The Importance of a Web Vulnerability Scanner
Every day, businesses lean more heavily on web applications to connect with customers and clients and to make their employees more productive. However, with so much sensitive data behind those web applications, those gains in productivity come with the potential to introduce critical vulnerabilities to the environment. Research into data breaches and their causes bears that out, with every Verizon Data Breach Investigation Report (DBIR) clearly showing web application security vulnerabilities as a significant cause of data breaches. Every organization that operates web apps needs a web application security scanner designed from the ground up to identify the full range of web vulnerabilities, from SQL injection and cross-site scripting (XSS) to other security issues in the OWASP Top Ten and beyond.The Right Tool for The Job
Tenable Nessus and other network security scanners (like Rapid7 Nexpose) are designed to identify vulnerable network services. They can perform cursory vulnerability scanning against web applications but are not designed to crawl an entire web application and identify the full range of application-level vulnerabilities. Acunetix, on the other hand, was designed from the ground up with application security testing in mind. It gives you a comprehensive view of web application vulnerabilities with minimal false positives, as well as the vulnerability management tools to allow your information security team to view and understand scan results quickly, prioritize the findings, and remediate vulnerabilities in your web applications. Uniquely among DAST tools, Acunetix has one more advantage: it comes integrated with the open-source OpenVAS network scanner. OpenVAS is a fork of the original open-source Nessus scanner before it was made into a Tenable product, so you are getting much of the same functionality – but with Acunetix, network vulnerabilities are managed in the same way as web vulnerabilities, giving you the best of both worlds.
Industry-Leading Versatility and Speed
Instead of the limited range of web application plugins that come with a network security scanner like Tenable Nessus, Acunetix gives you a full range of security checks to comprehensively and accurately scan any kind of web application. Whether your business depends on open-source software like WordPress, Drupal, or Joomla!, a commercial off-the-shelf framework, or custom-built web applications, Acunetix will be able to fully crawl your web presence and detect security vulnerabilities with a minimal false positive rate. In addition to its versatility, ease of use, and advanced scanning capabilities (including AcuSensor for IAST and AcuMonitor for out-of-band detection), Acunetix is also a market leader in scanning speed, featuring the SmartScan engine that is optimized for speed and helps you find 80% of vulnerabilities during the first 20% of scan duration.The Acunetix DeepScan Engine
Web applications are evolving to put more functionality on the client side, as evidenced by the rise of single-page applications (SPAs) that rely heavily on HTML5 and JavaScript. Most scanners fall short in properly interacting with and crawling SPAs. If a web application vulnerability scanner cannot perform comprehensive crawling and vulnerability assessment, that means you miss out on vulnerabilities that a sophisticated and patient attacker will take the time to find. Acunetix security researchers have developed a way to crawl the full range of tags, attributes and events in modern SPAs, and this research has been put into action with the DeepScan engine. Tenable Nessus doesn’t have this important capability to accurately parse and scan SPAs, and neither does the Tenable web application scanner (previously called tenable.io). Acunetix gives you the power and confidence of our proprietary DeepScan engine to ensure that each page is fully crawled and tested.
Frequently asked questions
Tenable Nessus was created as a network security scanner. With time, some web vulnerability tests were added, but web vulnerability scanning in Tenable Nessus does not offer as many features as Acunetix. Not only was Acunetix created as a dedicated web vulnerability scanner, but it also comes with OpenVAS as a built-in network scanner (based on the same original open-source project as Tenable Nessus).
Learn how to install OpenVAS and configure it with Acunetix.
Tenable Nessus is a network security scanner that runs scans and provides reports but has few vulnerability management features because management is not its main purpose. Acunetix scans web applications for vulnerabilities but goes far beyond just providing scan reports, allowing you to fully manage your vulnerabilities, whether internally using Acunetix itself or by integrating with existing external management tools.
No, Tenable Nessus is not free. Nessus began as an open-source project but was then made into into a commercial product by Tenable. The original open-source Nessus code was forked to create GNessUs (OpenVAS). Acunetix comes with the OpenVAS scanner built it, allowing you to detect and manage web and network vulnerabilities using one product and user interface.
Read about the history of Nessus, Tenable Nessus, and OpenVAS.
We believe that web vulnerability scanning is becoming much more important than network security scanning. This is because businesses are increasingly relying on web applications rather than traditional desktop applications. They host these web applications in the cloud, where network security is managed by the hosting provider – so they do not need network security scanning but definitely need application vulnerability testing.
We utilize Acunetix to more thoroughly assess internet-facing websites and servers. Acunetix helps us identify vulnerabilities in conjunction with other vulnerability scanning applications. Acunetix has been a more reliable application when discovering / determining different types of malicious code injection vulnerabilities (SQL, HTML, CGI, etc).