I've used it at a couple places. It's pretty good. It's best at checking the box on an audit to say you have a vulnerability management program.

If you want real coverage, you should also be actively involved in what's in your company's environment, and how security updates (for external software) and vulnerabilities (for internal) are handled. That is, do you have people looking for vulnerabilities, e.g. with fuzzing?

For Windows environments, you should additionally look at bloodhound and pingcastle.

It is a requirement for all of the military projects I’ve worked on. Specifically ACAS which has Nessus as a component.

For a solo person doing scans for clients I think the cost is like $2k. Seems fine but I wouldn’t buy it without a guarantee I’d get my money out of it.

There is one other product I’ve tried from greenbone. Never used it professionally. Idk if I would trust it at the same level as Nessus.

@redfox I've used Tenable for a LONG time. Pretty much their entire suite of products. Cost in the enterprise is going to vary on how many endpoints you have and what solutions you need.

As for effectiveness. I think it it has been and continues to be VM/scanning best of breed. Security Center specifically is highly extensible. It should be easy enough to get started with though may take some time to build out more advanced things.

Alts include Qualys and Rapid7.

Paging @tecnobabble

I’ve used Tenable Nessus Professional, and Tenable Security Center and both work well in their categories. Nessus Professional is a portable Nessus scanner a security person can take with them to do adhoc scans. Security Center (aka Tenable.sc) is a vulnerability management solution for an enterprise.

Their competition is Rapid7 and Qualys, but I can’t speak to those myself.