A scanner can only report a weakness it has a test for, which seemed worth checking rather than assuming. I counted how many of the 1,725 flaws on the US government's list of known exploited vulnerabilities, as it stood on 25 September 2026, have a test in two free scanners, Nuclei and OpenVAS.
71% have a test in at least one of the two, but only 35% have a test that works from the network without a login, which is the situation most people are actually scanning in, and 29% have no test in either. Coverage is weakest exactly where it matters most: edge devices from Cisco, Fortinet, Citrix and SonicWall feature heavily in recent attacks, and the free OpenVAS feed leaves many of those vendors to its paid version. Many of the most exploited flaws were also attacked before any fix or test existed, so no scanner could have found them in time.
It's worth keeping the scale in proportion. Exploiting a software flaw is how attackers got in for roughly 20% to 33% of intrusions with a known entry route in the major incident reports; stolen passwords, phishing and other routes account for the rest, and a scanner doesn't look for any of those. Commercial scanners and CISA's scanning service also find listed vulnerabilities in very large numbers. A 2023 report by a competing vendor implies two commercial scanners had tests for 87% and 89% of the list as it then stood, 892 entries, though it doesn't say how it counted and it isn't independent. More tellingly, in the published incident cases the scan had missed part of the network or nobody patched in time. A missing test was rarely the cause.
So free scanners without logins miss a lot of what attackers exploit, and nothing catches a zero-day. That doesn't make scanning worthless. Once a flaw is public, scanning finds much of it, and the bigger failures are what gets scanned and how fast fixes actually happen.