No more typing reviews! Try our Samantha, our new voice AI agent.

BMC Helix Cloud Security vs VMware Aria Automation comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Cloud Security Posture Management (CSPM)
8th
Average Rating
8.6
Reviews Sentiment
7.3
Number of Reviews
39
Ranking in other categories
Vulnerability Management (11th), Container Security (11th), Cloud Workload Protection Platforms (CWPP) (8th), SaaS Security Posture Management (SSPM) (1st), Cloud-Native Application Protection Platforms (CNAPP) (6th)
BMC Helix Cloud Security
Ranking in Cloud Security Posture Management (CSPM)
38th
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
5
Ranking in other categories
Cloud Workload Protection Platforms (CWPP) (25th)
VMware Aria Automation
Ranking in Cloud Security Posture Management (CSPM)
20th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
172
Ranking in other categories
Cloud Management (3rd), Configuration Management (8th), Network Automation (5th), Cloud Infrastructure Entitlement Management (CIEM) (6th)
 

Mindshare comparison

As of June 2026, in the Cloud Security Posture Management (CSPM) category, the mindshare of Qualys TotalCloud is 1.6%, up from 1.2% compared to the previous year. The mindshare of BMC Helix Cloud Security is 0.8%, up from 0.3% compared to the previous year. The mindshare of VMware Aria Automation is 1.0%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Cloud Security Posture Management (CSPM) Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.6%
VMware Aria Automation1.0%
BMC Helix Cloud Security0.8%
Other96.6%
Cloud Security Posture Management (CSPM)
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
DG
Portfolio Manager/ Helix Administrator at Frontier Communications
A highly scalable and straightforward solution with a knowledgeable support team
We work on a third-party shared environment. It wouldn’t have been feasible for a smaller company. My company was actually the first one to do it. Just like any cloud security, it pays to do your research and have complimentary security involved. The product can’t be the be-all and end-all tool for your security. Overall, I rate the solution a nine out of ten.
VasilisGiannitsiotis - PeerSpot reviewer
Senior IT at ITSolutions
Automation has streamlined complex financial workflows but still needs more intuitive orchestration
Something to improve in VMware Aria Automation would be related to VCF 9, as I do not know what it is trying to bring because they exposed it as the solution of everything. So VCF 9 will bring VCF Automation and VCF Operations, the new product line of VMware. I have not seen what this brings or what else it includes. Maybe in the area of vRealize Orchestrator, this would be beneficial because VRO can do everything. Perhaps a more user-friendly way to use that tool would be helpful because the possibilities there are endless. I am looking for more user-friendly navigation in VMware Aria Automation.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is a cloud-native app that integrates with both IaaS and SaaS. It seamlessly integrates with other platforms."
"Qualys TotalCloud's most valuable feature is its ability to link clusters of assets, providing a clear model of deployments, vulnerabilities, and statuses."
"With TotalCloud, we can scan through the API. If we are not able to deploy cloud agents on the machine, we can use the API."
"Qualys TotalCloud has helped us view our risk structure, vulnerabilities, and security posture."
"CSPM is currently the most used feature, and we are enjoying the new feature, FlexScan, which is valuable for Internet-facing VMs."
"The best part I like is the on-demand scans."
"Once you have your vulnerabilities fixed and your patches pushed out using Qualys TotalCloud, then you are able to eliminate threats and cyber risk."
"If someone were to ask me to review Qualys TotalCloud, I would summarize it as an end-to-end solution for cloud security with visibility and governance-grade controls without needing to manage multiple disconnected tools."
"With very minimal effort, you are able to have a cohesive view into your security posture on one or multiple cloud accounts, particularly if you are dealing with multicloud."
"The most valuable aspects of BMC Helix Cloud Security are its security features and regulatory compliance capabilities."
"The best feature is time to value. With very minimal effort, you are able to have a cohesive view into your security posture on one or multiple cloud accounts, particularly if you are dealing with multicloud. If you have Azure and AWS deployments, you might have multiple subscriptions in Azure and usually multiple accounts in AWS. You may even be doing some GCP work (around Google Cloud Platform). It's very difficult to manage a common set of policies, even less reporting, across multiple subscriptions, accounts, and cloud environments. What BMC Helix Cloud Security does is provide a unified view or single pane of glass as to your baseline. Then, it also facilitates the ability for Level 1 or 2 operations support to take action and report on security vulnerabilities."
"The cool feature of Helix Cloud Security is that you can do all that — understand and remediate issues — in one dashboard, based on the different policies that are available for security, out-of-the-box."
"Using this solution is an eye-opener; having that holistic view is the biggest eye-opener because you understand, from any of your connected cloud accounts, what your vulnerabilities are with it."
"It is a good tool to make sure that your containers are safe and sound."
"Role-based security is a valuable feature."
"It's also multi-cloud. You can look at several cloud providers: AWS, Azure, or GCP."
"Scalability is perfect. We haven't had any issues."
"I think vRA stands at the top of the list of the products that we rate, because of the problems that it has helped us to solve, in terms of providing the services to our end customers."
"You should look at the complexity and size of your environment, and when utilizing that background for your requirements, I personally would recommend VMware."
"Its automated processes have brought down the overall time to a fourth or fifth from our previous manual deployment's time."
"The most valuable feature would be the scalability, as it's very easy to add more capacity once it's set up, and in terms of provisioning, it has definitely helped speed-wise by simplifying making the environment bigger without the downtime of waiting for more hardware."
"SaltStack provides the capability necessary to truly streamline our SDLC and environment management."
"It has helped our organization tremendously."
"Official documentation and community support are top notch."
 

Cons

"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."
"The onboarding process is a bit difficult. In the initial phase, it is very difficult to understand the features, what the dashboard contains, and what criteria they are using."
"The patching process with Qualys Patch Management, which is part of TotalCloud, does not cover installing certain prerequisites on the servers or workstations. This shortcoming means we must rely on SCCM when any service stack updates or additional prerequisites are needed."
"We encountered challenges identifying the correct resource category for certain items, such as those in containers or storage."
"The main area needing improvement is integration. Although the team is strengthening TotalCloud, integration can be enhanced with SIEM, SOAR, ITSM, and other sources."
"TotalCloud could improve the classification of vulnerabilities. Specifically, it could enhance the categorization of what aspects fall under patches resolved by OS or software updates and what pertains to configuration adjustments."
"To improve the user experience, reporting could be simplified for better comprehension by end users and project managers, facilitating issue resolution."
"Although TotalCloud is a helpful tool, some of its advanced features are still under development."
"BMC Helix Cloud Security has room for improvement in terms of integrating its various features."
"We've had some issues with connectors; the connectors have seemed to cause a little bit of trouble, perhaps with the APIs trying to scan the environment."
"We've had some with issues connectors. The connectors have seemed to have caused a little bit of trouble, perhaps with the APIs trying to scan the environment. The only time I've had to reach out to tech support was for that. It seems it may not have been scanning correctly or I wasn't seeing data within a specific time. But we've set up a couple of connectors in the past couple of weeks and they actually scanned the AWS environment and we had data within about 10 minutes. It's working a lot faster and I think they're making improvements as they go."
"The UI could be more user-friendly."
"The biggest challenge now, which is a good problem to have, with BMC Helix is content."
"I think its TOA interfaces are still not that comfortable. The UI could be more user-friendly, easier to use."
"I want the role-based security feature to be improved."
"Every organization out there doesn't rely on just one control body. They use FISMA control. They may use HIPAA, CIS, PCI, or SOX, then blend them. One of the things that is now in big demand for BMC Helix Cloud Security is content. That's the next journey in its lifespan, making it easier for the community to share and collaborate on content for security controls that can be measured and remediated."
"I would like to see more out-of-the-box blueprints and workflows for the rest of VMware's products and its portfolio."
"Windows support is advertised as a first-rate supported platform; however, it is ripe with issues that have added countless hours to our roadmap."
"vCenter and vRA, I believe they share two different databases so sometimes you have to somehow sync them up. I wish there was only one database between the two or, somehow, one database would rule over the other one, so if you have both products, the vCenter might use the vRA database. Otherwise, when you do stuff in vCenter, you have to write a command on vRA to update the databases."
"There is some performance lag, but that could be on our end."
"I have found 7.4 to be user-friendly but 7.5 is not, in fact, it's a nightmare."
"VMware needs to make it to where it is not as custom. Right now, you spend a lot of time making the services work. In order to get it up and running initially, that takes time."
"We still struggle a little bit with the configuration as far as making sure that we have all the endpoints where they need to be, because that's not as agile as we'd like in the back-end. We're working towards that with our DevOps teams to make sure that we're touching the right endpoints and getting the right data."
"In terms of additional features, I would like it to be able to poll my vCenter infrastructure more rapidly and adapt to changes quickly. It should alert me and let me know when there are broken components, as a result of underlying infrastructure changes. It needs to be more stringent."
 

Pricing and Cost Advice

"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"TotalCloud's price is about right where I would expect it to be."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"The pricing is based on an annual subscription, upfront, and it's based on cloud assets. Whether your assets are in Azure and AWS combined, the tool tells you how many assets are being scanned and that's the number used for pricing."
"It is a subscription model with term licensing that is usually yearly. This includes, not only the product, but support and maintenance. It is based on cloud assets. Therefore, if you have 100 cloud assets, those cloud assets are measured based on evaluation or transactions. For example, if I'm evaluating that cloud asset for CIS compliance, PCI compliance, and AWS best practices, that asset gets evaluated three times, as those are three transactions. However, the license model is based on peak asset usage. So, over a year, if you deploy 100, 1000, 500, and then 2000 assets, you will be charged for the 2000 peak of assets managed by Helix Cloud Security."
"As far as value is concerned, it has been essential to our environment. We have been able to deploy VMs quickly and the developers have their own sandbox, so they can spin up and destroy VMs at their own will."
"We do plan to see ROI with any new implementation of new technologies being implemented within our environment."
"vRealize automation really should be a front door to the whole VMware suite of products."
"SaltStack is an open-source product."
"From the customer perspective, the value was worth it."
"Better pricing is always handy, but I feel it's at the right price point."
"They should provide one license for all the sub-products."
"It is an open-source product."
report
Use our free recommendation engine to learn which Cloud Security Posture Management (CSPM) solutions are best for your needs.
900,747 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
18%
Financial Services Firm
14%
Construction Company
7%
Comms Service Provider
7%
Construction Company
16%
Comms Service Provider
13%
Performing Arts
9%
Manufacturing Company
9%
Financial Services Firm
11%
Manufacturing Company
9%
Computer Software Company
7%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise3
Large Enterprise29
No data available
By reviewers
Company SizeCount
Small Business33
Midsize Enterprise24
Large Enterprise131
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
Areas that need improvement in every solution include the remediation part. The remediation steps should be simple en...
What is your primary use case for Qualys TotalCloud?
Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal appli...
Ask a question
Earn 20 points
What's the difference between VMware vRA (automation) and vROps (operations)?
vROP is a virtualization management solution from VMWare. It is efficient and easy to manage. You can find anything y...
Is there any way to try VMware Aria Automation for free?
When it comes to VMware Aria Automation, you have three choices for free runs: Hands-on Lab (HOL) Advanced lab A fre...
Which sectors can benefit the most from VMware Aria Automation?
I was looking at VMware Aria Automation case studies recently and I got the impression that three main kinds of compa...
 

Also Known As

Qualys TotalCloud with FlexScan
TrueSight Cloud Security, SecOps Policy Service
VMware vRealize Automation, vRA, VMware DynamicOps Cloud Suite, SaltStack
 

Overview

 

Sample Customers

Information Not Available
NHS, Vodafone, Kansas City Life, SKY Italia, Cybera
Rent-a-Center, Amway, Vistra Energy, Liberty Mutual
Find out what your peers are saying about BMC Helix Cloud Security vs. VMware Aria Automation and other solutions. Updated: April 2026.
900,747 professionals have used our research since 2012.