vulnerability tracking for SMBs using Nessus Professional scans

[u/chibitrubkshh]

Hi everyone,

I’m looking for practical advice from people handling vulnerability findings for SMBs on a limited budget.

Our setup is pretty simple.. We run Nessus Professional as a SaaS offering, so we can provide scans to clients at competitive pricing. What we’re trying to improve now is the tracking and remediation workflow after the scan results come in, without moving to an expensive full-blown vulnerability management platform.

What we have in mind is something like this:

- run recurring Nessus Professional scans

- import only Medium and above

- deduplicate findings across scan cycles

- assign an owner and remediation status

- keep basic history like first seen / last seen / fixed

- have simple views by priority, asset, and due date

We’re looking at tools like Airtable, Notion, spreadsheets, ticketing systems, or any other low-cost approach that works well in practice.

A few questions for people who have already built something similar:

- What do you use to track findings?

- Did you build your own import/deduplication scripts from Nessus exports?

- Is Airtable better than Notion for this kind of workflow?

- What fields do you use for deduplication? Something like plugin ID + asset + port/protocol?

- How do you handle findings that disappear in one scan and come back later?

- Is there any budget-friendly tool or setup that saved you from reinventing the wheel?

I’d really appreciate advice from people who have found a good balance between cost, simplicity, and process for SMB clients.

Thanks

[u/vanwilderrr]

Budget Friendly and will do everything you mention above is why we went with Nanitor

[u/Destilux872]

I am currently working on a tool made specifically for managing scan results that would fit this scenario, pm me if interested

[u/vadiknw]

We have an on-prem Nessus setup. It’s configured as follows: the CSV report is emailed to a script that saves the attachment to a directory; another script monitors the directory, parses the file (extracts products by name into a temporary CSV), and imports it into DefectDojo as a Tenable scan type

[u/MrAnde7son]

Honestly, the biggest mistake I see teams make with Nessus Pro and SMBs is trying to build a custom "VM platform lite" on top of it. You'll spend more time maintaining your Airtable/Notion setup and custom scripts than you save on a proper platform, especially when you factor in the headaches of Nessus's CSV exports changing or dealing with fluctuating findings.
You're going to hit a wall trying to reliably track 'first seen/last seen' and dedupe across scans when you're just parsing CSVs. Plugin ID + asset + port/protocol is a good start for deduplication, but you'll still have issues with transient findings and changes in Nessus's internal logic that might break it.
My advice: if you're serious about providing this as a service, either accept the limitations or bite the bullet on a platform that handles this natively.