Free Vulnerability Scanner for Windows
A lightweight agent for Windows 10, Windows 11, and Windows Server that finds known vulnerabilities in the operating system and in installed applications, then names the update that fixes each one. 200 endpoints free forever, commercial use allowed.
What the free scanner shows you
A live TridentStack Control demo on sample data. Pick a scene or let it play. There are no paid add-ons: everything shown here is included free for your first 200 endpoints.
Every CVE in the fleet, narrowed to CISA's Known Exploited list, then to critical severity.
What a Windows vulnerability scanner has to get right
On Windows, a vulnerability lives in one of two places. The first is the operating system itself, where the answer depends on the exact build and which monthly updates are installed. The second is everything installed on top of it: browsers, archivers, runtimes, remote-access tools, and drivers. A scanner that checks only one of those leaves most of the real exposure unreported.
The other thing that matters is where the scanner looks from. A network scanner sees a Windows machine from outside, so it reports what it can infer from open ports unless you hand it administrator credentials. An agent on the machine reads the installed build, the installed updates, and the software inventory directly, so its findings are based on what is there.
Free vulnerability scanners for Windows, compared
The main free ways to find vulnerabilities on Windows machines today, checked against each source page.
| Tool | Free limit | How it scans | Ties to patching | The catch |
|---|---|---|---|---|
| TridentStack Control | 200 endpoints, forever | Agent on each endpoint, continuous | Yes | $5/endpoint/mo past 200, commercial use fine |
| Action1 | 200 endpoints, forever | Agent on each endpoint, continuous | Yes | DISA STIG configuration is a paid add-on; quote-based past 200 |
| Nessus Essentials (Tenable) | Up to 5 IPs, 30-day license | Network scan you launch, point-in-time | No | Non-commercial use only; 30-day-delayed feed; no reporting or export on free |
| OpenVAS / Greenbone CE | Free/OSS, no seat cap | Network scan from a scanner you host | No | Community Feed only; the free appliance drops schedules, notifications, and backups; forum support |
| Wazuh | Free/OSS, self-hosted | Agent on each endpoint, continuous | No | A broad XDR and SIEM you self-host and operate; managed Wazuh Cloud is paid |
Free offers verified against each vendor's own page.
What you get free on Windows
Every capability below is included for your first 200 endpoints, at no cost, for production use.
Windows and application CVEs together
Operating system findings come from the installed build and updates. Application findings come from software inventory. Both appear in one list per endpoint.
The fixing update, named
When a fix exists, the finding shows the Windows security update or the application version that closes it, so the next step is clear.
Ranked by real exploitation risk
Each CVE carries its CVSS severity, EPSS exploit-prediction score, and CISA KEV status, so the short list for today is obvious.
Workstations and servers
The same agent runs on Windows 10, Windows 11, and Windows Server 2012 R2 and later, so laptops and servers report into one dashboard.
Fix from the same console
Deploy the Windows update or the application update that closes a finding without leaving the page it was reported on.
Accepted risks with an expiry
Record an exception with an end date and an audit trail when a fix has to wait, so it comes back for review.
When you outgrow free
Past your first 200 endpoints it is $5 per endpoint per month, with lower per-endpoint rates past 500 endpoints and every feature still included. See the pricing calculator.
Vulnerability scanning for Windows 11 and Windows 10
Windows 11 and Windows 10 machines pick up new CVEs every month, on the second Tuesday and in between. The agent compares each machine's build and installed updates against the published fixes, so a laptop that missed a cumulative update shows exactly which CVEs that leaves open.
Windows 10 is past its end-of-support date. On those machines the scanner separates the fixes you can still apply from the ones that need an Extended Security Update license, so the list reflects what you can act on.
Vulnerability scanning for Windows Server
Servers are where a missed update costs the most, and where scheduled network scans are most often blocked by firewalls and maintenance windows. The agent runs on Windows Server 2012 R2 and later and reports continuously, with no inbound scanner access and no stored administrator credentials.
Because findings are tied to patch deployment, a critical CVE on a domain controller or file server leads to the specific update to approve, and the reboot can wait for the window you set.
Third-party application vulnerabilities on Windows
Much of the exploited software on a Windows machine is not Windows. Browsers, PDF readers, archivers, and remote-access tools carry a steady stream of CVEs, and Windows Update does not patch them.
TridentStack Control matches installed applications against published CVEs from software inventory and, where an update exists, deploys the fixed version from the same console.
More free tools from TridentStack Control
Free Vulnerability Scanner
The full comparison of free scanners across Windows, macOS, and Linux.
Free Vulnerability Scanner for Linux
Package-level CVE detection matched against each distribution's own security advisories.
Free Vulnerability Scanner for macOS
CVE detection for macOS and the applications installed on every Mac in the fleet.
Sample scan report
A report from four lab endpoints, ranked by CISA KEV status, EPSS, and CVSS.
Free Patch Management Software
Deploy the fixes from the same console. 200 endpoints free forever.
Free CVE lookup
Search any CVE for its CVSS score, EPSS exploit prediction, and CISA KEV status.
Frequently asked questions
- Log 01Log 01
Is there a free vulnerability scanner for Windows?
Yes. TridentStack Control scans Windows 10, Windows 11, and Windows Server for known vulnerabilities in the operating system and installed applications. Your first 200 endpoints are free forever, including for commercial use.
- Log 02Log 02
Does it work on Windows Server?
Yes. The agent runs on Windows Server 2012 R2 and later, and on Windows 8.1 and later on desktops. Servers and workstations report into the same dashboard.
- Log 03Log 03
Does Windows have a built-in vulnerability scanner?
Windows Security includes antivirus scanning, which looks for malware, not for missing updates or vulnerable applications. Finding known CVEs across a fleet needs a vulnerability scanner that reads builds, installed updates, and software inventory.
- Log 04Log 04
Does it find vulnerabilities in third-party applications?
Yes. Installed applications such as browsers, archivers, and runtimes are matched against published CVEs alongside the operating system, and the fixed application version is shown when one exists.
- Log 05Log 05
Do I need to open firewall ports or provide administrator credentials?
No. The agent runs on each machine and connects outbound, so there is no scanner to allow through the firewall and no stored credentials for remote logins.
- Log 06Log 06
Can it install the fix as well?
Yes. Windows updates and application updates deploy from the same console, on a schedule or on demand, with control over when the endpoint reboots.
Start scanning Windows, free
200 endpoints free forever, every feature included. No credit card, no time limit.
Competitor facts verified against each vendor page. Last verified 2026-09-23. Reviewed by Adam Curtis, Founder, TridentStack.