OpenVAS comes up in almost every "do we need to pay for scanning?" conversation, and it earns the mention: it has been the standard open-source vulnerability scanner since it forked from Nessus in 2005, and Greenbone continues to develop it seriously. The comparison with Bastion is genuinely apples-to-oranges, though — and the differences are exactly what makes the decision easy once they are laid out.
What OpenVAS actually is
OpenVAS is the scan engine of Greenbone Community Edition (also called GVM — Greenbone Vulnerability Management). You install it on your own hardware or VM, keep its feed of vulnerability tests updated — the free community feed carries tens of thousands of checks, with a larger enterprise feed sold to businesses — and run scans against IP ranges or hostnames you choose. Scans are active: OpenVAS connects to services, fingerprints versions, and probes for known vulnerabilities, optionally logging into hosts with credentials for authenticated scans that inspect installed packages from the inside. Results are CVE-oriented: findings referencing specific advisories with CVSS scores.
That is a real capability Bastion does not have and does not claim: if you need to know whether the OpenSSH build on an internal host carries a specific CVE, a vulnerability scanner is the tool for that job.
What the vulnerability-scanner model leaves uncovered
- It scans targets you list, from where you run it. OpenVAS tests the hosts you enumerate. It does not discover the subdomains you forgot — certificate transparency monitoring is how those surface, and it is outside a vulnerability scanner's model. Nothing watches for lookalike domains or your own registration lapsing either.
- Domain-layer posture is not the focus. SPF and DMARC policy strength, CAA, security-header policy per hostname, certificate expiry escalation — the layers where most small-organization drift actually happens are thin or absent in a CVE-oriented feed.
- Operating it is a job. Installation on Linux (or the community containers), feed synchronization, scan tuning, false-positive triage, upgrades, and the machine it runs on are all yours. Teams routinely stand up OpenVAS in a sprint of enthusiasm and quietly stop running it two months later — a scanner nobody runs finds nothing.
- Active scanning needs care in production. OpenVAS defaults to safe checks, but it is still probing services, which deserves scan windows and change-control conversations. Passive observation does not.
- Authorization is on you. OpenVAS scans whatever you target — pointing it at infrastructure you do not own is your legal problem. Bastion is built the other way: nothing is scannable until the domain owner proves control via DNS.
What Bastion does instead
Bastion is domain-first and passive. You verify a domain with a TXT record, and from then on scheduled checks watch it from the public internet: TLS and certificate health with escalating expiry warnings, HTTP security headers, SPF/DMARC/CAA, subdomain discovery from certificate transparency logs, lookalike-domain registrations, registration expiry, and TCP connect checks of common ports. Every finding carries evidence, a severity and the fixing change; results roll up into a 0–100 posture score; and changes generate alerts — critical ones immediately, the rest in a weekly digest. There is nothing to install and no feed to maintain, because the maintenance is the product.
Head to head
| Bastion | OpenVAS / Greenbone CE | |
|---|---|---|
| Model | Passive external monitoring + change alerts | Active vulnerability scanning on demand or schedule |
| Depth | Posture and drift: TLS, DNS, headers, exposure | Tens of thousands of CVE checks, incl. authenticated scans |
| Deployment | Hosted — verify a domain, done | Self-hosted: install, feed updates, upgrades, hardware |
| Asset discovery | Subdomains via CT logs, lookalike domains | Scans the targets you enumerate |
| Production safety | Passive — browser-equivalent traffic | Active probes; safe-checks default, windows advised |
| Scope control | DNS ownership proof required before any scan | You choose targets; authorization is your responsibility |
| Ongoing effort | Read the alerts | Operate the scanner, triage, tune false positives |
| Cost | From $25/month | Free (community feed); paid enterprise feed and appliances |
Which one — or both?
If the question is "who is watching the outside of our domains, continuously, without anyone having to remember?" — that is a monitor, and running OpenVAS occasionally does not answer it. If the question is "which of our hosts carry known-vulnerable software versions?" — that is a vulnerability scanner, and Bastion does not answer it. Mature setups often run both: Bastion as the always-on external layer that also catches the assets you forgot, OpenVAS (or a commercial scanner) for scheduled CVE-depth scans of the infrastructure you know about — fed, ideally, by the inventory the external monitor keeps discovering.
The honest budget question is not license cost but operations: OpenVAS is free the way a rescue puppy is free. If your team has the appetite to run it well, it is excellent value. If nobody will own it after month two, an unmaintained scanner is more dangerous than no scanner — it produces the feeling of coverage without the fact of it.
Frequently asked questions
Is OpenVAS still free?
Yes. OpenVAS and Greenbone Community Edition are open source, and the community feed of vulnerability tests is free. Greenbone's business sells an enterprise feed with broader and faster coverage, plus supported appliances. The real cost of the free edition is operational: hosting, feed updates, upgrades and triage time.
Can Bastion replace OpenVAS?
Only if what you actually need is external monitoring rather than vulnerability scanning. Bastion does not run CVE checks or authenticated scans, so it cannot tell you a specific package version is vulnerable. It covers what OpenVAS does not: continuous domain-first watching — subdomain discovery, certificate expiry, DNS and email-auth drift, lookalike domains — with alerts on change and no scanner to operate.
Is OpenVAS safe to run against production systems?
Generally yes with its default safe-checks setting, but it is an active scanner: it connects to services and probes them, which can disturb fragile or embedded systems and will light up intrusion detection. Most teams run it in agreed scan windows. Passive monitoring avoids the question entirely, which is one reason the two tools coexist.
Which should a small team set up first?
Usually the monitoring layer, for the unglamorous reason that it keeps working when the team is busy. A self-hosted scanner delivers value proportional to the attention it gets; an external monitor delivers alerts either way. Add CVE-depth scanning when there is a clear owner for operating it — or when a compliance requirement asks for it explicitly.