# Panoptic Scans

> Panoptic Scans is a hosted vulnerability scanning platform. It is a cloud service that runs OpenVAS, ZAP, Nmap, and Nuclei, then explains how findings can be chained in real-world attacks. Teams use it for SOC 2, ISO 27001, and ISO 27001 A.12.6.1 evidence without operating their own scanners.

Panoptic Scans is a Software-as-a-Service product from Panoptic Scans, LLC, founded in 2019. External scans run from the cloud with no agents. Internal OpenVAS scans run from a customer VM via `openvas_local_scan.sh` and upload results to the same dashboard.

## What is Panoptic Scans?

Panoptic Scans is a vulnerability scanning service for networks and web applications. It combines four industry-standard engines:

1. **OpenVAS** for network vulnerability assessment, including 100,000+ NVTs. External scans are available on all plans. Internal network scans are available on the Pro plan.
2. **ZAP** (Zed Attack Proxy) for dynamic application security testing (DAST). Unauthenticated and authenticated scans are supported. Authenticated scans replay a Selenium login script before spidering.
3. **Nmap** for port scanning and service fingerprinting.
4. **Nuclei** for template-based detection using community templates.

Plans start at $25/month (Basic), $75/month (Premium), and $200/month (Pro). A free trial is available.

## Primary pages

- [Home](https://panopticscans.com/): Product overview and free-scan form
- [About](https://panopticscans.com/about): Company, methodology, and credentials
- [Pricing](https://panopticscans.com/pricing): Trial, Basic $25 with 75 targets, Premium $75, Pro $200
- [Sample report](https://panopticscans.com/sample-report): First pages of a real OpenVAS report: a white-labeled cover and an attacker's narrative
- [Documentation](https://panopticscans.com/docs): Product docs, including getting started and scanner guides
- [API](https://panopticscans.com/api): REST API for scan management
- [MCP server card](https://panopticscans.com/.well-known/mcp/server-card.json): Streamable HTTP MCP server for agents. The same API-key bearer token authorizes tools for scans, reports, vulnerabilities, targets, and webhooks
- [auth.md](https://panopticscans.com/auth.md): How an account holder grants an agent API and MCP access
- [Blog](https://panopticscans.com/blog): Vulnerability scanning guidance
- [Vanta integration](https://panopticscans.com/vanta-vulnerability-scanning): Official Vanta Marketplace integration; automatic evidence upload for AICPA TSC CC7.1–CC7.3 and ISO 27001 A.12.6.1

## Scanner pages

- [OpenVAS / Greenbone](https://panopticscans.com/openvas-vulnerability-scan)
- [ZAP](https://panopticscans.com/zap-vulnerability-scan)
- [Nmap](https://panopticscans.com/nmap-port-scanning)
- [Nuclei](https://panopticscans.com/nuclei-vulnerability-scan)

## Use cases

- [SOC 2 vulnerability scanning requirements](https://panopticscans.com/soc2-network-vulnerability-scanning) (AICPA Trust Services Criteria CC7)
- [Continuous vulnerability management](https://panopticscans.com/continuous-vulnerability-management)
- [OWASP ASVS vulnerability scanning](https://panopticscans.com/owasp-asvs-vulnerability-scanning)
- [DAST for applications](https://panopticscans.com/dast-application-vulnerability-scanning)
- [External attack surface monitoring](https://panopticscans.com/external-attack-surface-monitoring)
- [MSP vulnerability management](https://panopticscans.com/vulnerability-scanning-for-msps)
- [Official Vanta vulnerability scanner integration](https://panopticscans.com/vanta-vulnerability-scanning)

## Alternatives

- [Tenable Nessus](https://panopticscans.com/nessus-alternative)
- [Qualys VMDR](https://panopticscans.com/qualys-alternative)
- [Rapid7 InsightVM](https://panopticscans.com/rapid7-alternative)
- [Greenbone OpenVAS](https://panopticscans.com/greenbone-openvas-alternative)
- [AWS Inspector](https://panopticscans.com/aws-inspector-alternative)

## Optional

- [OpenVAS / Greenbone](https://www.openvas.org/)
- [ZAP](https://www.zaproxy.org/docs/)
- [Nmap](https://nmap.org/docs.html)
- [Nuclei](https://docs.projectdiscovery.io/tools/nuclei/overview)
- [NIST SP 800-115](https://csrc.nist.gov/publications/detail/sp/800-115/final)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)