Entry 2 - 0xBrendan/Tech-Journal GitHub Wiki

Using Nessus was a very streamlined and "done for you" experience. While the tool was extremely effective in finding vulnerabilities, it felt much more of closed box experience where you lacked the level of granular control that NMAP felt it had. A large concern that Nessus raised for me was in its attempts at active remediation of vulnerabilities found. This seemed to only be the case during a privileged scan, but when scanning a sensitive network, having a program unknowingly modifying and updating software/services can end up being devastating to operations. I have also seen in the past that Nessus has the ability to bring down critical infrastructure for certain servers under very heavy load.

NMAP on the other side of the spectrum operates a lot more in the realm of you really need to know how to properly use the tool to use it effectively. I prefer this approach though, as I feel you learn more from having to understand what you are asking a program to do. This is in contrast to clicking a button and something just working. I also can trust the integrity of the information I am receiving much more if I can understand what is happening and why. With Nessus this feels much more difficult to achieve than with NMAP.