Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 9 November 2026.

In one sentence: Nessus is a widely used program that checks computers and network devices for known weaknesses, such as missing updates, and produces a list for someone to fix.

This is an explainer. It is not a guide to using the product against anyone else’s systems.

What it is

Nessus is made by Tenable. It is a vulnerability scanner. A scanner works from a large library of checks for known problems. It does not think like an attacker. It asks the same questions of every system and records the answers.

It is sold in several editions. This page describes the scanning method that Tenable documents, not any one edition.

How it works

1. Discovery. The scanner finds live hosts and open ports on the addresses you give it.
2. Fingerprinting. It works out what software and version each open service runs. The NCSC describes infrastructure scanners as using fingerprinting or banner grabbing to collect details like vendor and version, then comparing against a library of products known to be vulnerable.
3. Checks. It sends safe test requests or compares versions to known flaws.
4. Report. It lists findings with severity, usually a CVSS score, and suggested fixes.

Unauthenticated or credentialed

An unauthenticated scan looks from outside, like an attacker with no login. Tenable says its advantage is that it mimics an external attacker’s view, but it cannot give a complete picture of the system.

A credentialed scan logs in to the machine with an account you provide. Tenable says this lets it check local exposures and patch levels that an outside scan cannot see, and that banner information can be inconclusive or incorrect. The depth depends on the privileges you give the account. On Windows, Tenable says an administrator account is needed.

Two practical points from Tenable’s documentation. Nessus opens several concurrent authenticated connections, so an account lockout policy based on concurrent sessions can cause trouble. And a plugin (ID 21745, “OS Security Patch Assessment Failed”) reports when local checks could not run. Tenable says to review all authentication failures, because a system can look scanned while the checks that needed a login did not happen.

Who uses it and how it affects you

• Sole trader to 10 staff. Rarely run in-house. A small business is more likely to meet it as a line in a report from an MSP or an insurer’s questions.
• 10 to 50 and 50 to 250 (accountancy, legal, manufacturing, MSPs). Often run monthly by IT or an MSP to track missing patches. Worst case if ignored: a known, fixable flaw stays open on an internet-facing server.
• Regulated (fintech, healthcare, SaaS start-ups). Scan reports are common evidence for customers and auditors. A scan alone does not show how far an attacker could get.

What we check on a test

A manual test treats a scan as one input, not the answer. When a Wolfcore tester reviews an environment, the method includes:

• Which scanner findings are real, and which are false positives or false negatives.
• Whether several small findings combine into a route to something that matters.
• What the scanner cannot see: business logic, who can see whose data, access control and chained weaknesses in a custom application.
• Whether the scan had working credentials, since thin results can look like a clean bill of health.
• Whether the fix actually closed the issue, by checking again.

The UK angle

The NCSC’s vulnerability management guidance also says to carry out assessments across the whole estate at least every month. Its scanning guidance says vulnerability scanning is only effective as part of a larger vulnerability management programme, and recommends infrastructure scans at least once every month. It also says automated scanning cannot compare to penetration testing for breadth and depth, and is best seen as a cost-effective way to find common issues so that testers can focus on harder ones.

For Cyber Essentials, the NCSC’s requirements (version 3.3) say updates that fix vulnerabilities rated critical or high, or with a CVSS v3 base score of 7 or above, must be applied within 14 days of release. A scanner is a handy way to find what is out of date, but Cyber Essentials does not require a particular tool.

Diagram: scan and test answer different questions

Worked example (illustration only)

A 40-person manufacturer’s MSP runs a monthly scan. The report shows 200 findings, and the owner asks which ones matter. Three internet-facing issues are critical, so they are fixed within the 14-day window Cyber Essentials expects. The credentialed scan of the file server quietly failed to log in, so its report looked clean when it was not. The cost of the blind spot is a server that nobody checked for months. The fix is to watch for failed-login results, and to ask for a manual test of what a real attacker could chain together.

How to detect problems with your scanning

• Check that credentialed scans actually logged in. Tenable’s plugin 21745 reports when local checks did not run.
• Compare scan results with your asset list. Hosts missing from the report are a gap.
• Confirm the account lockout policy is not blocking the scanner’s concurrent connections.
• Keep a record of anything excluded from scanning, as the NCSC advises.

How to use it well

1. Scan internet-facing assets first, then business-critical systems and anything holding sensitive data, as the NCSC advises.
2. Scan at least monthly, and again after fixing a critical issue.
3. Use credentialed scans for internal systems and give accounts enough privilege to see patch levels.
4. Triage by business impact, not score alone. The NCSC says to consider business impact and risk, not just the CVSS rating.
5. Verify every fix with a re-scan.
6. Add a manual penetration test to cover what a scanner cannot.

FAQ

Is Nessus a penetration test? No. The NCSC says automated scanning cannot compare to manual penetration testing for breadth and depth.

How often should I scan? The NCSC says at least once every month for infrastructure, and after fixing a critical issue.

Does Cyber Essentials need Nessus? No tool is named. The standard requires critical and high-risk fixes within 14 days.

Related terms

vulnerability-scanning, penetration-testing, patch-management, cvss, cyber-essentials, nmap

More in the security tools hub.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See our penetration testing service and start with the free web vulnerability scan.