New Product Feature: Agent-Based Scanning (Technology Preview)
Agent-Based Vulnerability Management on Your Terms
Scan agentlessly, deploy agents, or combine both. You decide which model fits your infrastructure.
What Is Agent-Based Scanning?
Network vulnerability scans can look at your infrastructure from the outside, probing the network for exposed services. Credentialed scans provide an internal view of an IT system, giving much more insight into potential weaknesses, including exploitable vulnerabilities. For a defense in depth approach to IT security, credentialed scans are a must.
Agent-based scanning is a more advanced form of performing credentialed scans than traditional methods such as using SSH or SMB for remote access to the scan target. Agents are scanning programs installed directly on each device. Having direct access, agents can assess a system’s security from the inside and report back. Think of it as having scans running regularly on every endpoint, rather than periodic remote probes.
Greenbone gives you the choice: scan agentlessly, deploy agents, or combine both. You decide the best model for your infrastructure.
Performance by the Numbers
5,000
Agents per Appliance or Sensor
1 to 2x/day
Recommended Reporting Interval (up to 60 sec possible)
~80 MB
Idle Memory Footprint
$0
Extra Cost, Included in Asset Count
Common Issues Faced by Remote Scanning
Blocked Network Segments
Network segments often block inbound scan traffic by default, leaving entire zones invisible to scanners.
Centralized Credentials at Risk
Centralized SSH/SMB credentials for authenticated scanning are a high-value target for attackers.
Network Load From Remote Access
Remote access to many systems at once adds noticeably to network congestion across large infrastructures.
Distributed Teams Out of Reach
Distributed teams sit outside the scan radius of traditional network tools and simply can’t be reached.
Agent-Based vs. Network Scanning vs. SSH/SMB
Different approaches cover different ground. Here’s how they compare.
| Criterion | Network Scan | SSH / SMB Auth Scan | Agent-Based Scanning |
|---|---|---|---|
| Deep local vulnerability checks | None | Full |  Extended beyond script-based checks |
| Works without inbound network access | No | No | Yes |
| Scan time and reporting | Time consuming | Time consuming | Within seconds |
| Centralized credentials required | No | Yes | No |
| Works for remote-premises devices (e.g., laptops) | No | No | Yes |
| Works across network segments | Complex setup required | Complex setup required | Yes |
Endpoint Scanning: Agentless. Agents. Hybrid. You Decide.
Greenbone is designed around your operational reality. If compliance constraints, PAM policies, or network topology drive your choices, we have a solution for your needs.
Network Scanning
Proven External Visibility
Classic, unauthenticated scanning from the outside, no installation on the target system and no stored credentials required. Covers exposed services but provides no insight into local vulnerabilities.
Classic, unauthenticated scanning from the outside, no installation on the target system and no stored credentials required. Covers exposed services but provides no insight into local vulnerabilities.
Endpoint Agents
Deep Endpoint Visibility
Agents deliver vulnerability data from within scan targets, with an extended depth beyond SSH/SMB local security checks, without the credential overhead or network dependency.
Agents deliver vulnerability data from within scan targets, with an extended depth beyond SSH/SMB local security checks, without the credential overhead or network dependency.
Hybrid Mode
Complete Coverage
Combine scanning modes to suit the needs of your IT topography. Get comprehensive coverage across a wide range of network architectures without compromise, from a single security platform.
Combine scanning modes to suit the needs of your IT topography. Get comprehensive coverage across a wide range of network architectures without compromise, from a single security platform.
Already using CyberArk or another PAM solution for remote authenticated scans? We support that too. Agents are an option, not a requirement.
Why More Teams Are Choosing Agents
Greenbone has long supported SSH and SMB remote access for credentialed scans. Agents take that capability further: delivering endpoint visibility with less friction, less risk, and more frequency.
Reduced Scan Time
Agents report software inventory and vulnerability state regularly, on your schedule, delivering results within seconds instead of waiting on a scheduled remote scan.
No Centralized Credentials
Agents use local user privileges and push data straight to OPENVAS SCAN. A central credential cache, a favorite attack target, becomes unnecessary.
Works in Restricted Networks
Agents only ever open outbound connections, moving data easily across network segments even behind standard firewalls and complex proxies.
Lower Resource Consumption
Agents use around 80 MB of RAM when idle and generate light network traffic, noticeably lighter than traditional credentialed scans.
Extended Visibility vs. Network Scans
Agents see what a local user sees: software inventory, registry state, configs, and patch status, detecting risks that network-only tools simply cannot see.
Coverage Beyond the Perimeter
Assets and employees are often spread out geographically. Agents follow the endpoint, so every managed device stays in scope regardless of where it is.
Built for Modern, Secure Vulnerability Management
Agent-based scanning solves real operational challenges that traditional agentless credentialed scans weren’t designed for.
Restricted Network Environments
Agents call back: no inbound scanning needed.
OT networks and high-security zones often block inbound scan traffic by policy. Agents work strictly outbound, typically with no architectural changes required.
OT networks and high-security zones often block inbound scan traffic by policy. Agents work strictly outbound, typically with no architectural changes required.
PAM-Protected Environments
We adapt to your compliance policy.
Where PAM policy blocks agents on certain systems, keep using traditional credentialed remote scans there. Both models run side by side.
Where PAM policy blocks agents on certain systems, keep using traditional credentialed remote scans there. Both models run side by side.
Fast-Moving Dev and Cloud
Quick visibility into endpoint security.
Containerized environments and rapid deployments easily outpace scheduled scan cycles. Agents deliver quick vulnerability data as systems spin up and change.
Containerized environments and rapid deployments easily outpace scheduled scan cycles. Agents deliver quick vulnerability data as systems spin up and change.
Large, Complex Networks
Monitor up to 5,000 endpoints at once.
Running credentialed scans across thousands of assets isn’t efficient. Agents replace the network overhead with lightweight, persistent telemetry, cutting infrastructure costs.
Running credentialed scans across thousands of assets isn’t efficient. Agents replace the network overhead with lightweight, persistent telemetry, cutting infrastructure costs.
Distributed, Remote Teams
Visibility beyond your corporate network segments.
Employees working from home, co-working spaces, or abroad sit outside your scanning perimeter. Agents keep full visibility on those endpoints, regardless of connection.
Employees working from home, co-working spaces, or abroad sit outside your scanning perimeter. Agents keep full visibility on those endpoints, regardless of connection.
Talk to our team and find out which scanning model fits your infrastructure.
Lightweight by Design With Efficient Capability
Agent-based scanning is engineered for low resource consumption on production IT systems: under 100 MB disk space, minimal CPU, and a lean memory footprint.
< 100 MB
Disk Space
Minimal
CPU Usage
Lean
Memory Footprint
No Extra Cost. No Surprise Licenses.
Agent-based scanning is available to all customers on the new licensing model at no additional charge. Agents count toward your existing asset quota: even if an endpoint is also detected in a network scan, it counts as a single asset. Other vendors charge separately for agent deployments. We don’t.
- Included in the new license model
- No separate agent licensing fees
- Counts as one asset even if also network-scanned
- Available for Windows and Linux now
Technology Preview: Agent-based scanning is an early-access capability for evaluation ahead of general availability and is not intended for production use. You can find the full definition in the manual, and you are also pointed to it when you enable the feature in the GOS menu. The feature is part of OPENVAS SCAN and will also be included in OPENVAS SECURITY INTELLIGENCE once that product becomes available. It is not a separate product and can be enabled directly from your GOS menu.
Frequently Asked Questions About Agent-Based Scanning
Do I have to use agents, or can I keep using network-based scanning?
Agents are an option, not a requirement. Agent-based scanning is optional: if traditional credentialed scanning works for you, including environments where PAM policies restrict agent deployment, you can continue exactly as before. Mixed approaches also work within a single OPENVAS SCAN instance.
What's the difference between an agent and an SSH/SMB authenticated scan?
Both produce the same class of local endpoint vulnerability data. The key differences are that agent-based scanning runs continuously and reports faster than a scheduled scan, agents don’t require centralized credential storage, and they initiate outbound connections rather than waiting for an inbound scan session, making them significantly simpler to deploy in restricted environments.
How does agent counting work in the license?
Each agent-managed endpoint counts as a single asset against your license quota. If the same endpoint is also discovered by a network scan, it still counts as one asset. There are no additional per-agent fees on top of your existing subscription.
Does the agent require outbound internet access or just access to OPENVAS SCAN?
Agents call back to your OPENVAS SCAN instance, not to an external Greenbone cloud endpoint. This means the agent only needs outbound network access to your internal OPENVAS SCAN deployment, making it more compatible with typical firewall configurations.
What platforms are supported today?
Windows 10, Windows 11, Server 2016, Server 2019, Server 2022, and Server 2025, and major Linux distributions including Ubuntu 22.04, 24.04, and 26.04 LTS, Debian 11, 12, and 13, RHEL 8, 9, and 10, and SUSE Linux Enterprise Server 15 and 16.
Does agent-based scanning cover the same products as an authenticated scan?
Agent-based scanning detects all applications on the device, more than an authenticated scan would, regardless of whether a vulnerability is present. That said, an authenticated scan will still detect more vulnerabilities than the agent, since some Enterprise feed content is exempted from agent-based checks: for example, products an agent is unlikely to be installed on, such as switches and routers, as well as tests meant to be carried out remotely over the network, such as non-credentialed banner-based tests and active checks.
Get Expert Advice on Agent-Based Scanning
Talk to our team to see how agent-based scanning integrates with your existing vulnerability management setup: agentlessly, with agents, or both.
Already a Greenbone customer? Enable the feature directly from your GOS menu.
