

Qualys VMDR and FortiCNAPP compete in the cybersecurity solutions market with a focus on vulnerability management and cloud security. Qualys VMDR seems to have the upper hand in vulnerability management and asset inventory with robust features and a comprehensive vulnerability database, while FortiCNAPP is strong in cloud security but could improve in areas like scanning and integration.
Features: Qualys VMDR provides advanced vulnerability management, patch management, and compliance, with extensive integration capabilities and asset inventory management. FortiCNAPP specializes in threat detection and continuous monitoring, offering automated policy recommendations for better cloud security but lacks advanced scanning capabilities compared to Qualys VMDR.
Room for Improvement: Qualys VMDR users report challenges in reporting, customization, and false positives, seeking better documentation and simpler asset tagging processes. It also faces issues with handling large assets and integrations. FortiCNAPP needs better data visibility, IAM security control, alert simplification, and enhanced remediation features to improve user experience.
Ease of Deployment and Customer Service: Qualys VMDR offers flexibility in deployment across on-premises, private cloud, and hybrid models. Customer service receives mixed reviews, with variable response times. FortiCNAPP supports public and private cloud deployment with high customer service satisfaction, though specific areas need improvement.
Pricing and ROI: Qualys VMDR has a higher pricing perception, especially for smaller businesses, but is valued for reducing vulnerabilities and improving security posture. FortiCNAPP is considered expensive for large deployments, offering significant risk reduction though requires clearer pricing metrics. Both products show strong ROI and security investment returns despite differing pricing structures.
We saw a return on investment through significant savings in time, money, and resources.
Technical support from Fortinet is good; I get feedback and responses quickly.
We usually get on calls with tech support, and they are very helpful.
The technical support provided by Qualys is pretty good.
When reaching out via email, they reply quickly.
Scalability depends on the license and the number of assets being monitored.
Qualys VMDR can handle scalability, although increasing the inventory can raise the licensing costs.
Qualys VMDR's scalability is good, and the customer support is good.
Qualys VMDR is stable.
The vulnerability part is not systematically organized; it is all clumsy in the web UI, and it is not user-friendly.
One area where Qualys VMDR can be improved is the missing feature for deploying agents for over 1,000 assets, as we need to do it manually.
If AI features were integrated, it could enhance the capabilities significantly.
It does not automate patching unless the patch management module is purchased separately.
Qualys offers better pricing and is feature-packed compared to other tools.
I would rate the pricing between seven to eight out of ten.
I have a notion that Qualys might be more expensive than Rapid7.
The machine learning capability in Lacework FortiCNAPP is used for threat detection.
The prioritization of vulnerabilities has improved our remediation efforts by around thirty to thirty-five percent.
Qualys VMDR's continuous monitoring capabilities help us respond to emergent threats by enabling my team to reach out to the security engineers whenever there is any detection of a vulnerability, informing them about it, and creating an incident.
It impacts my workflow overall, with the patch management features as it has the missing patches listed in detail, making it easier to get a comprehensive report and providing some dashboards that offer visual representation.
| Product | Market Share (%) |
|---|---|
| Qualys VMDR | 5.0% |
| FortiCNAPP | 1.7% |
| Other | 93.3% |

| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 4 |
| Large Enterprise | 4 |
| Company Size | Count |
|---|---|
| Small Business | 20 |
| Midsize Enterprise | 12 |
| Large Enterprise | 70 |
FortiCNAPP is a comprehensive cloud security platform focusing on ease of use and machine learning-driven anomaly detection. It offers robust compliance reporting, seamless integration, and continuous monitoring, making it an essential tool for organizations managing multi-cloud environments and security configurations.
FortiCNAPP provides significant capabilities in cloud security, compliance, and vulnerability management. Designed for organizations needing efficient monitoring, it enables detection of anomalies across cloud infrastructures while optimizing security posture and ensuring compliance with environments like AWS and GCP. The platform offers in-depth insights through scanning of IAC scripts, host systems, and cloud configurations. Recognized for effectively managing security posture, it safeguards Kubernetes and container environments, providing comprehensive threat detection and response. However, some areas like visibility, IAM security controls, and compliance metrics need improvement. Users face challenges with alert setup and lack intuitive design, alongside issues like FedRAMP authorization absence and complexity in the data model.
What are the key features of FortiCNAPP?FortiCNAPP is implemented extensively by industries needing reliable cloud security, such as finance, healthcare, and technology sectors. It supports organizations in enhancing cloud infrastructure protection, ensuring compliance, and strengthening vulnerability management. By integrating with platforms like AWS and GCP, businesses can optimize security posture in their cloud deployments.
Vulnerability Management, Detection, and Response (VMDR) is a cornerstone product of the Qualys TruRisk Platform and a global leader in the enterprise-grade vulnerability management (VM) vendor space. With VMDR, enterprises are empowered with visibility and insight into cyber risk exposure - making it easy to prioritize vulnerabilities, assets, or groups of assets based on business risk. Security teams can take action to mitigate risk, helping the business measure their actual risk exposure over time.
Qualys VMDR offers an all-inclusive risk-based vulnerability management solution to prioritize vulnerabilities and assets based on risk and business criticality. VMDR seamlessly integrates with configuration management databases (CMDB), Qualys Patch Management, Custom Assessment and Remediation (CAR), Qualys TotalCloud and other Qualys and non-Qualys solutions to facilitate vulnerability detection and remediation across the entire enterprise.
With VMDR, users are empowered with actionable risk insights that translate vulnerabilities and exploits into optimized remediation actions based on business impact. Qualys customers can now aggregate and orchestrate data from the Qualys Threat Library, 25+ threat intelligence feeds, and third-party security and IT solutions, empowering organizations to measure, communicate, and eliminate risk across on-premises, hybrid, and cloud environments.
We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.