Tenable shipped Nessus 10.12.4 on August 19, 2026, and the free Nessus Essentials tier that ships with it still confuses people who learned the product years ago. Older guides insist the free edition scans up to 16 IP addresses. Tenable’s current product page and its 10.12 documentation both say five. That single number changes how you plan a home lab, a small-office audit, or a certification study environment, and it’s the first thing this tutorial sets straight before walking through a full install.
This guide covers registering for an activation code, installing Nessus Essentials on Windows, Linux, or macOS, running a credentialed scan, reading CVSS and VPR scores correctly, and automating the whole workflow with the Nessus REST API. It also covers where the free tier stops working for you and what a step up to Nessus Essentials Plus, Nessus Professional, or an open-source alternative like OpenVAS actually costs in 2026.
Twelve steps, five-plus code blocks, and a full home-lab project sit between here and a working scanner. Whether you’re studying for a certification, doing your first authorized assessment of your own home network, or evaluating Nessus before recommending a paid tier to your employer, the process below assumes zero prior experience with vulnerability scanning and walks through every screen you’ll actually see.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Nessus Essentials Actually Gives You for Free in 2026
Nessus Essentials is Tenable’s no-cost edition of its commercial vulnerability scanner, built on the same scan engine and plugin architecture as Nessus Professional and Nessus Expert. Tenable’s own documentation describes it plainly: “This free tier features high-speed asset discovery and vulnerability scanning for up to five IP addresses with a 30-day delayed plugin feed.” That delayed feed matters more than most tutorials admit — Essentials receives the same plugin checks as paid Nessus editions, just roughly a month after Tenable’s commercial customers get them.
The five-IP cap is a hard ceiling per scanner instance, not a rolling monthly quota. If you scan five hosts on Monday and five different hosts on Tuesday, you’ve used ten distinct targets against a five-IP license, and Nessus will block the scan. Tenable also now sells Nessus Essentials Plus, a new low-cost annual license positioned above Essentials: it raises the ceiling to 20 IPs, drops the 30-day plugin delay for real-time updates, and adds basic PDF/HTML reporting. Verified students and instructors can claim a free one-year Essentials Plus license for coursework through Tenable’s education program.
For a home lab, a single subnet audit, or prepping for a certification like Security+ or eJPT, five IPs is workable. For anything resembling a small-business network assessment, you’ll hit the wall inside the first hour and need to either rotate targets deliberately or budget for Essentials Plus, Professional, or an alternative scanner. Vulnerability scanning is one piece of a larger defensive posture, alongside patch management, network segmentation, and the kind of threat monitoring covered across our broader cybersecurity coverage.
Prerequisites: Versions and System Requirements
Before you download anything, confirm your host machine actually meets Tenable’s published requirements. Undersized VMs are the single most common cause of scans that hang or time out, and it’s a five-minute check that saves an hour of troubleshooting later.
| Requirement | Minimum | Recommended | Notes |
|---|---|---|---|
| Nessus version | 10.12.4 (current) | 10.12.4 | Released August 19, 2026, per Tenable’s documentation index |
| CPU | 2 cores, 2 GHz | 4 cores, 2 GHz | Tenable’s baseline for scans up to 50,000 hosts; Essentials’ 5-IP scope needs far less |
| RAM | 4 GB | 8 GB | Higher RAM speeds up plugin compilation on first launch |
| Disk space | 30 GB free | 40+ GB free | Excludes host OS; does not include scan results, plugin updates, or logs |
| Operating system | Current Windows, Linux, or macOS release | Latest patched build | Check Tenable’s system requirements page before installing on an older OS build |
| Network access | Outbound HTTPS (443) to Tenable | Direct internet, no proxy | Required for activation and plugin feed updates |
You’ll also need a web browser to reach the local Nessus interface (it runs on https://localhost:8834 by default), an email address for registration, and — if you plan to run credentialed scans, which you should — a low-privilege service account on the systems you’re targeting. Full details on the 30-GB baseline and per-OS breakdowns are on Tenable’s system requirements page.
Running Nessus inside a virtual machine is the most common setup for a home lab, and it works fine as long as you allocate resources honestly rather than accepting a hypervisor’s default. A VM configured with 2 vCPUs and 2 GB of RAM will technically boot Nessus, but plugin compilation on first launch can stretch past an hour and scans against even a single host may stall. Bump the allocation to 4 vCPUs and 8 GB before you start, and thin-provision the disk at 40 GB or more so you’re not fighting for space after your first few scans and plugin updates accumulate. If you’re running security software like an endpoint agent or a strict host firewall on the same machine, add an exception for the Nessus service and port 8834 — antivirus tools occasionally flag the scanner’s own port-probing behavior as suspicious, which can silently degrade scan accuracy without throwing an obvious error.
Step 1–2: Register and Download the Right Package
Go to the Nessus Essentials product page and fill out the registration form with your name and a valid email address. Tenable’s instructions are exactly as blunt as the product itself: “Complete the registration form at the top of this page and follow the prompted steps for Nessus download and installation.” Within a few minutes you’ll get an email containing your activation code — save it somewhere durable, because you’ll need it again if you ever reinstall or move Nessus to a new machine.
From the same download page, pick the package that matches your host OS:
- Windows: a
.exeinstaller - Linux (Debian/Ubuntu): a
.debpackage - Linux (RHEL/Fedora/CentOS): an
.rpmpackage - macOS: a
.dmgdisk image containing an installer.pkg
Match the architecture (x86_64 vs. ARM) to your hardware too — installing the wrong build is a common early mistake that produces a service that won’t start at all.
The activation email sometimes lands in a spam or promotions folder, especially if you registered with a work email behind aggressive filtering — check there before assuming the registration failed. If you don’t see it within about fifteen minutes, the registration page also offers a resend option rather than making you fill out the form a second time. It’s worth registering with an email address you’ll still control a year from now; Tenable ties the activation code to that address, and recovering it later means logging into Tenable’s account portal rather than simply re-reading an old email.
Step 3–4: Install and Launch Nessus Essentials
On Windows, run the .exe with administrative privileges, accept the license agreement, choose an install directory (the default is fine for most setups), and let the installer finish. It registers the Nessus service automatically and opens your browser to the local interface when done.
On Debian-based Linux, install the package and start the service manually:
sudo dpkg -i Nessus-10.12.4-debian10_amd64.deb
sudo systemctl start nessusd
sudo systemctl enable nessusd
sudo systemctl status nessusdOn RPM-based distributions, swap the install command but keep the same service steps:
sudo rpm -ivh Nessus-10.12.4-es8.x86_64.rpm
sudo systemctl start nessusd
sudo systemctl enable nessusdOn macOS, open the .dmg, double-click Install Nessus.pkg, and follow the standard macOS installer prompts. Nessus runs as a background service and, again, serves its interface over HTTPS on port 8834.
Whichever OS you used, open a browser and navigate to https://localhost:8834 (or the machine’s IP address if you installed on a headless server or VM you’re accessing remotely). Your browser will flag the self-signed certificate as untrusted — that’s expected for a local scanner, and you can safely proceed past the warning on a machine you control.
If the page never loads at all, confirm the service actually started before troubleshooting anything else. On Windows, open Services (services.msc) and look for “Tenable Nessus” in a Running state; on Linux and macOS, the systemctl status nessusd command from above should show active (running) rather than failed or inactive. A fresh install occasionally needs sixty to ninety seconds after the installer finishes before the web server is actually listening, so a blank or connection-refused page immediately after installation isn’t necessarily a real problem — wait a minute and refresh before digging into logs.
Step 5: Activate Nessus and Create Your Admin Account
On first load, Nessus asks you to choose a product type. Select Nessus Essentials, paste in the activation code from your registration email, and click through to create your administrator username and password. Use a real password manager entry here, not a throwaway string — this account has full control over scan configuration and results on the box.
Once activated, Nessus downloads and compiles its plugin feed. On a fresh install this typically takes anywhere from five to twenty minutes depending on your connection and CPU, and you’ll see a progress indicator in the interface. Don’t interrupt this step — a partial plugin compile is one of the more annoying things to recover from cleanly.
This is also the point where Nessus asks whether to enable plugin auto-updates — leave that on. Given that Essentials already runs roughly 30 days behind the paid feed, manually forgetting to refresh plugins on top of that built-in delay means scanning against checks that are two or three months stale by the time you actually run them. If you’re setting up Nessus on a machine that will sit powered off between study sessions, get in the habit of checking the plugin feed status the moment you boot it back up, before you trust any scan results from that session.
Step 6: Tour the Web Interface
While plugins compile, take a minute to orient yourself. The left-hand navigation splits into My Scans (your saved and completed scans), All Scans, Policies (reusable scan configuration templates), and Plugin Rules. The top-right corner shows your license type, IP count used against your five-IP cap, and a link to Tenable’s plugin feed status. Bookmark that license indicator — it’s the fastest way to check how much headroom you have left before you accidentally lock yourself out mid-audit.
Step 7–8: Create and Launch Your First Basic Network Scan
Click New Scan, then choose the Basic Network Scan template — Tenable’s general-purpose starting point for discovering hosts and checking them against the full plugin catalog. Give the scan a descriptive name (for example, “Home-Lab-Baseline-Sept2026”), and in the Targets field enter the IP addresses, hostnames, or CIDR range you want to assess. For a first run, target a single machine or a small range you fully control — never scan infrastructure you don’t own or have explicit written permission to test.
If you’re scanning a subnet rather than a known host list, Tenable’s own guidance is worth following before you commit scanner time to a full assessment: “In larger or dynamic networks, Tenable recommends doing discovery prior to undertaking a full vulnerability scan of a large subnet(s).” Run a lightweight host discovery scan first, confirm which IPs actually respond, then build your five-IP target list from real, live hosts instead of guessing at a range. If you’d rather do that discovery pass outside Nessus entirely, a dedicated port scanner works just as well for mapping live hosts before you commit any of your five IP slots — see our guide to network scanning with Nmap for that exact workflow.
Save the scan, then click the launch (play) icon next to it in the My Scans list. A Basic Network Scan against a single host typically completes in under ten minutes; a full five-IP scan with all plugin families enabled can run considerably longer depending on how many services each host exposes.
Step 9: Set Up a Credentialed Scan for Real Results
An unauthenticated network scan only sees what’s visible from outside — open ports, banner-grabbable service versions, and misconfigurations exposed over the wire. A credentialed scan logs into the target with an account you provide and inspects installed software, missing patches, local configuration, and registry or file-permission issues that no amount of external probing will ever surface. Tenable is explicit about the gap between the two approaches: “Tenable recommends performing fully authenticated assessments wherever possible; these provide up to 45 times more findings and insights than uncredentialed assessments.”
To add credentials, edit your scan (or create a new one from the same Basic Network Scan template), open the Credentials tab, and choose the relevant type — SSH for Linux/Unix targets, Windows for domain or local accounts, or SNMP for network gear. For SSH, a key-based login is preferable to a password; for Windows, a domain account with local admin rights on the target (or membership in a scoped scanning group) gives Nessus the visibility it needs. Create a dedicated, least-privilege scanning account rather than reusing a personal or shared admin login — it makes audit trails cleaner and limits blast radius if the credential ever leaks.
Two platform-specific details trip up almost everyone the first time. On Windows targets, Nessus needs File and Printer Sharing enabled and the Remote Registry service running, along with administrative share access (C$/ADMIN$) — a locked-down workstation with those services disabled will reject the scan even with a valid admin password. On Linux targets, if the scanning account isn’t root, you’ll need to grant it passwordless sudo access to the specific commands Nessus runs, or configure privilege escalation directly in the Credentials tab under the SSH settings rather than trying to scan as an unprivileged user and wondering why local checks come back empty.
Step 10: Read Results — CVSS, VPR, and Severity Explained
Once a scan finishes, Nessus groups findings by host and by severity. Under the hood, it can score vulnerabilities using CVSS v2.0, CVSS v3.0, CVSS v4.0, or EPSS, and new installations default to CVSS v3 where a plugin supports it. Severity buckets map to standard CVSS score ranges, defined by the Forum of Incident Response and Security Teams (FIRST) and tracked centrally by the National Vulnerability Database.
| Severity | CVSS v3 range | What it usually means | Typical response window |
|---|---|---|---|
| Critical | 9.0 – 10.0 | Remote code execution or full compromise with no user interaction | Same day to 48 hours |
| High | 7.0 – 8.9 | Significant impact to confidentiality, integrity, or availability | 1–2 weeks |
| Medium | 4.0 – 6.9 | Exploitable under specific conditions or with prerequisites | 30 days |
| Low | 0.1 – 3.9 | Limited impact or requires significant attacker effort | Next patch cycle |
| Info | 0.0 | Configuration detail or informational finding, not a vulnerability | Review as needed |
Nessus also surfaces Tenable’s own Vulnerability Priority Rating (VPR) alongside CVSS. Don’t treat VPR as a replacement for CVSS — CVSS measures technical severity in a vacuum, while VPR layers in threat intelligence like active exploitation and exploit-kit availability to help you decide what to patch first when you can’t patch everything at once. A Medium-CVSS finding with a high VPR because it’s being actively exploited in the wild deserves more urgency than a High-CVSS finding sitting unexploited for years.
Click into any finding to see the plugin output, affected port, CVE references, and Tenable’s suggested remediation — usually a specific patch, configuration change, or vendor advisory link.
Not every Info-severity item is noise, and not every finding needs the same urgency you’d give a Critical. An Info finding that reveals a full OS and kernel version banner is low-risk on its own, but combined with a High finding for an outdated service on the same host, it tells an attacker exactly which known exploits to try first — read findings on a host together, not purely as an isolated severity list. If a specific plugin result looks wrong for your environment (a false positive on a custom-built service, for instance), you can suppress it for that host under Plugin Rules rather than re-triaging the same non-issue every time you re-scan.
Step 11: Schedule Recurring Scans and Keep Plugins Current
A one-time scan is a snapshot; a scheduled scan is a program. Edit any saved scan, open the Schedule tab, toggle it on, and set a frequency — weekly is a reasonable default for a home lab or small environment. Remember that Essentials’ plugin feed lags roughly 30 days behind paid editions, so a newly disclosed critical CVE may not show up in your Essentials scan results as quickly as it would on Professional or Expert. That delay is the tradeoff for a free license, and it’s worth flagging explicitly if you’re using Essentials for anything beyond learning or a personal lab. It’s also a good reason not to treat Nessus as your only source of patch intelligence — cross-reference major vendor patch cycles directly, like our coverage of a recent Microsoft Patch Tuesday release, so a scanner’s feed lag never becomes your only warning about a critical, actively exploited flaw.
You can also trigger a manual plugin update from the command line if the GUI feels slow to refresh:
# Linux/macOS
sudo /opt/nessus/sbin/nessuscli update --all
# Check current plugin feed status
sudo /opt/nessus/sbin/nessuscli fetch --check-auto-updateStep 12: Export Reports and Build a Remediation Workflow
From a completed scan, click Export and choose a format — HTML and PDF work well for sharing with non-technical stakeholders, while CSV and Nessus’s native .nessus XML format are better suited to feeding results into a ticketing system, spreadsheet, or a second tool for tracking remediation over time. A minimal but effective workflow looks like this: export findings, triage by CVSS/VPR combined, assign each Critical and High finding an owner and a due date, re-scan the same targets after patches land, and confirm the finding actually clears rather than just assuming the patch worked.
That re-scan step is the part most beginners skip, and it’s the one that actually closes the loop — a vulnerability scanner that never verifies its own findings got fixed is just generating reports nobody acts on.
If you’re using Nessus in a small IT team rather than solo, the .nessus export is worth learning even if you never touch the API — it’s structured XML that a second analyst, a GRC tool, or a simple script can parse without re-running the scan themselves. Pair each exported finding with three fields at minimum: an owner, a target remediation date based on the severity table above, and a re-scan date. That’s a lightweight enough process to run in a spreadsheet for a five-IP Essentials setup, and it’s the same shape of workflow that scales up to a full ticketing-system integration once you outgrow the free tier.
Common Pitfalls When Setting Up Nessus Essentials
- Scanning more than five distinct IPs across a week. The license blocks new targets once you hit the cap, and it doesn’t reset until you free up a slot by removing an old target from your scan history — plan your target list before you start, not during.
- Skipping host discovery before scanning a whole subnet. Pointing Nessus at a /24 without checking which hosts actually respond wastes scanner time and can silently burn through your five-IP allowance on dead addresses.
- Running only unauthenticated scans. As covered above, credentialed scans surface dramatically more findings — an Essentials setup that never adds credentials is leaving most of its value on the table.
- Scanning targets you don’t have explicit permission to test. Even on a free tool, port scanning and vulnerability scanning without authorization can violate computer-fraud laws or your ISP’s acceptable-use policy. Stick to hardware you own or a deliberately provisioned lab environment (Metasploitable, a VulnHub VM, or similar).
- Ignoring the 30-day plugin delay. Treating an Essentials scan as proof a network has no critical exposure to a vulnerability disclosed last week is a false sense of security — the plugin for it may not have arrived yet.
- Installing on an undersized VM. Below the 4 GB RAM minimum, plugin compilation can stall for hours or fail outright, and scans against even a single host can time out.
- Losing the activation code. It’s tied to your registered email, but retrieving it again means digging through Tenable’s account portal — save it in a password manager the day you receive it.
Troubleshooting: 8 Nessus Essentials Problems and Fixes
1. Plugin feed update fails or hangs. Check outbound HTTPS (443) connectivity from the host to Tenable’s servers, confirm any corporate proxy is correctly configured in Nessus’s advanced settings, verify system disk space, and make sure the system clock is accurate — a clock skew of more than a few minutes can break TLS validation during the update.
2. Activation code rejected. Double-check for copy-paste whitespace or a mistyped character, confirm you’re entering an Essentials code into an Essentials install (not a Professional or trial code), and verify the scanner can actually reach Tenable’s activation servers over the network.
3. Scan times out before finishing. Reduce the target scope, confirm the hosts are actually reachable (a simple ping or port check first), check whether a firewall between the scanner and target is silently dropping probe packets, and reduce the number of concurrent checks in the scan’s Performance settings if the scanner itself is resource-constrained.
4. Nessus web interface won’t load at localhost:8834. Confirm the nessusd service is actually running (systemctl status nessusd on Linux), check that nothing else is bound to port 8834, and try accessing via 127.0.0.1:8834 instead of localhost if DNS resolution is the issue.
5. Credentialed scan shows “Unable to log in” even with correct credentials. For Windows targets, confirm the account has the necessary remote administration rights and that File and Printer Sharing / WMI aren’t blocked by a local firewall rule. For SSH, confirm the account can actually log in interactively outside of Nessus first, and that key permissions are set correctly (600) if you’re using key-based auth.
6. “License limit exceeded” error mid-scan. You’ve hit the five-IP Essentials cap. Go to Settings, review which IPs are currently counted against your license, and remove stale or test targets you no longer need before adding new ones.
7. Scan results show far fewer findings than expected. This is almost always an unauthenticated scan against a well-patched or firewalled host. Add credentials (Step 9) before assuming a target is genuinely clean.
8. Nessus service won’t start after a Linux package upgrade. Check the service logs at /opt/nessus/var/nessus/logs/ for a specific error, confirm the install completed without a dependency conflict, and try a manual restart with sudo systemctl restart nessusd followed by journalctl -u nessusd -n 50 to see the most recent startup errors.
Output Example: What a Finished Scan Summary Looks Like
A typical completed Basic Network Scan against a single moderately patched Linux host produces a results screen resembling this breakdown:
Scan: Home-Lab-Baseline-Sept2026
Status: Completed
Host: 192.168.1.42
Vulnerabilities found: 27
Critical: 0
High: 2 (outdated OpenSSH version, missing kernel patch)
Medium: 6 (weak TLS cipher suites, self-signed cert)
Low: 9 (informational service banners, SNMP defaults)
Info: 10 (open port enumeration, OS fingerprint)
Scan duration: 6m 42s
Plugins used: full family set (credentialed)The two High findings are where you start: an outdated SSH daemon and a missing kernel patch are exactly the kind of remotely exploitable issues Nessus exists to catch, and both typically have a direct, low-risk fix (update the package, reboot into the patched kernel).
Advanced Tips: API Automation and Scan Tuning
Nessus exposes a REST API on the same port as the web interface, which means you can trigger scans and pull results programmatically instead of clicking through the GUI every time. First, generate an API key pair from your user profile in Settings, then authenticate and launch a scan by ID:
curl -k -X POST "https://localhost:8834/scans//launch" \
-H "X-ApiKeys: accessKey=; secretKey="
# Check scan status
curl -k -X GET "https://localhost:8834/scans/" \
-H "X-ApiKeys: accessKey=; secretKey=" This is enough to drop a scan trigger into a cron job or a CI pipeline step that scans a staging environment before every deploy. Nessus itself only assesses hosts and networks you point it at directly — it has no visibility into cloud-native threats like anomalous IAM activity or compromised access keys, so treat it as one layer of coverage rather than the whole picture. If part of your footprint lives in AWS, pairing scheduled Nessus scans of your self-managed servers with a service like AWS GuardDuty for continuous cloud threat detection closes a gap that a host-based scanner alone can’t. A few other tuning tips worth knowing once the basics are working:
- Narrow plugin families for faster scans. If you only care about web-facing issues, disable unrelated plugin families (like local Windows registry checks on a Linux-only target list) to cut scan time significantly.
- Use the “Host Discovery” template before a full scan on unfamiliar ranges to build an accurate target list without burning your IP allowance on unresponsive addresses.
- Tag and compare scan history over time rather than treating each scan as a one-off — the trend line (are findings going up or down month over month) is often more useful than any single scan’s absolute count.
- Set a scan window rather than “any time” if you’re scanning production-adjacent systems, even in a lab. Aggressive plugin checks can occasionally trip an IDS/IPS rule or briefly spike CPU on an older device, so scheduling scans for low-traffic hours is good practice even when you’re the only user on the network.
One more automation option worth knowing about: Tenable also publishes an official Nessus Docker image, which is useful if you want a disposable, reproducible scanner instance for a CI pipeline instead of a persistent VM — spin it up, register and activate it with the same activation code, run the scan via API, and tear it down when the job finishes. If you’re managing the scanner itself remotely — say, a Nessus instance running on a home server you access while traveling — a zero-config mesh VPN is a cleaner way in than opening port 8834 to the wider internet; our Tailscale setup guide covers getting that running in about the same amount of time as this Nessus install.
Nessus Essentials vs. Professional, Expert, and Open-Source Alternatives
Once five IPs and a 30-day plugin delay stop being enough, you have a genuine decision to make between staying inside the Tenable product family or switching tools entirely.
| Product | 2026 price | IP / asset limit | Plugin feed | Best for |
|---|---|---|---|---|
| Nessus Essentials | Free | 5 IPs | 30-day delayed | Learning, certification study, tiny home labs |
| Nessus Essentials Plus | Low-cost annual (free for verified students/educators) | 20 IPs | Real-time | Hobbyists and students needing ongoing coverage |
| Nessus Professional | $4,790/year | Unlimited | Real-time | Professional pentesters, MSPs, small-to-mid IT teams |
| Nessus Expert | $6,790/year | Unlimited + external attack surface | Real-time | Consultants needing external ASM and web app scanning |
| Greenbone/OpenVAS | Free (community); paid appliances available | Unlimited (self-managed) | Community feed | Budget-conscious teams comfortable self-hosting |
| Qualys VMDR | Custom quote, asset-based | Unlimited (licensed) | Real-time | Enterprise, cloud-native asset inventories |
| Rapid7 InsightVM/Nexpose | Custom quote, asset-based | Unlimited (licensed) | Real-time | Enterprise, strong remediation-workflow integration |
Nessus Expert adds web application scanning and external attack-surface visibility on top of everything Professional includes, which is why it commands roughly a $2,000-a-year premium — see Tenable’s Expert product page for the current feature breakdown. Greenbone’s community edition of OpenVAS remains the closest free alternative with no IP cap, at the cost of a rougher setup process and a less polished interface than Nessus. Qualys and Rapid7 both price by asset count through a custom quote rather than a flat annual license, so get a current quote directly rather than relying on a number from an older comparison article — enterprise vulnerability-management pricing shifts constantly with deal size and add-on modules. Full current Nessus pricing tiers are on Tenable’s buy page, and the FAQ covering license limits in detail is at Tenable’s Nessus FAQ.
Nessus is a network and host scanner, not a web application security tool, even on the Expert tier’s attack-surface features. If application-layer testing — SQL injection, cross-site scripting, broken authentication flows — is part of what you need to cover, pair Nessus with a dedicated web app scanner rather than expecting network-focused plugins to catch it. Our OWASP ZAP setup guide covers the free, open-source option most teams reach for first.
Complete Working Project: A Home Lab Vulnerability Assessment
Here’s how all twelve steps come together in a realistic, self-contained project you can run this weekend on hardware you own.
Setup: A hypervisor (VirtualBox or VMware Workstation Player, both free for personal use) running two VMs — one Nessus Essentials install on a Linux VM with 8 GB RAM allocated, and one deliberately vulnerable target VM downloaded from VulnHub or Metasploitable, isolated on a host-only or NAT network so it never touches the wider internet.
This project takes roughly 90 minutes end to end and exercises every core skill the rest of this tutorial covers — installation, credentialed scanning, severity triage, and remediation verification — without touching a single IP address outside your own machine.
Frequently Asked Questions
Is Nessus Essentials really free forever, or is it a trial?
Nessus Essentials is a genuinely free, non-expiring license tier, not a time-limited trial. The tradeoffs versus paid editions are the five-IP scan cap and the roughly 30-day-delayed plugin feed, not a countdown to when the product stops working.
Does Nessus Essentials support 16 IP addresses like some older guides say?
No — that figure is outdated. Tenable’s current product page and its 10.12 documentation both state a five-IP limit for Essentials as of September 2026. The 20-IP tier now belongs to the newer Nessus Essentials Plus license, not standard Essentials.
Can I scan targets outside my own network with Nessus Essentials?
Only with explicit written authorization from the network owner. Scanning systems you don’t own or haven’t been authorized to test can violate computer-fraud laws regardless of which scanner you use. Stick to owned hardware or dedicated lab environments like VulnHub or Metasploitable VMs.
Why does my credentialed scan find so many more issues than my unauthenticated one?
Unauthenticated scans can only assess what’s visible from the network, like open ports and exposed banners. Credentialed scans log into the host and inspect installed packages, patch levels, and local configuration directly, which is why Tenable’s own guidance points to authenticated assessments surfacing dramatically more findings than network-only checks.
What’s the difference between a CVSS score and a VPR score in Nessus?
CVSS is an industry-standard technical severity score maintained by FIRST and tracked by the NVD. VPR is Tenable’s own prioritization score that layers real-world threat intelligence, like active exploitation, on top of a vulnerability’s technical severity. Use CVSS to understand how bad a flaw is in theory, and VPR to help decide what to fix first in practice.
Should I upgrade to Nessus Professional or switch to OpenVAS instead?
If you need unlimited assets, real-time plugin updates, and vendor support, Nessus Professional at $4,790 a year is the straightforward upgrade path with zero migration friction from Essentials. If budget is the primary constraint and you’re comfortable managing your own infrastructure, Greenbone’s OpenVAS community edition is free with no IP cap, though it takes more setup effort and lacks Nessus’s polish.
Why did my plugin feed update suddenly stop working?
The most common causes are blocked outbound HTTPS traffic, a misconfigured proxy, an inaccurate system clock breaking TLS validation, or insufficient disk space. Check connectivity to Tenable’s servers and your system clock first — those two account for the majority of update failures.
Can I automate Nessus Essentials scans with scripts or CI pipelines?
Yes. Nessus exposes a REST API on the same port as its web interface, so you can generate an API key pair and trigger scans or pull results with a tool like curl or a script, which makes it straightforward to fold into a cron job or a pipeline step ahead of a deployment.
Related Coverage
- Cloudflare Turnstile Setup: 13 Steps, Free vs $8/Mo [2026]
- Tailscale Zero-Trust VPN Setup: 13 Steps, Free Tier [2026]
- AWS GuardDuty Setup: 13 Steps, $662/Mo at 800GB [2026]
- Google Account Passkey Setup: 13 Steps, 40 Min [2026]
- Migrate Passkeys on Android: 12 Steps, 4 Apps Only [2026]
