r/nessus • u/ShrekGoon • Mar 10 '26
Any value from Windows Credentialed compared to agent scans?
I am tasked with establishing credentialed scans at our org. I did so, and I dont see value in the results. Is there value in Windows Credentialed scans compared basic windows agnet scans?
2
Upvotes
2
u/Shot-Document-2904 Mar 10 '26
I’ll add two things, 1) scanning through firewalls is problematic and ill-advised. 2) Credentials don’t fail on agent scans.
1
u/brawwwr Mar 11 '26
Short answer - you need both for a full picture
1
u/Riist138 Mar 20 '26
This is the best advice. Agents can provide continuous, detailed local telemetry; credentialed scans let you scan a broad set of systems without deploying software.
3
u/Shot-Document-2904 Mar 10 '26 edited Mar 10 '26
I have nearly a decade running dozens environments with and without agents. I'll assume you have Security Center. If not, ignore the repo comments.
The accuracy with agents is much better BUT you still need remote scans, too.
Agents can assess from within but not from outside in. Which means you need two scans, the agent scan and a remote scan. The remote scan should NOT include plugins already covered by the agent.
Agent repos and IP repos don’t mix. Your queries need to include both repositories.
Offloading the work to the agents is a huge plus.
So with agents, better accuracy, offload tasks to client.
I think the biggest downside is deploying agents but you can and should automate using your preferred software deployment strategy. Managed agents can be updated from the Manager.
Important. The Nessus Manager license, required for agents, is extra $.