How to read a Nessus scan report (and turn it into a client report)

The short version:

• Check scope and credential status before reading a single finding.
• Nessus severity comes from CVSS; it says how bad a flaw could be, not how likely it is to be used.
• Rank known exploited vulnerabilities (CISA KEV) first, then work down by severity and exposure.
• Hand the client actions, not plugin counts. Keep the raw detail as an appendix.

Why a raw Nessus report confuses clients

Nessus is built to be thorough. A routine scan of a 50-device office can return thousands of plugin results, including hundreds of informational items, many duplicates of the same missing patch across hosts, and a severity summary dominated by red. That output is accurate, but it answers the scanner's question (what did I detect?) rather than the client's question (what should we do this month?).

Reading a Nessus report well means separating three things: what the scan could see, what it found, and which of those findings deserve attention first. The rest of this guide takes them in that order.

Step 1: confirm what the scan could see

Before reading findings, look at the scope. A short list of clean-looking hosts can simply mean the scan never logged in.

• Targets and dates. Compare the scanned host list with the client's asset list. Missing hosts are a coverage gap, not good news.
• Plugin 19506, Nessus Scan Information. Every host has one. Its output shows the scanner version, plugin feed date, scan policy and whether credentialed checks ran.
• Plugin 21745, Authentication Failure — Local Checks Not Run. Its presence means the scanner could not log in and fell back to a network-only view of that host.
• Plugin feed date. An old feed misses recent vulnerabilities. Note the date in the report so the client knows how current the checks were.

Rule of thumb A host with credential failures should be reported as partially assessed. Presenting it beside fully credentialed hosts, with fewer findings, makes it look safer than it is. See credentialed vs non-credentialed scans.

Step 2: understand severity, CVSS and VPR

Nessus assigns each plugin a severity of Critical, High, Medium, Low or Info. That severity is derived from the CVSS base score of the underlying vulnerability, using the standard bands:

CVSS base score to severity

• Critical: 9.0 to 10.0
• High: 7.0 to 8.9
• Medium: 4.0 to 6.9
• Low: 0.1 to 3.9
• Info: No vulnerability; context such as open ports or detected software

Tenable products also show a Vulnerability Priority Rating (VPR), Tenable's own threat-weighted score. VPR is useful inside Tenable, but it is proprietary, so it cannot be explained or reproduced outside that ecosystem. For a client report, public signals travel better: CVSS for impact, EPSS and CISA KEV for likelihood.

Step 3: read a finding properly

Each Nessus finding is a plugin result on a host and port. The fields that matter most for a report:

• Plugin ID and name. The stable identifier. Many plugins roll up several CVEs, for example a single "Microsoft Windows security update" plugin can cover dozens.
• Plugin output. The evidence: the installed version, the file path, the registry key or the banner the scanner saw. Always read this before calling something a false positive.
• Solution. Tenable's remediation text, usually "upgrade to version X or later" or a link to a vendor advisory.
• CVE and CVSS references. Present on most vulnerability plugins; absent on configuration findings such as weak TLS ciphers, which are real issues without a CVE.
• Exploit available. A flag that public exploit code or a framework module exists. It raises likelihood but is not the same as confirmed exploitation in the wild.

Group findings by remediation, not by plugin. Twenty plugins about one outdated browser are one action for the client: update the browser.

Step 4: decide what goes first

A defensible order for client work looks like this:

1. Vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog, especially those with known ransomware use.
2. Critical findings (CVSS 9.0 or above) on systems reachable from the internet.
3. Other Critical and High findings, grouped by the patch or upgrade that fixes them.
4. Configuration findings without a CVE that still carry real risk, such as end-of-life software or weak remote access settings.
5. Low and informational items, kept as context.

This is close to the six priority bands Varaxon Scan Hub applies automatically. Band membership is calculated by code from the export and KEV data, so it is the same every time and can be explained line by line.

Step 5: export the right file

Nessus can export results as a .nessus file, CSV, HTML or PDF. Only the .nessus file is a complete, machine-readable record: it is XML containing the targets, the policy settings (with passwords stripped) and every result with its plugin output. CSV is convenient for spreadsheets but flattens structure; HTML and PDF are for reading.

If you plan to build a client deliverable, export the .nessus file. The export-to-report guide covers the equivalent choice for other scanners.

Turning the scan into a client report

A client report built from a Nessus scan should open with a short summary of the handful of actions that matter, in business language, then show the scope, the prioritized actions with owners and dates, and finally the technical appendix. The report template guide lists every section.

Varaxon Scan Hub does this from the .nessus file directly: it ranks the findings, groups them into remediation actions, writes the summary and keeps every statement tied to plugin evidence. Download the sample Nessus report to see the output.

Common questions

What file format does Nessus export?

Nessus exports scan results as a .nessus XML file, CSV, HTML and PDF. The .nessus file is the complete machine-readable export and the best input for any reporting tool.

What is plugin 19506 in Nessus?

Plugin 19506, Nessus Scan Information, records the scanner version, plugin feed date, scan policy and whether credentialed checks ran on each host. Check it first to confirm the scan's coverage.

Is Nessus severity the same as risk?

No. Nessus severity comes from the CVSS base score, which measures how severe a flaw could be in general. Risk also depends on whether the flaw is being exploited, how exposed the system is and how important it is to the business.

This guide first appeared on varaxontech.com.

I'm building Varaxon Scan Hub. It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan Founder, Varaxon Technologies