Greenbone (OpenVAS)

OPNsense

OPNsense is an open-source firewall and routing platform built on FreeBSD, offering a stateful firewall for IPv4/IPv6, multi-WAN load balancing and failover, and hardware failover via the CARP protocol. It bundles multiple VPN options (IPsec, OpenVPN, WireGuard, Tinc), an intrusion prevention system powered by Suricata, and NetFlow-based traffic reporting, all managed through a web GUI. The core platform is free under a permissive BSD/MIT license and can run on anything from a fanless mini-PC to a rack appliance, including official OVA images for virtualization. A paid Business Edition adds a Web Application Firewall, extended threat-intelligence blocklists, centralized fleet management (OPNcentral), and training/e-book resources for organizations that need vendor-backed support.

OWASP ZAP

ZAP (Zed Attack Proxy) is a free and open-source web application security scanner that started under the OWASP umbrella and is now stewarded by Checkmarx with independent open-source governance. It bills itself as the world's most widely used web app scanner, aimed at both security professionals doing manual penetration testing and developers who want automated security checks in CI/CD pipelines. ZAP works as an intercepting proxy that can passively and actively scan web traffic for vulnerabilities, and it can be extended through a marketplace of community-built add-ons. Its interface is designed to be approachable for people new to security testing while still offering the automation hooks experienced testers expect, and the project maintains an active GitHub repository ranked among GitHub's top open-source projects.

Tenable Nessus

Nessus is Tenable's vulnerability assessment scanner, used to discover vulnerabilities and misconfigurations across operating systems, network devices, and applications. It covers over 117,000 CVEs through more than 319,000 detection plugins, with roughly 100 new plugins released weekly, and prioritizes findings using CVSS v4, EPSS, and Tenable's own VPR risk scoring. The product ships with 450+ pre-built policy and compliance audit templates and guided remediation workflows to help teams act on results rather than just collect them. Nessus Professional and Nessus Expert are sold as annual subscriptions, with Expert adding external attack surface scanning and expanded web application scanning.

Qualys

Qualys is an enterprise cyber risk and security platform built to help organizations "measure, communicate, and eliminate cyber risk." Its flagship VMDR (Vulnerability Management, Detection and Response) product continuously and automatically discovers assets across a network, including endpoints, servers, cloud workloads, containers, and IoT devices, then scans and prioritizes vulnerabilities for remediation. The platform emphasizes consolidation, positioning itself as a way for organizations to streamline and automate security and compliance work onto a single cloud platform rather than juggling multiple point tools, aiming for greater agility, better outcomes, and lower cost. Qualys does not publish list pricing on its site; prospective customers request pricing through the company's sales team based on organization size and needed modules.