First, the PVS "sees" information passing between devices that might be hidden behind firewalls and unavailable to active scanners. Second, since PVS is running all the time, it collects and reports vulnerability information between active scans. This can be very useful when creating reports.
The PVS, in order to be truly useful, requires the Tenable Security Center. The Security Center acts as a correlation device and, more important, provides the displays and reporting that give the product its real strength. These displays and reporting allow the PVS to combine its findings with those of active scanners and host-based scanners to give a full picture of the enterprise’s vulnerabilities.
Beyond traditional views of vulnerabilities, however, there is concern about insider abuse. This is a powerful capability in the PVS.
Documentation for PVS is clear and useful. Additionally, there are many supporting documents on the Tenable website, and the Tenable blog offers considerable insight into how to deploy Tenable products most effectively.
Reporting is comprehensive and there are many templates, from the developer and the user community. In general, we found the Tenable Passive Vulnerability Scanner to be a novel and useful tool. Coupled with other tools it adds an important dimension to vulnerability testing, reporting and compliance monitoring.
The PVS is not cheap. However, the addition of the Nessus active scanner is a no cost option, so a complete active/passive security management tool set comes in at US$39,895 for 500 IP addresses. Given that the benefits of this suite are significant, we find that a reasonable price.
We rate PVS Recommended for its powerful approach to compliance and general network vulnerability monitoring.
Passive Vulnerability Scanner has been rated Recommended by SC Magazine.
For: Powerful addition to active scanners.
Against: Requires Security Center to be effective.
Verdict: An important addition to any organization’s active scan regimen, critical for compliance monitoring. Recommended.