We use Nessus Professional for internal vulnerability scanning. It's free for higher eds so that factored into the decision. Prior to that we used NMap. In general, I'd say it does what we need it to do but we also use other tools to get the full picture. For example, we use Shodan to get a look from the outside. We also use Nagios to do things like check that packages are up to date. VMWare also tells us a lot.
Things to consider:
* Nessus report formats are PDF, HTML, and CSV. There is also a proprietary Nessus format that I've never used. CSV is useful enough but I would prefer output in JSON.
* Whatever tool you use you will need to process the results somehow (see above) and turn those results in useful information. For example, you may want to open tickets in some kind of tracking system. So think about how well the tool can feed into whatever system you are using.
* Consider what it would take to do authenticated scans in your environment. Unauthenticated scans can sometimes yield false positives where it simply flags vulnerable packages by version listed in the banner text. Typically linux package maintainers will patch the version in the repo rather than roll to the next version. So you really need to look at apt to know if a package is vulnerable. This sometimes happens with our linux VMs. Not a big deal just don't believe everything it tells you. Not sure how things work in Windows world but it may be similar...
* It's also worth thinking about how big your network is. If it's only a /24 then NMap and a reasonable amount of Python might be the simplest and most flexible thing. For larger nets (/16 or /8) that may prove unwieldy. But define what you want to know and then select the tool. For example, certain Nagios checks are basically identical to an authenticated internal scan (e.g check_apt, check_apache, check_nginx, and so on). YMMV but you may already have tools on hand that will tell you what you want to know.
