What a Nessus Plugin Update Taught Me About Vulnerability Assessment

Sometimes the hardest part of a cybersecurity project isn’t the security assessment itself.

I recently completed an internal vulnerability assessment for BlueRock Technologies, using Kali Linux, Nmap, and Nessus to identify security weaknesses on an authorized lab server.

On paper, the project sounded straightforward:

Identify the target → scan with Nmap → run Nessus → analyze vulnerabilities → prioritize the risks → document the findings.

In reality, it was much more challenging than I expected.

One of the biggest problems I faced was with Nessus and its plugin updates. The plugins were taking a long time to upload and update, and this significantly delayed the vulnerability scanning process.

And honestly, it was exhausting.

There were times when I felt like I had already spent so much time on the project, only to be stopped by something that seemed like it should have been simple.

But I kept going.

The Project

The objective was to conduct an authorized vulnerability assessment against a Metasploitable 2 virtual machine within an internal laboratory environment.

The target was:

192.168.10.3

My assessment environment was Kali Linux, and I used two main tools:

• Nmap for reconnaissance and service/version enumeration
• Nessus for vulnerability identification and configuration weaknesses

The assessment focused on identifying exposed services, open ports, software versions, known vulnerabilities, authentication weaknesses, administrative interfaces, and potentially outdated software.

The Struggle With Nessus

This was probably the most frustrating part of the project.

Before Nessus could properly perform the assessment, I needed its plugins to be available and updated. However, the plugin upload/update process was taking much longer than expected.

That meant waiting.

Then troubleshooting.

Then waiting again.

And when you’re working on a project with a deadline, repeatedly watching a process take longer than expected can be incredibly frustrating.

There were moments where I felt mentally drained from the project.

I started questioning whether I was making progress at all.

But cybersecurity has taught me something important:

Troubleshooting is part of the job.

-Things don’t always work the first time.

-Tools can fail.

-Configurations can cause unexpected problems.

-Updates can take longer than expected.

-And sometimes, the solution is not immediately obvious.

Instead of giving up, I continued working through the issue until I was able to move forward with the assessment.

Starting With Nmap

Once I was able to progress with the assessment, I started with reconnaissance.

I used Nmap to identify the services and versions exposed by the target.

This was important because vulnerability scanners shouldn’t simply be treated as a magic button that produces a list of vulnerabilities.

Understanding what is actually running on the target gives you context for interpreting the scanner results.

My approach was to first understand the attack surface and then use Nessus to identify potential weaknesses.

Moving to Nessus

Nessus was then used to identify known vulnerabilities and configuration weaknesses associated with the target.

The assessment produced a significant number of findings:

SeverityFindingsCritical11High7Medium23Low9Informational130

Seeing 11 Critical vulnerabilities and 7 High vulnerabilities really demonstrated how important vulnerability management is.

But another lesson I learned was that finding vulnerabilities is only the beginning.

You have to understand what they mean.

Not Every Scanner Result Should Be Accepted Blindly

One of the most valuable parts of the project was learning about vulnerability validation.

A vulnerability scanner can identify potential vulnerabilities, but that doesn’t mean every result should automatically be treated as confirmed.

I compared the Nessus findings with the services and software versions identified during the Nmap reconnaissance.

If Nessus reported a vulnerability affecting a particular service or version, I could compare that information against what Nmap actually identified on the target.

This helped provide additional confidence in the findings and reduce the risk of relying blindly on automated scanner output.

Where applicable, findings could also be considered alongside CVE information and CVSS scores to understand their severity and potential impact.

Learning to Think About Risk

Another important lesson was that vulnerability assessment isn’t just about producing a huge list of vulnerabilities.

Get Waheedah Olayiwola’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

It’s about prioritization.

The Critical findings were placed at the highest priority and recommended for immediate remediation, while High findings were recommended to be addressed within one week.

The assessment also considered factors such as:

• Technical severity
• CVSS score
• Exploitability
• Confidentiality impact
• Integrity impact
• Availability impact
• Potential business consequences

This helped me understand the difference between simply identifying a vulnerability and actually performing a meaningful risk assessment.

What I Would Recommend

Based on the assessment, the main recommendations included:

• Applying critical security patches immediately
• Upgrading unsupported software
• Disabling unnecessary services
• Removing insecure configurations
• Applying least-privilege access
• Enforcing stronger authentication
• Enabling MFA for administrative access
• Closing unnecessary ports
• Restricting administrative services
• Improving centralized logging and monitoring
• Performing regular vulnerability scans
• Conducting follow-up scans after remediation

What This Project Really Taught Me

The biggest lesson wasn’t actually about Nmap or Nessus.

It was about persistence.

When I started this project, I expected the biggest challenge to be understanding the vulnerability assessment methodology.

Instead, one of my biggest obstacles was getting the tools to work properly — particularly the long Nessus plugin update/upload process.

It dragged the project out.

It frustrated me.

And at times, it completely exhausted me.

But I finished it.

That experience reminded me that cybersecurity isn’t always about knowing the answer immediately.

Sometimes it’s about:

Researching.
Troubleshooting.
Waiting.
Trying again.
Making mistakes.
Learning.
And trying again.

Final Thoughts

Completing this vulnerability assessment gave me practical experience with Kali Linux, Nmap, Nessus, vulnerability identification, service enumeration, CVE/CVSS analysis, risk prioritization, and remediation planning.

But more importantly, it taught me something I will carry into future cybersecurity projects:

Progress isn’t always fast, and sometimes finishing the project means pushing through the frustrating parts that nobody sees.

The finished report might show the tools I used and the vulnerabilities I identified.

It doesn’t show the hours spent waiting for Nessus plugins.

It doesn’t show the frustration.

It doesn’t show the moments when I wanted to step away from the project.

But those experiences were part of completing it.

And that’s probably one of the most valuable things I learned.

Keep troubleshooting. Keep learning. Keep going. 🔐💻

Tools Used

• Kali Linux
• Nmap
• Nessus
• Metasploitable 2
• CVE/CVSS analysis
• Vulnerability assessment methodology

Key Skills Developed

Vulnerability Assessment | Network Reconnaissance | Vulnerability Scanning | Risk Assessment | CVE/CVSS Analysis | Security Reporting | Remediation Planning | Troubleshooting