JFrog Xray vs Qualys TotalCloud comparison

JFrog and Qualys are both solutions in the Vulnerability Management category. JFrog is ranked #39 with an average rating of 7.0, while Qualys is ranked #13 with an average rating of 8.7. JFrog holds a 1.4% mindshare in VM, compared to Qualys’s 0.8% mindshare. Additionally, 90% of JFrog users are willing to recommend the solution, compared to 100% of Qualys users who would recommend it.

JFrog Xray

Read 10 JFrog Xray reviews

7,795 Views
1,949 Comparison Views

90% willing to recommend

Qualys TotalCloud

Read 36 Qualys TotalCloud reviews

2,892 Views
1,735 Comparison Views

100% willing to recommend

JFrog Xray

Qualys TotalCloud

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 16, 2024

JFrog Xray and Qualys TotalCloud are two prominent products in the software security and vulnerability management landscape. JFrog Xray is favored for its feature set, while Qualys TotalCloud excels in its overall offering, outweighing Xray’s pricing and support.

Features: JFrog Xray stands out with its robust integration capabilities, effective vulnerability scanning, and seamless functionality within CI/CD pipelines. Qualys TotalCloud is praised for its extensive threat intelligence, comprehensive cloud-native security features, and broader range of security measures.

Room for Improvement: Users of JFrog Xray wish for better scalability, more detailed reporting features, and enhanced user interface. For Qualys TotalCloud, the desire is for improved API performance, more intuitive setup processes, and faster scan times.

Ease of Deployment and Customer Service: JFrog Xray is noted for straightforward deployment, but some users report challenges with customer support responsiveness. Qualys TotalCloud users enjoy an efficient deployment process and exemplary customer service, suggesting a more favorable support experience compared to JFrog Xray.

Pricing and ROI: JFrog Xray is often viewed as more cost-effective in the initial setup, with solid ROI attributed to its seamless integration in DevOps workflows. Qualys TotalCloud, despite potentially higher costs, is valued for its comprehensive security coverage which users see as justifying the investment. Qualys is perceived to offer superior return on investment in terms of security.

To learn more, read our detailed JFrog Xray vs. Qualys TotalCloud Report (Updated: January 2026).

Buyer's Guide

JFrog Xray vs. Qualys TotalCloud

January 2026

Download the complete report

Helped 881,733 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

3.5

JFrog Xray improved efficiency, security, and compliance, reduced downtime, and sped up release cycles with enhanced vulnerability detection and reporting.

Sentiment score

5.9

Qualys TotalCloud enhances efficiency, reduces workloads and costs, achieving substantial ROI through automation and strategic engagements.

No quotes available

For more quotes and insights, download the JFrog Xray report

It has saved about 90% of our time.

reviewer2592729

Senior Consultant at a consultancy with 10,001+ employees

TotalCloud has generated overall savings of 30 to 40 percent across various departments.

reviewer2060841

Security Manager at a consultancy with 10,001+ employees

CallStream helps us integrate and automate tasks.

SurajTripathi

Senior Security Consultant at CyberNxt Solutions LLP

For more quotes and insights, download the Qualys TotalCloud report

Customer Service

Sentiment score

4.0

JFrog Xray's customer service is generally well-received, with positive technical support, though not all users engage directly.

Sentiment score

7.4

Qualys TotalCloud's customer service is praised for effectiveness but faces criticism for delayed responses and varying support staff expertise.

When we need clarifications, we contact our account manager, and they arrange demos.

Vinod Bhupathiraju

Development Senior at a financial services firm with 5,001-10,000 employees

On a scale of 1 to 10, I would rate the technical support of JFrog Xray an eight because they are very knowledgeable.

reviewer2757060

DevSecOps Engineer at a tech services company with 501-1,000 employees

For more quotes and insights, download the JFrog Xray report

They are helpful, respond to my queries, and can answer any question.

Bhaskar Praveen

Developer at a consultancy with 10,001+ employees

Qualys's tech support is highly responsive, providing multiple ways to interact with them.

HASHIM JUNAID

Service Manager, Security Operations at CDA IT SOLUTIONS

Qualys' customer service provides quality answers, but the response time is long, even though it is within the SLA.

Aditya Pathak

Works at a consultancy with 10,001+ employees

For more quotes and insights, download the Qualys TotalCloud report

Scalability Issues

Sentiment score

6.8

JFrog Xray is scalable and suitable for multiple applications, despite PostgreSQL limitations and some performance challenges.

Sentiment score

8.1

Qualys TotalCloud is praised for seamless scalability, effectively managing deployments and applications across diverse environments and growing enterprises.

According to my use case, it is highly scalable.

Anand Nanwana

DevOps Engineer at Syvora

For more quotes and insights, download the JFrog Xray report

We started our organization about nine months back. We started with about 30 users, and we now have more than 100 users.

Mohsin_Raza

CIO at a venture capital & private equity firm with 11-50 employees

Our organization currently uses it to manage over 1200 web applications.

Faiz Delvi

Analyst, Information Security at Infosys

It is absolutely scalable, and I would rate its scalability as nine out of ten.

Eshan Kshirsagar

retired at a consultancy with 10,001+ employees

For more quotes and insights, download the Qualys TotalCloud report

Stability Issues

Sentiment score

7.6

JFrog Xray is praised for stability and security, compared favorably to competitors, with minor concerns about PostgreSQL support.

Sentiment score

8.4

Qualys TotalCloud is praised for its high stability, minimal downtime, and smooth performance with effective maintenance and bug fixes.

I use JFrog Xray primarily for security purposes, and I find it reliable.

Anand Nanwana

DevOps Engineer at Syvora

We did experience crashes, downtimes, and performance issues with JFrog Xray.

reviewer2757060

DevSecOps Engineer at a tech services company with 501-1,000 employees

For more quotes and insights, download the JFrog Xray report

Overall, the support provided has been excellent.

Faiz Delvi

Analyst, Information Security at Infosys

It is a stable solution, which is why we chose it.

Mohsin_Raza

CIO at a venture capital & private equity firm with 11-50 employees

Continuous monitoring is crucial to ensure system stability and avoid vulnerabilities or threats.

Bhaskar Praveen

Developer at a consultancy with 10,001+ employees

For more quotes and insights, download the Qualys TotalCloud report

Room For Improvement

Users demand better reporting, documentation, UI, site performance, API limits, custom reports, vulnerability management, and integration support.

Qualys TotalCloud users report unclear licensing, challenging dashboard, needed feature enhancements, UI improvements, platform support, and pricing concerns.

When we have given a very long tag, it doesn't work as expected and requires excessive scrolling.

Anand Nanwana

DevOps Engineer at Syvora

somehow you need to adapt your GitLab pipeline and turn them into JFrog pipeline, and this is something they don't really advertise at first—you're obliged to use the JFrog CLI.

reviewer2757060

DevSecOps Engineer at a tech services company with 501-1,000 employees

X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL.

Vinod Bhupathiraju

Development Senior at a financial services firm with 5,001-10,000 employees

For more quotes and insights, download the JFrog Xray report

Ideally, the scanner should automatically detect and scan all subdomains, even if not explicitly defined, ensuring comprehensive vulnerability assessment.

Faiz Delvi

Analyst, Information Security at Infosys

Ideally, updates should be more immediate, enabling quicker implementation of solutions.

ShantanuChoubal

Project Lead at Persistent Systems

Our goal is to integrate all these functions into Qualys, creating a single dashboard for comprehensive security monitoring and management.

Ramachandran Sugumar

Senior Information Security Engineer at a consultancy with 10,001+ employees

For more quotes and insights, download the Qualys TotalCloud report

Setup Cost

Qualys TotalCloud pricing is seen as either expensive or competitive, with features and flexibility justifying the cost for enterprises.

JFrog Xray provides a free trial of 14 days.

Anand Nanwana

DevOps Engineer at Syvora

The basic scanning capabilities come with Artifactory, however, curation requires additional licenses.

Vinod Bhupathiraju

Development Senior at a financial services firm with 5,001-10,000 employees

For more quotes and insights, download the JFrog Xray report

Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive.

Pramod Borana

Senior Manager at a financial services firm with 10,001+ employees

Pricing is managed by our finance team; however, Qualys TotalCloud offers cost-effective licensing flexibility.

Sushant Samantara

IT Manager at a consultancy with 10,001+ employees

Qualys TotalCloud is expensive, but it offers a premier solution with no headaches.

SubhashMuthareddy

Vice President at Inspira Enterprise

For more quotes and insights, download the Qualys TotalCloud report

Valuable Features

JFrog Xray offers deep scanning, seamless integration with Artifactory, robust vulnerabilities management, flexible deployment, and attractive pricing.

Qualys TotalCloud provides comprehensive security management with automatic detection, real-time protection, and integrated dashboards, enhancing visibility and reducing workloads.

The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features.

Vinod Bhupathiraju

Development Senior at a financial services firm with 5,001-10,000 employees

The policy-driven approach of JFrog Xray helped me maintain security standards by integrating it in the development pipeline.

reviewer2757060

DevSecOps Engineer at a tech services company with 501-1,000 employees

With other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well.

Anand Nanwana

DevOps Engineer at Syvora

For more quotes and insights, download the JFrog Xray report

This view of risk helps reduce the work we would have to do to combine multiple sources to prioritize risk.

Aditya Pathak

Works at a consultancy with 10,001+ employees

It will help cybersecurity professionals monitor the cloud and find vulnerabilities.

Bhaskar Praveen

Developer at a consultancy with 10,001+ employees

We are enjoying the new feature, FlexScan, which is valuable for Internet-facing VMs.

Jignesh Baleshwaria

Senior Consultant at a consultancy with 10,001+ employees

For more quotes and insights, download the Qualys TotalCloud report

Categories and Ranking

JFrog Xray

Ranking in Vulnerability Management

39th

Ranking in Container Security

14th

Average Rating

7.8

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (5th), Software Supply Chain Security (1st)

Qualys TotalCloud

Ranking in Vulnerability Management

13th

Ranking in Container Security

13th

Average Rating

8.6

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Cloud Workload Protection Platforms (CWPP) (9th), Cloud Security Posture Management (CSPM) (9th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (8th)

Mindshare comparison

As of February 2026, in the Vulnerability Management category, the mindshare of JFrog Xray is 1.4%, down from 1.5% compared to the previous year. The mindshare of Qualys TotalCloud is 0.8%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Vulnerability Management Market Share Distribution
Product	Market Share (%)
Qualys TotalCloud	0.8%
JFrog Xray	1.4%
Other	97.8%

Vulnerability Management

Featured Reviews

Anand Nanwana

DevOps Engineer at Syvora

Offers flexibility across clouds and easy credential management while interface improvements are needed

For JFrog Xray, the Artifactory and package repositories are valuable features. There are many benefits from JFrog Xray. For example, with other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well. JFrog can support multiple packages, such as NuGet package, pip, and other technologies. It can be used for Terraform as well. The credential management is very easy in JFrog. For instance, when using GitHub action as a CI/CD tool, I just need to create a token and set up JFrog CLI there and give access to the repository. With multiple repositories, I can generate a token for a specific repository, add that token in the GitHub secret, fetch from the CI/CD, run the command JFrog CLI, and authenticate through the token. Then we can push the images into JFrog.

Read full review

Arshad N. R.

Cyber Security Specialist at UBS Financial

A centralized tool for vulnerability and misconfiguration management in a multiple cloud environment

Qualys TotalCloud provides written explanations to help guide the remediation paths and eliminate cyber risk. We are using TruRisk for the remediations. The TruRisk shows anything critical, and we can then focus on that. We also assess manually whether an asset is a critical target or not. Qualys TotalCloud provides a single, prioritized view of risk. We are using CIS-CAT standards to harden our clouds, such as AWS, Google Cloud, and Azure. We are able to analyze the scans and identify which policies have failed and how we can remediate them. We can customize policies as per our organization's requirements. That is very helpful for us. With the TruRisk Insights feature, security has significantly improved. In six months of using it, we see that everything is under control. We've solved many problems related to asset management, cloud configuration, and the new asset identification. If an application team has onboarded any cloud asset, we can see that. We have that information now.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.

See recommendations

881,733 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

25%

Manufacturing Company

12%

Computer Software Company

Government

Financial Services Firm

16%

Manufacturing Company

11%

Computer Software Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	1
Midsize Enterprise	3
Large Enterprise	6

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	3
Large Enterprise	25

Questions from the Community

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

See all answers

What needs improvement with JFrog Xray?

I would assess the integration of JFrog Xray with CI/CD tools as the weak point. You have two means to do that: one is using the API, or the other is using the command line from JFrog. That part is...

See all answers

What is your primary use case for JFrog Xray?

For JFrog Xray product, you can use it for two main goals: compliance and security. You can use it to check if your licenses are compliant, and you can check if your dependencies you want to use ar...

See all answers

What is your experience regarding pricing and costs for Qualys TotalCloud?

Pricing compared to competitor tools is high. My costs depend on asset subscriptions. Pricing remains constant regardless of asset utilization, whereas other tools employ a credit system.

See all answers

What needs improvement with Qualys TotalCloud?

From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud. The navigation is difficult in terms of understanding risk relationships. Attack ...

See all answers

What is your primary use case for Qualys TotalCloud?

I use Qualys TotalCloud for cloud security posture management across AWS and Google Cloud. I use this tool for compliance and other purposes. I scan AWS and Azure for S3 buckets, security groups, u...

See all answers

Comparisons

Trivy vs JFrog Xray

Compared 11% of the time

Black Duck SCA vs JFrog Xray

Compared 9% of the time

Wiz vs JFrog Xray

Compared 6% of the time

Sonatype Lifecycle vs JFrog Xray

Compared 5% of the time

Mend.io vs JFrog Xray

Compared 5% of the time

More JFrog Xray Competitors

Wiz vs Qualys TotalCloud

Compared 20% of the time

Microsoft Defender for Cloud vs Qualys TotalCloud

Compared 10% of the time

AWS Security Hub vs Qualys TotalCloud

Compared 7% of the time

Prisma Cloud by Palo Alto Networks vs Qualys TotalCloud

Compared 6% of the time

Hadrian vs Qualys TotalCloud

Compared 3% of the time

More Qualys TotalCloud Competitors

Product Reports

Buyer's Guide

JFrog Xray

January 2026

Download JFrog Xray product report

Buyer's Guide

Qualys TotalCloud

January 2026

Download Qualys TotalCloud product report

Also Known As

JFrog Security Essentials

Qualys TotalCloud with FlexScan

Overview

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

JFrog

TotalCloud is the Qualys approach to Cloud Native Application Protection Platform (CNAPP) for cloud infrastructure and SaaS environments. With TotalCloud, customers extend TruRisk insights (transparent cyber risk scoring methodology) from the Qualys Enterprise TruRisk Platform to their cloud environments allowing for a seamless unified view of cyber risk across on-prem, hybrid, and multi-cloud environments.

Features and capabilities of Qualys TotalCloud include, but are not limited to:

Discover: Complete visibility and insights into cyber-risk exposure across multi-cloud. Continuously discover and monitor all your workloads across a multi-cloud environment for a 360-degree view of your cloud footprint. Identify known and previously unknown internet-facing assets for 100% visibility and tracking of risks.

Assess: Comprehensive cloud-native assessments with FlexScanTM. Extensive scanning capabilities with Qualys FlexScan, including no-touch, agentless, API- and snapshot-based scanning, along with agent- and network-based scanning for in-depth assessment. Use these multiple scanning methods to scan a workload to get a unified and comprehensive view of vulnerabilities and misconfigurations.

Prioritize: Unified security view to prioritize cloud risk with TruRiskTM. Experience a unified risk-based view of cloud security with insights across workloads, services, and resources. Qualys TruRisk quantifies security risk by workload criticality and vulnerabilities; it correlates with ransomware, malware, and exploitation threat intelligence to prioritize, trace, and reduce risk.

Defend: Real-time protection against evolving and unknown threats with InstaProtectTM. Qualys enables continuous monitoring of all cloud assets to ensure they are protected against threats and attacks at runtime. Qualys keeps your cloud runtime safe by detecting known and unknown threats across the entire kill chain in near real-time across a multi-cloud environment.

Remediate: Fast remediation with QFlow – no code, drag-and-drop workflows. The integration of QFlow technology into Qualys TotalCloud saves security and DevOps teams valuable time and resources. Automation and no-code, drag-and-drop workflows help simplify the time-consuming operational tasks of assessing vulnerabilities on ephemeral cloud assets, alerting on high-priority threats, remediating misconfigurations, and quarantining high-risk assets.

Qualys

Sample Customers

google, amazon, cisco, netflix, oracle, vmware, facebook

Information Not Available

Buyer's Guide

JFrog Xray vs. Qualys TotalCloud

January 2026

Free Report: JFrog Xray vs. Qualys TotalCloud

Find out what your peers are saying about JFrog Xray vs. Qualys TotalCloud and other solutions. Updated: January 2026.

DOWNLOAD NOW

881,733 professionals have used our research since 2012.

See our JFrog Xray vs. Qualys TotalCloud report.

See our list of best Vulnerability Management vendors and best Container Security vendors.

We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.