

Qualys VMDR and Vulcan Cyber compete in the vulnerability management category. Qualys VMDR seems to have an edge due to its comprehensive vulnerability assessment and patch management features, while Vulcan Cyber stands out with its centralized data consolidation and advanced threat analysis capabilities.
Features: Qualys VMDR offers robust vulnerability assessment, diverse scanning capabilities including cloud and container security, and a user-friendly dynamic dashboard for detailed reporting. Vulcan Cyber features centralized data consolidation from multiple scanners, a holistic vulnerability platform, and an intuitive single-pane-of-glass interface with prioritization and automation capabilities.
Room for Improvement: Qualys VMDR can improve its user experience by simplifying the asset inventory interface and expanding scanning capabilities to IoT and SCADA systems. Enhancing reporting flexibility and integration options is also desired. Vulcan Cyber needs to improve data filtering, speed, and connector updates while reducing false positives and improving integration options.
Ease of Deployment and Customer Service: Qualys VMDR provides flexible deployment options including on-premises and cloud environments with responsive global support. However, there's a need for improved response time and personalized assistance. Vulcan Cyber primarily deploys in public cloud settings with versatile support, though improvements in addressing complex queries are desired.
Pricing and ROI: Qualys VMDR is seen as expensive for smaller organizations but offers substantial value through comprehensive features and integration capabilities, leading to significant ROI. Vulcan Cyber's pricing is competitive and justified by its automation and unique capabilities, offering evident returns on investment through enhanced security postures.
We saw a return on investment through significant savings in time, money, and resources.
With our vulnerability management platform, I used to get reports weekly, but with Vulcan Cyber, I get them daily.
Our security team probably spends 15 minutes instead of two hours daily notifying the teams.
We usually get on calls with tech support, and they are very helpful.
The response time takes a while.
The technical support provided by Qualys is pretty good.
We do not necessarily have visibility of when those feature requests are going into the development pipeline.
It would enhance my experience if Vulcan informed customers of forthcoming maintenance or changes that might cause website downtime.
Their technical support team is very good, knowledgeable, and helpful.
Scalability depends on the license and the number of assets being monitored.
Qualys VMDR can handle scalability, although increasing the inventory can raise the licensing costs.
Qualys VMDR's scalability is good, and the customer support is good.
We have a lot of assets under management, and it effectively scales up to accommodate hundreds or even thousands of assets.
I'd rate the scalability ten out of ten.
I would rate it ten out of ten for scalability, as integration with multiple connectors is possible without exceeding licensing limits.
Qualys VMDR is stable.
It would be better if Vulcan notified me, the customer, about upcoming maintenance or changes, indicating when the website might be down.
The product's stability is commendable, with no noticeable lags or slowness.
I would rate it a nine out of ten in terms of stability.
It does not automate patching unless the patch management module is purchased separately.
If AI features were integrated, it could enhance the capabilities significantly.
One area where Qualys VMDR can be improved is the missing feature for deploying agents for over 1,000 assets, as we need to do it manually.
It would be beneficial if the platform allowed remote access to devices for immediate remedies.
Providing real-world examples of how to construct a ticket format for Jira, Azure DevOps, or ServiceNow with specific examples would help us understand how it might work in our environment.
Having it more customized or providing more customization options for me would be beneficial.
I would rate the pricing between seven to eight out of ten.
I have a notion that Qualys might be more expensive than Rapid7.
Qualys offers better pricing and is feature-packed compared to other tools.
For our use case, the solution is lacking some features, and the cost savings don't make it worth it.
The prioritization of vulnerabilities has improved our remediation efforts by around thirty to thirty-five percent.
It impacts my workflow overall, with the patch management features as it has the missing patches listed in detail, making it easier to get a comprehensive report and providing some dashboards that offer visual representation.
Qualys VMDR's continuous monitoring capabilities help us respond to emergent threats by enabling my team to reach out to the security engineers whenever there is any detection of a vulnerability, informing them about it, and creating an incident.
It offers a comprehensive view of the assets and their associated vulnerabilities, which aids in assessing and mitigating threats.
The automation capabilities using the Vulcan API platform or the API feature allow me to easily automate scripts and reports and schedule them.
Instead of having 100 vulnerabilities and not knowing how to prioritize and assign all your FTEs there, you now have only ten that you know you need to fix, and you're assigning the right number of FTEs.
| Product | Market Share (%) |
|---|---|
| Qualys VMDR | 5.0% |
| Vulcan Cyber | 0.6% |
| Other | 94.4% |

| Company Size | Count |
|---|---|
| Small Business | 20 |
| Midsize Enterprise | 12 |
| Large Enterprise | 70 |
| Company Size | Count |
|---|---|
| Small Business | 1 |
| Large Enterprise | 10 |
Vulnerability Management, Detection, and Response (VMDR) is a cornerstone product of the Qualys TruRisk Platform and a global leader in the enterprise-grade vulnerability management (VM) vendor space. With VMDR, enterprises are empowered with visibility and insight into cyber risk exposure - making it easy to prioritize vulnerabilities, assets, or groups of assets based on business risk. Security teams can take action to mitigate risk, helping the business measure their actual risk exposure over time.
Qualys VMDR offers an all-inclusive risk-based vulnerability management solution to prioritize vulnerabilities and assets based on risk and business criticality. VMDR seamlessly integrates with configuration management databases (CMDB), Qualys Patch Management, Custom Assessment and Remediation (CAR), Qualys TotalCloud and other Qualys and non-Qualys solutions to facilitate vulnerability detection and remediation across the entire enterprise.
With VMDR, users are empowered with actionable risk insights that translate vulnerabilities and exploits into optimized remediation actions based on business impact. Qualys customers can now aggregate and orchestrate data from the Qualys Threat Library, 25+ threat intelligence feeds, and third-party security and IT solutions, empowering organizations to measure, communicate, and eliminate risk across on-premises, hybrid, and cloud environments.
Vulcan Cyber is used by leading cyber security organizations to manage exposure risk created by unmitigated infrastructure, application, code and cloud vulnerabilities.
The Vulcan Cyber ExposureOS starts by correlating and normalizing risk and asset data aggregated from hundreds of vulnerability scanners, asset repositories and threat intelligence feeds. These signals are then used to create a singular view of your organization's attack surfaces to make exposure risk and vulnerability prioritization accurate and actionable.
Vulcan Cyber ExposureOS reduces mean time to remediation by fostering efficient collaboration among security teams, asset and remediation owners through orchestrated workflows and automated remediation tasks.
Use Vulcan Cyber to measure security posture improvement, efficacy of vulnerability risk mitigation campaigns, and compliance with SLAs and regulatory frameworks such as PCI DSS, DORA, NIS2 and HIPPA.
Vulcan Cyber is the only vulnerability risk management solution provider to be named a "Leader" in both the Forrester Wave and Omdia Universe evaluations in 2023.
We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.