly. The Community Feed is described as cost-free (as echoed by TechRadar and Greenbone’s own materials contrasting community vs enterprise).
• Commercial options (paid): Greenbone offers commercial offerings and an Enterprise Feed, but exact subscription pricing is not consistently published in the sources reviewed here, so this review won’t invent numbers. Greenbone’s own comparison documents make clear there are paid options (e.g., Enterprise Feed / product variants) alongside community options.

Refunds: No reliable, explicit refund-window statement was found in the sources above for enterprise subscriptions/licenses, so this review won’t claim a specific refund policy.

Privacy and Security Assessment

This is where many “privacy tools” review templates don’t map cleanly—OpenVAS is not a consumer privacy product, and it’s not a VPN. The relevant security questions are: where the data lives, what code you can inspect, how updates are handled, and what you’re implicitly trusting.

Open-source posture and licensing

The OpenVAS scanner code is published openly, and the scanner repository indicates GPL-2.0 licensing (with files under GPL-2.0-only or GPL-2.0-or-later as detailed in its license breakdown). Greenbone also explicitly states in its materials that the scanner core is open source under the GPL and is further developed by Greenbone AG.

Other stack components are also published; for example, gvmd is the manager component, described as the central management service between scanners and user clients.

Data handling and “logs” (in the VPN sense)

There is no meaningful “no-logs” claim to assess because OpenVAS is designed to store scan configurations and results. It’s a vulnerability management system; if it didn’t keep results, it wouldn’t be useful. The privacy posture is therefore mostly determined by your deployment: self-hosted means scan results stay where you host them.

Feed trust and update reliability

Your security outcomes depend on how current and comprehensive your vulnerability tests are. Greenbone’s materials clearly distinguish between the Community Feed and the Enterprise Feed, emphasizing that Enterprise includes broader in-house tests while Community is more limited.

There are also community reports of feed update issues (for example, forum discussion threads focused on Community Feed update timeliness). Those are not proof of a systemic failure, but they’re a practical reminder: if you bet your program on a free feed, you should monitor its freshness and have a plan when updates lag.

Jurisdiction and compliance claims

Greenbone markets its solutions as “GDPR-compliant” and positions itself as a European vendor, but “jurisdiction” in the VPN sense doesn’t apply the same way here because the default community deployment is self-hosted. Still, if you use commercial cloud or managed services, jurisdiction becomes relevant—but those specifics weren’t confirmed in the sources captured for this review, so we won’t go beyond what’s documented.

Known incidents / audits

No credible, specific “security incident” record or independent “no-logs audit” claim applicable to OpenVAS was found in the sources reviewed above. This review therefore does not claim any third-party audit status.

Strengths and Limitations

Strengths

• Real vulnerability management stack, not just a scanner. The separation of scanner (OpenVAS), manager (gvmd), and UI (GSA) supports structured workflows and repeatable operations.
• Automation-friendly. GMP plus gvm-tools gives you a documented way to drive scans and retrieve results programmatically.
• Open-source core. The scanner is published and GPL-licensed, with public repositories and documentation.
• Extensible test approach. Vulnerability tests are implemented as NVTs, and community guidance explicitly frames VT development as writing NASL scripts.

Limitations

• Operational complexity. The “real” deployment involves multiple components (scanner, OSP daemon, manager, UI), which is more moving parts than many teams expect. The scanner docs explicitly note that user interfaces interact with gvmd and/or ospd-openvas—not directly with the scanner.
• Free feed is not the same as enterprise coverage. Greenbone explicitly positions the Community Feed as more limited compared to the Enterprise Feed, including not having all in-house tests.
• UI/UX isn’t the main selling point. Even favorable reviews note OpenVAS is less beginner-friendly than some commercial competitors, while stronger on customization and complexity.

Who Should Use OpenVAS?

Good fit

1. Small-to-mid teams that need a free, self-hosted vulnerability scanner. If your priority is “get coverage without license spend” and you can tolerate setup and tuning, the community stack fits.
2. Security engineers who want automation and integration. If you plan to script scans and pull results into other systems, GMP + gvm-tools is a practical foundation.
3. Organizations that want inspectable, open-source components. If your policy prefers open code for core scanning infrastructure, the OpenVAS scanner’s GPL licensing and public repos matter.

Not a good fit

1. Teams that need a “one-click” scanner with minimal ops. OpenVAS’s multi-component architecture and feed management are real overhead.
2. Organizations that require guaranteed, comprehensive test coverage without exceptions. Greenbone’s own materials position Enterprise Feed coverage as broader than Community Feed, implying trade-offs for free users.
3. Anyone shopping for a privacy tool like a VPN. OpenVAS isn’t a VPN, doesn’t provide anonymity, and stores scan results by design.