Compliance frameworks do not all ask security teams to test their systems in the same way.
PCI (News - Alert) DSS separates vulnerability scanning from penetration testing. DORA requires digital operational resilience testing and, for certain financial entities, Threat-Led Penetration Testing (TLPT). NIS2 requires organizations to assess the effectiveness of their cybersecurity measures, while ISO 27001 expects technical vulnerabilities to be identified, evaluated, and addressed.
For teams dealing with several frameworks, the challenge is working out which testing method and evidence each one requires. One scanner will rarely cover everything.
What the frameworks require
PCI DSS: Requirement 11.3 covers internal and external vulnerability scanning. External scans under 11.3.2 must be performed through a PCI SSC Approved Scanning Vendor (ASV), while internal scanning has separate requirements. Requirement 11.4 covers penetration testing, including internal and external testing at least annually and after significant infrastructure or application changes. PCI DSS v4.0.1 is now fully in effect, including the requirements that became mandatory on March 31, 2025.
Buying a vulnerability scanner from a company that also operates an approved ASV service does not make an independently run scan an ASV scan. The external scan has to go through the approved process and receive the required ASV attestation.
SOC 2: CC7.1 covers the detection and monitoring of changes that could introduce vulnerabilities. Vulnerability scanning is commonly used as evidence, but the AICPA Trust Services Criteria do not set a universal monthly or quarterly scanning schedule.
ISO 27001: Annex A 8.8 covers the management of technical vulnerabilities. Organizations need to collect information about vulnerabilities, assess their exposure, take action, and keep evidence of the work. The standard does not prescribe a particular scanner.
HIPAA: 45 CFR 164.308(a)(1)(ii)(A) mandates an accurate and thorough assessment of risks and vulnerabilities affecting electronic protected health information. It does not specifically require vulnerability scanning or penetration testing. The proposed update to the Security Rule would change that, requiring vulnerability scanning at least every six months and penetration testing at least once a year. For now, those requirements have not been finalized as of September 2026.
NIS2: Article 21(2)(f) requires organizations to have policies and procedures for assessing whether their cybersecurity risk-management measures are effective. It does not name penetration testing as the required method.
DORA: Financial entities in scope must carry out digital operational resilience testing. Article 26 requires financial entities identified for advanced testing to carry out TLPT at least every three years.
How well each tool fits depends on the type of testing required and the evidence it leaves behind.
Qualys (News - Alert) VMDR / Enterprise TruRisk Management
Qualys can run authenticated and unauthenticated scans using scanner appliances or Cloud Agents. VMDR handles the scanning and helps teams prioritize the results, while Enterprise TruRisk Management brings that work into a broader exposure management program. TruRisk scoring and compliance reporting can be used to track findings through remediation and provide records for audit review.
Qualys is an Approved Scanning Vendor, but its ASV status applies to the approved PCI scanning service. Running VMDR internally does not satisfy PCI DSS 11.3.2. External reports for that requirement must go through the Qualys PCI process and receive ASV review and attestation.
Best fit: Organizations covering PCI DSS alongside ISO 27001 or SOC 2 and looking for vulnerability management across a large asset base.
Gap: An ASV scan does not replace the separate penetration testing required under PCI DSS 11.4.
Nessus / Tenable
Nessus supports credentialed vulnerability scanning as well as configuration and compliance checks. Tenable's current plugin database contains more than 442,000 plugins.
Tenable holds ASV accreditation for its PCI scanning service. An ordinary Nessus scan run in-house does not satisfy PCI DSS 11.3.2. Official attestation goes through Tenable's PCI ASV offering.
Nessus is built around scheduled and point-in-time assessments. Teams that need findings tracked through a wider remediation process will need other systems or Tenable products around it.
Best fit: Teams that need detailed credentialed scanning and configuration assessment, particularly where Nessus is already part of the security program.
Gap: Independently run Nessus scans do not carry ASV attestation.
Rapid7 InsightVM
InsightVM scans through engines or agents, giving teams the option of regular scans or ongoing assessment. Its Active Risk score draws on CVSS as well as sources such as CISA's Known Exploited Vulnerabilities catalog, AttackerKB, Metasploit, and ExploitDB to help decide which findings need attention first.
Dashboards and remediation workflows keep a record of findings after the initial scan and track their progress toward remediation.
Rapid7 uses third-party ASV MegaplanIT for external PCI scans and attestation. Because ASV approval applies to a specific scanning solution, organizations using InsightVM should check that their external scans go through the approved Rapid7/MegaplanIT service before treating them as evidence for PCI DSS 11.3.2.
Best fit: Teams that want ongoing vulnerability assessment that features remediation tracking and risk prioritization.
Gap: Detection and prioritization do not replace penetration testing where a framework requires it.
Pentest-Tools.com
Pentest-Tools.com combines discovery and vulnerability scanning with automated exploitation across networks, web applications, and cloud environments, including internal networks via VPN.
Sniper Auto-Exploiter tests selected vulnerabilities and records evidence when exploitation succeeds, including full exploitation console output, system and network details, extracted files, and an exploitation summary with a network graph. Findings go into editable DOCX penetration test reports, reducing manual confirmation work for internal security teams and MSP/MSSPs, useful in PCI DSS 11.4 testing, where a vulnerability scan alone is not enough.
Its Vulnerability & Exploit Database shows how CISA KEV listing, EPSS score, and CVSSv3 are combined to prioritize findings.
Pentest-Tools.com is not an Approved Scanning Vendor and cannot replace the external ASV scan and attestation required under PCI DSS 11.3.2.
Best fit: Internal security teams and MSP/MSSPs that need scanning and evidence from confirmed exploitation across networks, web applications, and cloud environments.
Gap: Exploit validation provides evidence for the penetration test, but does not, by itself, satisfy every part of the PCI DSS 11.4 testing requirement.
Invicti
Invicti focuses on web applications and APIs. It supports authenticated scanning and uses Proof-Based Scanning to verify certain vulnerabilities.
For findings it can verify, teams have evidence that the vulnerability is exploitable rather than another unconfirmed scanner result. This can reduce the validation work around application and API findings.
Its coverage stops at the application layer. Network and host-level compliance testing requires another scanner.
Best fit: Teams that need application and API vulnerability evidence for ISO 27001 or as part of PCI testing.
Gap: Web and API coverage only.
Greenbone / OpenVAS
Greenbone/OpenVAS provides self-hosted vulnerability scanning through the Community Edition, while Greenbone's commercial products use the Enterprise Feed. Authenticated scanning is one of its strengths, particularly for teams that need information about software and configuration on internal systems. It is a practical option for vulnerability identification under ISO 27001 Annex A 8.8 where self-hosting or budget is a priority.
Both feeds are updated regularly, but they do not have the same coverage or guarantees. The Enterprise Feed includes additional vulnerability tests and compliance content, while the Community Feed comes without an SLA for availability.
OpenVAS does not independently confirm exploitability. Risk decisions, remediation records, and evidence that a vulnerability was fixed have to be handled elsewhere.
Best fit: Teams that want self-hosted authenticated scanning for ISO 27001 or other risk-based compliance programs and have the resources to manage it.
Gap: No built-in exploit confirmation, and Community Feed users do not get the same vulnerability coverage, compliance content, update frequency, or support guarantees as Enterprise customers.
What an auditor will want to see
A scan report shows what was found at a particular point in time, but an auditor wants to know what happened to those findings afterward.
That includes the risk decision, the ticket or change record showing what was done, and a later scan or test confirming the fix.
As evidence, auditors typically expect timestamped scan reports (scope, tool, authenticated/unauthenticated, severities), a clear prioritization rationale, per-finding remediation records (owner, SLA, resolution/exception), and re-verification results.
Qualys and Rapid7 have risk scoring and remediation workflows for tracking findings after discovery. Pentest-Tools.com can provide exploitation evidence for selected vulnerabilities and scan diff notifications showing which findings were remediated between scans, while Invicti can verify certain web and API findings, while Invicti can verify certain web and API findings. Nessus and Greenbone provide detailed scan results, with more of the follow-up handled elsewhere.
These differences are important when audit evidence is needed. Under PCI DSS, a vulnerability scan cannot stand in for the penetration testing required under 11.4. ISO 27001 expects organizations to show what they did about the technical vulnerabilities they identified. HIPAA leaves more freedom over how risks and vulnerabilities to ePHI are assessed.
Match the tool to the framework
The tools on this list cover different parts of that work. For PCI DSS, that could mean an ASV service for external scans alongside separate penetration testing. For ISO 27001, the focus may be on finding vulnerabilities, recording the risk decision, and showing that they were addressed. Other frameworks leave more room for the organization to decide how testing is done.
Compare that with what the scanner covers and what it records. An organization subject to PCI DSS, ISO 27001, and DORA, for example, should not expect the same scan report to cover all three.
That may mean using more than one tool, particularly where ASV scanning, infrastructure assessment, and penetration testing sit under different requirements.
