What Claude (Anthropic) with web search answered for vulnerability scanning tools (small businesses) on 2026-10-18

Claude (Anthropic) with web search claude-opus-5 asked 2026-10-18

Coverage: Claude (Anthropic) with web search. Other engines not included.

The question asked, verbatim: best vulnerability scanning tools for small businesses

Brands named, in the order the engine gave

1. Nessus recommended
   Nessus Essentials (free) / Nessus Professional (~$3,600-4,400/yr)
2. Nessus Essentials recommended
   Nessus Essentials (free) / Nessus Professional (~$3,600-4,400/yr)
3. Nessus Professional recommended
   Nessus Essentials (free) / Nessus Professional (~$3,600-4,400/yr)
4. Professional recommended
   Nessus Essentials (free) / Nessus Professional (~$3,600-4,400/yr)
5. Intruder mentioned
   Intruder (~$149/mo entry)
6. Qualys Community Edition mentioned
   Qualys Community Edition (free, limited) or paid VMDR
7. Community Edition mentioned
   Qualys Community Edition (free, limited) or paid VMDR
8. Astra Security mentioned
   Astra Security
9. Probely mentioned
   Probely or Pentest-Tools.com - for web apps specifically
10. Pentest-Tools.com mentioned
    Probely or Pentest-Tools.com - for web apps specifically
11. OpenVAS / Greenbone mentioned
    OpenVAS / Greenbone Community Edition (free, open source)
12. OpenVAS / Greenbone Community Edition mentioned
    OpenVAS / Greenbone Community Edition (free, open source)
13. Malwarebytes mentioned
    G2's small-business "vulnerability scanner" category ranks Malwarebytes, Sophos, and ESET at the top, but those are AV/EDR products with scanning features - don't buy one expecting a vulnerability management program, or vice versa.
14. Tenable Nessus compared
    - G2 - Intruder vs Tenable Nessus (https://www.g2.com/compare/intruder-vs-tenable-nessus)

Sources the engine cited

The answer, as recorded

Here's what I'd actually recommend, roughly in the order I'd try them: **1. Nessus Essentials (free) / Nessus Professional (~$3,600-4,400/yr)** The default starting point. Essentials scans up to 16 IPs free, which covers a lot of genuinely small shops, and it's the same engine the paid product uses. Downside: it's a scanner, not a program - you get findings, not prioritization or workflow, and the learning curve is steeper than the SaaS options. Note the Pro license doesn't include web-app, cloud, or external attack-surface scanning. **2. Intruder (~$149/mo entry)** The one I'd point a small business with no dedicated security person toward. Transparent pricing, near-zero setup, continuous external scanning with emerging-threat rescans, and it filters noise instead of dumping a 400-page CSV on you. About 60% of its reviews come from small businesses, which tells you who it's built for. **3. Qualys Community Edition (free, limited) or paid VMDR** Worth it if you want the deepest coverage and best compliance reporting, and the free tier handles 16 assets. But pricing is quote-only and the console is genuinely enterprise-shaped - it rewards someone who'll invest time in it. **4. Astra Security** Good middle path if you want human eyes, not just automation - automated scanning plus analyst-assisted pentests and compliance-ready (SOC 2, ISO, PCI) reports. The right pick if a customer or auditor is the reason you're scanning. **5. Probely or Pentest-Tools.com - for web apps specifically** If your real risk surface is a web app or API rather than a network, the general scanners above will underperform. Probely is the cleaner DAST product; Pentest-Tools.com is cheaper and more à-la-carte. **6. OpenVAS / Greenbone Community Edition (free, open source)** Only if you have someone technical who enjoys this. Capable engine, genuinely free, but you own the maintenance, tuning, and false positives. **Two things worth saying beyond the tool choice:** Vulnerability scanning isn't the same as endpoint protection. G2's small-business "vulnerability scanner" category ranks Malwarebytes, Sophos, and ESET at the top, but those are AV/EDR products with scanning features - don't buy one expecting a vulnerability management program, or vice versa. Most small businesses need both. Also, if you're scanning anything you don't own outright - a hosted platform, a client's infrastructure - get written authorization first, and check your provider's policy. Most cloud hosts permit scanning your own assets; scanning beyond them can breach terms of service or worse. If I had to pick one blind: **Intruder** if nobody's job title includes "security," **Nessus** if someone's does. Sources: - [G2 - Vulnerability Scanner, Small Business](https://www.g2.com/categories/vulnerability-scanner/small-business) - [G2 - Intruder vs Tenable Nessus](https://www.g2.com/compare/intruder-vs-tenable-nessus) - [Astra - Vulnerability Scanning for SMBs](https://www.getastra.com/blog/dast/vulnerability-scanning-for-smbs/) - [eSecurity Planet - SMB Vulnerability Scanners](https://esecurityplanet.com/?p=27566) - [Intruder - Top Vulnerability Scanning Tools](https://www.intruder.io/blog/the-top-vulnerability-scanning-tools) - [Ciphers Security - Nessus Alternatives 2026](https://cipherssecurity.com/nessus-alternatives-2026/) - [Pentest-Tools.com pricing (G2)](https://www.g2.com/products/pentest-tools-com/pricing)

Near this answer

The same question, recorded on other dates: 2026-10-16, 2026-10-14, 2026-10-11, 2026-10-09, 2026-10-06, 2026-10-03, 2026-10-01, 2026-09-29, 2026-09-27, 2026-09-25, 2026-09-23.

vulnerability scanning tools, asked for other audiences: remote teams (asked 2026-10-18).

Other categories with a recorded answer: backup and recovery software, cloud hosting providers, compliance automation software, data loss prevention software.

Markdown edition · JSON record · the question page, with every recording · Answer Watch · AEO Watch

Answer Watch records what one AI answer engine said on one date, nothing more. Each page names the engine and the model, carries the date the question was asked, and lists the brands that appeared in the answer in the order the engine gave them, with the sources it cited. It is a measurement, not a ranking, not a recommendation and not a claim about the world. Brands that did not appear in an answer are not named on any public page. Coverage: Claude (Anthropic) with web search. Other engines not included.