What Claude (Anthropic) with web search answered for vulnerability scanning tools (small businesses) on 2026-09-25

Claude (Anthropic) with web search claude-opus-5 asked 2026-09-25

Coverage: Claude (Anthropic) with web search. Other engines not included.

The question asked, verbatim: best vulnerability scanning tools for small businesses

Brands named, in the order the engine gave

1. Intruder recommended
   Intruder - My default pick for a small business without a dedicated security person.
2. Tenable Nessus recommended
   Tenable Nessus (Essentials, then Professional) - The industry workhorse and the best free starting point.
3. Nessus Essentials recommended
   Nessus Essentials is free for up to 16 IPs, which covers a lot of small offices outright.
4. CISA recommended
   CISA's free vulnerability scanning (CyHy) - Genuinely free, run by the US government for private businesses and critical infrastructure.
5. US recommended
   CISA's free vulnerability scanning (CyHy) - Genuinely free, run by the US government for private businesses and critical infrastructure.
6. Qualys Community Edition recommended
   Qualys Community Edition - Free for 16 internal IPs, 3 external IPs, and 1 web app URL.
7. OpenVAS recommended
   OpenVAS / Greenbone Community Edition - Free and open source, unlimited hosts.
8. OpenVAS / Greenbone recommended
   OpenVAS / Greenbone Community Edition - Free and open source, unlimited hosts.
9. OpenVAS / Greenbone Community Edition recommended
   OpenVAS / Greenbone Community Edition - Free and open source, unlimited hosts.
10. Invicti recommended
    Invicti (or Burp Suite Pro) - Only if you build and ship your own web application.
11. NinjaOne mentioned
    - Best Vulnerability Scanning Tools: Top 5 in 2026 - NinjaOne (https://www.ninjaone.com/blog/vulnerability-scanning-tools/)

Sources the engine cited

The answer, as recorded

Here's what I'd actually recommend, roughly in the order I'd try them: **1. Intruder** - My default pick for a small business without a dedicated security person. It's cloud-hosted (nothing to install), scans your internet-facing assets continuously, and filters out noise so you get a short list of things that actually matter rather than a 400-page CVE dump. Plans run roughly $260-$500/month depending on cloud vs. hybrid coverage, with a free tier and a 14-day trial. The tradeoff: it's opinionated and you have less low-level control. **2. Tenable Nessus (Essentials, then Professional)** - The industry workhorse and the best free starting point. **Nessus Essentials is free for up to 16 IPs**, which covers a lot of small offices outright. If you outgrow it, Professional is ~$2,190/year per scanner for unlimited IPs. Deepest plugin coverage of anything here; expect to do more tuning and triage yourself. **3. CISA's free vulnerability scanning (CyHy)** - Genuinely free, run by the US government for private businesses and critical infrastructure. You sign up, they continuously scan your internet-facing assets and email you reports. It's not a replacement for a real scanner (external-only, no internal network view), but it costs nothing and there's no reason not to layer it underneath whatever else you pick. **4. Qualys Community Edition** - Free for 16 internal IPs, 3 external IPs, and 1 web app URL. Best free option if you want cloud-hosted with zero maintenance overhead and a mature asset-inventory view. The full VMDR product is enterprise-priced (easily $10k+/year at 1,000 assets), so treat Community Edition as a standalone free tool, not an on-ramp. **5. OpenVAS / Greenbone Community Edition** - Free and open source, unlimited hosts. The right call if you have someone technical who doesn't mind running a VM and tuning scans - it sidesteps Nessus Essentials' 16-IP ceiling entirely. Costs you setup time instead of license fees. Greenbone's paid Basic appliance is ~€2,500/year if you want support. **6. ManageEngine Vulnerability Manager Plus** - Worth a look specifically if you want *scanning plus patching* in one tool. For a small shop where the same person finds and fixes the problem, collapsing those into one workflow is often more valuable than having a better scanner. **7. Invicti (or Burp Suite Pro)** - Only if you build and ship your own web application. The tools above scan infrastructure; they won't find SQL injection in your own code. Invicti is DAST + IAST with low false positives; Burp Suite Pro is far cheaper if someone on the team will drive it manually. **Practical path:** start with Nessus Essentials for internal scanning + CISA's free service for external monitoring - that's $0 and covers most small businesses. Move to Intruder when the manual triage becomes the bottleneck, or to OpenVAS if you blow past 16 IPs before you have budget. One caveat: a scanner produces findings, not security. The bottleneck for most small businesses isn't finding vulnerabilities - it's having someone who patches them. Budget time for remediation before budgeting for a tool. Sources: - [8 Top Vulnerability Scanning Tools for 2026 - Intruder](https://www.intruder.io/blog/the-top-vulnerability-scanning-tools) - [Intruder Pricing | Plans & Bolt-ons](https://www.intruder.io/pricing) - [Nessus vs. Qualys vs. OpenVAS - InfosecTrain](https://www.infosectrain.com/blog/nessus-vs-qualys-vs-openvas) - [Nessus vs OpenVAS: Which Vulnerability Scanner to Choose (2026) - Secably](https://secably.com/blog/nessus-vs-openvas-which-vulnerability-scanner-to-choose-in-2026/) - [Free vulnerability scanning for your business - Federal Trade Commission](https://www.ftc.gov/business-guidance/blog/2019/12/free-vulnerability-scanning-your-business) - [Qualys Community Edition - Help Net Security](https://www.helpnetsecurity.com/2018/09/06/qualys-community-edition/) - [Best Vulnerability Scanning Tools: Top 5 in 2026 - NinjaOne](https://www.ninjaone.com/blog/vulnerability-scanning-tools/) - [7 Best Vulnerability Scanning Tools & Software in 2026 - eSecurity Planet](https://www.esecurityplanet.com/networks/vulnerability-scanning-tools/)

Markdown edition · the question page, with every recording · Answer Watch · AEO Watch

Answer Watch records what one AI answer engine said on one date, nothing more. Each page names the engine and the model, carries the date the question was asked, and lists the brands that appeared in the answer in the order the engine gave them, with the sources it cited. It is a measurement, not a ranking, not a recommendation and not a claim about the world. Brands that did not appear in an answer are not named on any public page. Coverage: Claude (Anthropic) with web search. Other engines not included.