Resources · Cyber Security
Fjordex vs Shodan vs Nessus: what is each one for?
Short answer
The three do different jobs and do not replace each other. Shodan is a search engine that indexes internet-connected devices; you can look up any target, but it does not carry out an assessment for you. Nessus is an authorised active scanner that connects to your own systems and detects known vulnerabilities (CVEs). Fjordex is ArveNova's assessment engine: it maps the external attack surface with passive and authorised active discovery, matches discovered versions against NVD-based CVE data, reads Active Directory security posture under authorisation, and brings the result together in a sober, signable Turkish report. The Fjordex connector (MCP) is only the passive preview of that engine. Findings come from deterministic rules; no LLM sits in the decision loop.
The three tools compared in one table
| Shodan | Nessus | Fjordex | |
|---|---|---|---|
| Category | Internet device search engine | Vulnerability scanner | Attack surface and vulnerability assessment engine + reporting layer |
| Interaction with the target | None (Shodan scans on its own, you search the results) | Active: connects to the target and queries services | Passive discovery (DNS, CT logs) + active discovery that passes an authorisation gate (live services, ports, TLS) + credentialed AD read. The connector runs only the passive part |
| Is authorisation needed? | Not for searching | Yes, your own systems or written authorisation | Every run requires a written authorisation reference and a test window; out-of-scope assets are never scanned |
| What does it find? | Open ports, banners, device types, internet-wide | CVE matches, misconfigurations, missing patches | Inventory of externally visible assets, SPF/DKIM/DMARC, TLS posture, exposed panels, version-based CVE matching, subdomain takeover, lookalike domains, Kerberoast / AS-REP / ADCS risks in AD |
| What does it not find? | Interpretation and prioritisation specific to you | External visibility inventory, brand impersonation | Real-time traffic monitoring (SOC), automated attacks, running exploits |
| Who uses it? | Researchers, SOC teams, attackers | IT teams, pentesters | SMEs, universities, hospitals and municipalities with no IT team or that want an outside view |
| Where does it run? | Web interface, API | Installed software / Tenable cloud | Run by ArveNova under authorisation; passive preview through the MCP connector |
| Cost | Free / membership | Licence (annual) | Signed assessment from €2,200 |
Shodan: the search engine of the internet
Shodan constantly scans the internet and indexes the devices and service banners it finds. It answers a question like "which IPs have port 3389 open and run Windows Server 2012" in seconds. Its strength is its coverage: the whole internet. Its weakness is the same thing: it is not specific to you. Shodan does not tell you "this is your attack surface"; the data may be stale and interpreting it is up to you. Because it is also the first place attackers look, Shodan is one of the sources that feed discovery; Fjordex adds target-specific, fresh and authorised validation, CVE matching and the report on top.
Nessus: the credentialed vulnerability scanner
Nessus (Tenable) connects to your own systems, detects the versions of running services and matches them against a known-vulnerability database. Its output is CVE numbers, CVSS scores and a list of missing patches. It gives its best results in credentialed (authenticated) scans, that is, on the internal network; its output is in English and usually hundreds of lines long. For an internal IT team it is indispensable. Fjordex does not replace Nessus, it works alongside it: Nessus for deep internal CVE scanning, Fjordex for the external attack surface, AD posture and the decision layer (prioritisation, delta, a signable Turkish report). Because it is an active scan, Nessus needs care on sensitive systems (hospital devices, legacy industrial control systems); in rare cases it can cause a service outage.
Fjordex: the assessment engine and the connector
Fjordex works on two planes. The external plane maps the organisation's internet-facing assets: passive discovery (subdomains, Certificate Transparency logs, SPF/DKIM/DMARC, lookalike domains) and active discovery limited by written authorisation (live services, ports, TLS posture, exposed panels, subdomain takeover). Discovered service versions are matched against an NVD-based CVE dataset; severity is calculated from the CVSS vector, never assigned by hand. The internal plane is a credentialed, read-only review of Active Directory security posture: weak password policy, Kerberoast / AS-REP risks, ADCS misconfigurations and mapping of the path to Domain Admin; no path is ever executed.
Every run passes through a single authorisation gate: without a written authorisation reference and a test window the scan does not start, and out-of-scope assets are never scanned. The output is a signable Turkish report, a delta report showing what changed since the previous run, and a monthly monitoring report; the body of the report comes only from the engine.
The Fjordex connector (MCP) is the passive preview of this engine: email security, DNS hygiene, subdomain discovery and lookalike domain checks. It does not connect to your systems and needs no installation; it works with a sentence like "check email security for arvenova.ai".
What Fjordex is not
This is the most important section, because false expectations are the most expensive mistake in security.
- It does not replace Nessus. Fjordex performs version-based CVE matching but does not aim for Nessus's broad, credentialed internal plugin base. "The connector came back clean" does not mean "our systems have no vulnerabilities"; it only means no problem is visible in public DNS and certificate data.
- It is not a SOC and not 24/7 monitoring. It does not detect attacks in real time and does not provide incident response. The monitoring product is a periodic re-scan with a monthly delta report.
- It is not a penetration test. Fjordex assesses; the manual finding validation add-on verifies critical findings by hand under written authorisation, with masked evidence in a signed annex. There is no attack simulation and no lateral movement.
- It is not an RMM or EDR. It installs no agent on your devices, does not monitor endpoints and does not deploy patches.
- The LLM does not make the call. Scanning, severity and prioritisation are fully deterministic: same input, same report. A language model is used only for the optional executive summary, locally and in a closed loop; if an IP, CVE or severity in the summary does not exist in the source data, that sentence does not make it into the report. In the connector too, the assistant only calls the tool and explains the result.
- It is not a signed report. The connector output is an automated preview. A document for an audit, insurer or tender is the signed report with human review (Tier 1 and above).
Which one to use, and when?
- You have your own servers and want to know your patch status: Nessus or an equivalent, with your own team or a consultant.
- You want to know how an attacker sees you and what is leaking across the internet: Shodan queries, ideally with an expert alongside.
- You want the full external surface in a signed, prioritised report: the ArveNova Tier 1 assessment (from €2,200, depending on scope). For Active Directory posture, Tier 3.
Need a signed assessment?
Contact us for a signed report, finding validation and regular monitoring. The final price is confirmed after a short scoping call.
Frequently asked questions
Can Fjordex replace Nessus?
No, it works alongside it. Nessus is strong at deep, credentialed internal CVE scanning; Fjordex provides the external attack surface, Active Directory posture and the decision layer (prioritisation, delta, a signable Turkish report). The connector runs only the passive checks.
Are Fjordex results produced by an AI?
No. Scanning, severity and prioritisation are done with deterministic rules; the same input gives the same report. A language model is used only for the optional summary text and cannot add any information to the report that is not in the source data.
Can I run Fjordex against a competitor's domain?
No. The passive connector does not technically block it, but it should only be used for domains you operate or are authorised to assess. The full engine does not start at all without a written authorisation reference.
Is Shodan free?
Basic search is free; filters, the API and historical data require a membership. Shodan is a data source, not an assessment service.
Is it safe to run Nessus on a hospital network?
Usually yes, but medical devices and legacy systems can react unexpectedly to active scanning. That is why for hospitals we recommend a passive assessment first, followed by an active scan with an agreed scope and time.