What Claude (Anthropic) with web search answered for vulnerability scanning tools (small businesses) on 2026-09-13

Claude (Anthropic) with web search claude-opus-5 asked 2026-09-13

Coverage: Claude (Anthropic) with web search. Other engines not included.

The question asked, verbatim: best vulnerability scanning tools for small businesses

Brands named, in the order the engine gave

1. Intruder recommended
   Intruder - My default suggestion for a small business with no dedicated security person.
2. OpenVAS recommended
   Under the hood it runs OpenVAS on the Essential plan and adds Nuclei on the Cloud plan, so you're getting solid engines with a usable interface bolted on.
3. you're recommended
   Under the hood it runs OpenVAS on the Essential plan and adds Nuclei on the Cloud plan, so you're getting solid engines with a usable interface bolted on.
4. CISA Cyber Hygiene Services recommended
   CISA Cyber Hygiene Services - Free, and I'd sign up for this regardless of what else you buy.
5. Greenbone / OpenVAS recommended
   Greenbone / OpenVAS - The answer if your budget is genuinely zero and you have someone comfortable running a Linux VM.
6. Linux recommended
   Greenbone / OpenVAS - The answer if your budget is genuinely zero and you have someone comfortable running a Linux VM.
7. Tenable Nessus recommended
   Tenable Nessus Professional - The deepest-pedigree scanner and still the industry standard, but it's a point-in-time scanning engine, not a management platform, and list price is roughly $4,800/year (Expert ~$6,800).
8. Tenable Nessus Professional recommended
   Tenable Nessus Professional - The deepest-pedigree scanner and still the industry standard, but it's a point-in-time scanning engine, not a management platform, and list price is roughly $4,800/year (Expert ~$6,800).
9. Rapid7 recommended
   Rapid7 InsightVM - The one I'd name if you expect to grow into a broader security program.
10. Rapid7 InsightVM recommended
    Rapid7 InsightVM - The one I'd name if you expect to grow into a broader security program.
11. Aikido mentioned
    Add Aikido (SAST, DAST, SCA, container and IaC scanning in one product, small-team friendly pricing) or StackHawk / OWASP ZAP for web app testing specifically.
12. StackHawk mentioned
    Add Aikido (SAST, DAST, SCA, container and IaC scanning in one product, small-team friendly pricing) or StackHawk / OWASP ZAP for web app testing specifically.
13. OWASP ZAP mentioned
    Add Aikido (SAST, DAST, SCA, container and IaC scanning in one product, small-team friendly pricing) or StackHawk / OWASP ZAP for web app testing specifically.
14. ZAP mentioned
    Add Aikido (SAST, DAST, SCA, container and IaC scanning in one product, small-team friendly pricing) or StackHawk / OWASP ZAP for web app testing specifically.

Sources the engine cited

The answer, as recorded

Here's what I'd actually recommend, roughly in the order I'd try them: **1. Intruder** - My default suggestion for a small business with no dedicated security person. It's cloud-hosted (nothing to install), focused on your internet-facing attack surface, and it tells you what to fix first instead of dumping a 400-page CVE list on you. Under the hood it runs OpenVAS on the Essential plan and adds Nuclei on the Cloud plan, so you're getting solid engines with a usable interface bolted on. Starts in the low hundreds per month. **2. CISA Cyber Hygiene Services** - Free, and I'd sign up for this *regardless* of what else you buy. US government service that continuously scans your public static IPs and web apps, emails you weekly reports plus urgent alerts. Takes ~72 hours to start after you email them. No reason not to have it running in the background. Caveat: it only covers internet-facing assets you own IPs for, so it's a complement, not a replacement. **3. Greenbone / OpenVAS** - The answer if your budget is genuinely zero and you have someone comfortable running a Linux VM. Free, self-hosted, huge feed of network and host tests. The community edition is real work to maintain, so the honest tradeoff is money vs. your admin's time. **4. ManageEngine Vulnerability Manager Plus** - Worth a look if you want scanning *and* patching in one tool rather than a scanner that just generates a to-do list. For a small IT team that's already the one doing the remediation, that consolidation is often more valuable than better detection. **5. Tenable Nessus Professional** - The deepest-pedigree scanner and still the industry standard, but it's a point-in-time scanning engine, not a management platform, and list price is roughly $4,800/year (Expert ~$6,800). For most small businesses that's a lot of money for something you'll outgrow the moment you want continuous monitoring. I'd pick it if you have compliance audit requirements or someone who already knows it. **6. Rapid7 InsightVM** - The one I'd name if you expect to grow into a broader security program. Entry pricing is reported around $175/month, cheaper than Nessus at the low end, with risk-based prioritization and dashboards. Heavier to deploy than Intruder, so it's overkill unless you'll use the rest of the platform. **If you build software**, the above are mostly network/infrastructure scanners and won't cover your own code. Add **Aikido** (SAST, DAST, SCA, container and IaC scanning in one product, small-team friendly pricing) or **StackHawk** / **OWASP ZAP** for web app testing specifically. A practical note: the biggest determinant of whether this works isn't which scanner you pick - it's whether anyone acts on the output. A free CISA report someone reads beats a $5k scanner nobody logs into. One caveat on the pricing above: the Nessus and Rapid7 numbers come from third-party comparison write-ups rather than my own check of the vendors' current price pages, so confirm before budgeting. Sources: - [esecurityplanet.com - 7 Best Vulnerability Scanning Tools & Software in 2026](https://www.esecurityplanet.com/networks/vulnerability-scanning-tools/) - [ninjaone.com - Best Vulnerability Scanning Tools: Top 5 in 2026](https://www.ninjaone.com/blog/vulnerability-scanning-tools/) - [blueheadline.com - Best Vulnerability Scanners For Small Businesses In 2026](https://blueheadline.com/cybersecurity/best-vulnerability-scanners-small-business/) - [intruder.io - OpenVAS vs. Nessus: A Comprehensive Analysis](https://www.intruder.io/blog/openvas-vs-nessus) - [cisa.gov - Cyber Hygiene Services](https://www.cisa.gov/cyber-hygiene-services) - [ftc.gov - Free vulnerability scanning for your business](https://www.ftc.gov/business-guidance/blog/2019/12/free-vulnerability-scanning-your-business) - [tech-insider.org - Tenable vs Qualys vs Rapid7: Vulnerability Management 2026](https://tech-insider.org/tenable-vs-qualys-vs-rapid7-2026/) - [cipherssecurity.com - Nessus Alternatives 2026: 8 Scanners Compared](https://cipherssecurity.com/nessus-alternatives-2026/)

Markdown edition · the question page, with every recording · Answer Watch · AEO Watch

Answer Watch records what one AI answer engine said on one date, nothing more. Each page names the engine and the model, carries the date the question was asked, and lists the brands that appeared in the answer in the order the engine gave them, with the sources it cited. It is a measurement, not a ranking, not a recommendation and not a claim about the world. Brands that did not appear in an answer are not named on any public page. Coverage: Claude (Anthropic) with web search. Other engines not included.