No more typing reviews! Try our Samantha, our new voice AI agent.

PortSwigger Burp Suite Enterprise Edition vs Qualys VMDR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 25, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

PortSwigger Burp Suite Ente...
Ranking in Vulnerability Management
40th
Average Rating
8.0
Reviews Sentiment
7.2
Number of Reviews
12
Ranking in other categories
Dynamic Application Security Testing (DAST) (7th)
Qualys VMDR
Ranking in Vulnerability Management
3rd
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
96
Ranking in other categories
IT Asset Management (3rd), Configuration Management Databases (3rd), Container Security (9th), Risk-Based Vulnerability Management (1st)
 

Mindshare comparison

As of May 2026, in the Vulnerability Management category, the mindshare of PortSwigger Burp Suite Enterprise Edition is 1.1%, up from 0.9% compared to the previous year. The mindshare of Qualys VMDR is 4.2%, down from 8.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys VMDR4.2%
PortSwigger Burp Suite Enterprise Edition1.1%
Other94.7%
Vulnerability Management
 

Featured Reviews

OB
Studiant at Edifixio
Enables time-saving automated scanning and brute force attacks
The most appreciated functionality of PortSwigger Burp Suite is its ability to perform brute force attacks automatically. Its automated scanning feature saves time. Additionally, using this tool provides significant security insights, making our testing process more efficient and comprehensive, leading to considerable time savings, which in turn translates to financial benefits.
Vaibhav Ghule - PeerSpot reviewer
Soc Lead & Edr Administration at Persistent Systems
Continuous risk-based monitoring has strengthened incident response and vulnerability prioritization
I haven't explored Qualys VMDR's vulnerability lifecycle automation yet. One of my analysts mentioned that queries lack grouping operators in Qualys VMDR. From my experience, I would appreciate improvements in the query options in Qualys VMDR, specifically in the query-building process where I would need more features and operators. Additionally, we have been facing issues with Qualys on the cloud level. We cannot download the configuration profile from the cloud agent, and it is showing a pending action for download. During 2025, we noticed outages of Qualys a couple of times. I want to mention that there is an issue with receiving timely RCA deliveries. While this is not necessarily about the tool, it relates to support. The support has not been very responsive, and we are receiving RCAs a little delayed whenever we raise support cases or communicate with the TAMs. Additionally, the UI has a slight latency, which I and my team have experienced. They have also reported this latency issue when navigating through different pages.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The product's initial setup phase was super easy."
"The most valuable part of it was probably the ability to intercept and modify calls."
"The tool is loaded with many features that give us ROI."
"Its automated scanning feature saves time."
"We are in the early stage of using the solution making it difficult to fully determine the best features; however, we have noticed the CMDB and device discovery features look valuable at this time."
"I like normal dynamic scanning, general web applications scanning, and vulnerability assessments."
"The most valuable features of PortSwigger Burp Suite Enterprise Edition are the vast amount of options and ease of use. They frequently improve the solution every six months to a year. Additionally, if we want any more features we can upload a custom script to meet our needs."
"The solution's extensions really expand the capabilities and features offered by the installation."
"Detects new hosts along with vulnerabilities."
"This solution has provided information about existing vulnerabilities, and helped with quick remediation in case of global malware attacks."
"The platform's most valuable features include its robust vulnerability detection capabilities and automated remediation workflows."
"I find the solution's dashboard interesting...The response time is fine. You can pull up reports without dragging or consuming bandwidth."
"The best features of Qualys VMDR are its patch management capabilities and the ability to mitigate vulnerabilities automatically."
"Once you are set up properly and have proper acceptance from support teams, device owners and senior management you can start to scan your environment much more often which increases your organizations ability to detect vulnerabilities more often reducing your overall vulnerability footprint and corresponding business risk."
"With QualsyGuard we have been able to achieve this by utilizing its modules, such as vulnerability management, policy compliance, web scanning, malware detection, and asset tagging."
"The initial setup was good. We didn't have any problems with it."
 

Cons

"It's not a stable product. Sometimes, it takes a lot of time to scan."
"The implementation of the solution is quite complicated and could be easier."
"It would be better if the solution is cloud-based."
"The stability is a big issue. So many times the scans fail."
"It would be beneficial if Burp Suite provided predefined payloads for each attack category, such as SQL injection and cross-site scripting, to automate some tasks more effectively."
"The stability of the scans could be improved."
"The solution is a bit expensive."
"The cost per license per user could be cheaper, specifically for individual licensing."
"The price could be better. Asset view is still a legacy feature. I'm not able to extract the information about the asset with complete details. It would be better if they fixed that in the next release. I know Qualys is already working on it, so I'm hopeful it will be available in the next five or six months. That would be something that's changed where I seek improvement."
"When you want to cover yourself for scalability, you will be charged for the number you place on the scan itself."
"Qualys VM's vulnerability scan could be improved, especially the number of CVE numbers it can manage at a time."
"Web application security model needs some work."
"The reporting and dashboards could improve in Qualys VM. However, they have improved since the previous versions."
"Sometimes the scanning can get overwhelmed and start to drag when a lot of users are trying to scan at once."
"Representation of the total number of vulnerabilities (with name) vs. the number of patches (with name)."
"Some of the older features could be polished instead of focusing on releasing new features."
 

Pricing and Cost Advice

"PortSwigger Burp Suite Enterprise Edition is expensive compared to other solutions."
"The tool's pricing is reasonable and costs around 400 dollars per year."
"For Professional, it's about $400 per year."
"Although the solution can be a bit expensive for small companies, its pricing is fairly reasonable for its capabilities."
"PortSwigger Burp Suite Enterprise Edition is neither a cheap nor an expensive product. PortSwigger Burp Suite Enterprise Edition is a good tool for companies."
"There is a license for the use of this solution. We pay annually instead of monthly to receive a better discount on the price."
"The pricing and licensing for Qualys could be improved."
"We do see over $100,000 in terms of price, for mid-size programs. You likely will pay more than $100,000 without any discount. It is a bit pricey."
"An annual license for a single scanner costs around $3,000."
"Qualys VM is quite expensive. It's a subscription-based license, and it's yearly. Right now, it's open for me, and I don't have any limitations or caps on the licenses. They are seeing if the product is viable for 4500 users. I can add as much as I want, and at the end of the subscription, they'll let me know how many licenses were actually used and bill me accordingly. On a scale from one to five, I would give their pricing a three. It's still expensive."
"In Nigerian Naira, we spend about roughly four to five million to use this solution and this is expensive compared to solutions like Nessus."
"The price is very reasonable."
"We have an annual contract for Qualys VMDR. I believe it's for either two years or five years."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
893,311 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Manufacturing Company
8%
Computer Software Company
7%
Construction Company
6%
Financial Services Firm
16%
Computer Software Company
7%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise2
Large Enterprise7
By reviewers
Company SizeCount
Small Business20
Midsize Enterprise12
Large Enterprise70
 

Questions from the Community

What is your experience regarding pricing and costs for PortSwigger Burp Suite Enterprise Edition?
I am using the Community Edition, which is free, however, I understand there might be extra expenses for additional features or services.
What needs improvement with PortSwigger Burp Suite Enterprise Edition?
It would be beneficial if Burp Suite provided predefined payloads for each attack category, such as SQL injection and cross-site scripting, to automate some tasks more effectively.
What is your primary use case for PortSwigger Burp Suite Enterprise Edition?
I work with security testing tools for SaaS, focusing on static application security testing and using tools like Burp Suite for replaying Apex.
What do you like most about Qualys VMDR?
I like that we have many scanners and channels that don't overload. It helps us scan and track easily. Also, the tagging system is good for tagging. We can still use QualysAgent task ID tools even ...
What is your experience regarding pricing and costs for Qualys VMDR?
My experience with pricing, setup cost, and licensing shows that we can consider both time and money saved.
What needs improvement with Qualys VMDR?
I haven't explored Qualys VMDR's vulnerability lifecycle automation yet. One of my analysts mentioned that queries lack grouping operators in Qualys VMDR. From my experience, I would appreciate imp...
 

Also Known As

No data available
Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security
 

Overview

 

Sample Customers

Nasa, Disney, Dow Jones, Iberia Bank, IBM, Ernest and Young, Apple, Ryanair, Thyssenkrupp, Delivery Hero
Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx
Find out what your peers are saying about PortSwigger Burp Suite Enterprise Edition vs. Qualys VMDR and other solutions. Updated: April 2026.
893,311 professionals have used our research since 2012.