OpenVAS Scheduled Scanning

Use this automated version of the hosted OpenVAS Vulnerability Scanner to monitor your Internet facing systems, and be alerted to changes on your servers, firewall or border routers. Vulnerability Scans can be scheduled for weekly or monthly testing.

Configure Automated OpenVAS Vulnerability Scans
PRO or Business Membership Required

PRO or BUSINESS Plan is required to use the automated OpenVAS Scanner. Immediate access is available to new members or login now if you have a valid membership.


  • Discover vulnerabilities in Internet facing systems, where attackers may be able to exploit the vulnerability to gain access to the system.
  • Detect configuration errors that can leave systems vulnerable to exploitation.
  • Simplify your Vulnerability Scanner management, the servers are regularly updated so that you always have the latest signatures to discover new vulnerabilities as they are released.


Additional Information

Selecting Your Targets

Using this automated Vulnerability Scanner you are able to scan a single IP address 192.123.x.x, a hostname scanme.nmap.org or a range of IP addresses 192.168.0.0/24. It is also possible to schedule a list of targets in one hit using the bulk add option as noted below.

If you wish to target a range of IP addresses you may use the format 192.168.1.1-50 or in CIDR 192.168.1.0/24. This can be up to a full /24 net block. 254 IP addresses are the maximum amount that can be scanned on one scan profile.
Warning: Please ensure any subnets do not overlap onto targets you do not have permission to scan.

Adding targets in bulk
Multiple targets can be added by submitting a list of targets. All targets from list will have scan properties as selected in the form. It is not possible to add both IPv4 and IPv6 targets as a list (create two lists). Note that adding multiple targets with different labels is possible by having the list contain comma separated values.

Example csv for adding a list of targets

192.168.1.1,target1-label
192.168.1.2,target2-label
192.168.1.3
192.168.1.4,target4-label

Determining the number of available Scans

The number of IP addresses that can be scanned is based on a monthly quota. If you wish to scan a full Class C net block, then this can be performed every month or a smaller block of 64 addresses could be scanned every week (64 x 4 weeks in month = 256 monthly).

Time of Scheduled Scans

The scans can be scheduled for any hour during the day. Port scans are then queued on that hour, and will run in sequence. If you scheduled 20 scans for 13:00 UTC they will not all run simultaneously right on 13:00, they will be queued at 13:00 and run as scan servers are available.

Viewing Results and Status

The status is determined by comparing two most recent OpenVAS scans. The scans can be initiated manually through the web interface or launched as part of a scheduled scan operation. The comparison of the results is performed by comparing csv of the results and determining if there is a difference in the discovered vulnerabilities or CVSS score.

No Change This indicates the previous two scans are identical.
Changed This indicates there is a difference in results of the previous two scans.
No Data There is not enough data to determine the status (there are not two results available for comparison).
Running An OpenVAS scan is currently running, progress will be indicated in the table above.
Queued The scan is currently queued to run when the next available server is available.
Error There was a problem running the scan, try again or contact support if this continues

Results are delivered to the user in an email, depending on the user selected email option in the scan profile. If a user chooses to receive results every time then an email is dispatched following the completion of the scan, otherwise emails are only sent if a change is detected in the scan results. All results are also able to be viewed through the web interface.

Warning about Security Monitoring

A vulnerability scan is an intrusive scan that will create a large amount of noise on the network against the targeted system. It is important you understand that this scan will take place regularly and that any security monitoring in place is aware of the source IP addresses of our scanners (List of Scanners). Security teams must be aware that this testing is being configured against a system that they are responsible for, otherwise they may detect the scanning as an attack against the organisation.