Vulnerability management software compared

Vulnerability management software finds the systems a business runs, scans them for known weaknesses, ranks what it finds and tracks each fix until a rescan confirms it. The eight products on this page each do three things: scan assets for vulnerabilities, rank findings by risk, and track remediation. We read each vendor's own pages, and each product page links to the sources we used.

Why ranking matters more than finding

A scanner can report thousands of findings on a modest network, and a small IT team cannot fix them all in a month. The national catalog of public flaws, the NIST National Vulnerability Database, shows how large the pile has become. NIST says CVE submissions rose 263% from 2020 to 2025, and that submissions in the first quarter of 2026 ran nearly one third above the same period of 2025.

NIST has changed how it handles that volume. On April 15, 2026, NVD moved to a risk-based model for enrichment. CVEs in CISA's Known Exploited Vulnerabilities catalog are enriched first, with a goal of one business day, while other CVEs are labeled "Lowest Priority" and are not scheduled for immediate enrichment. NIST also no longer routinely adds its own severity score when the CVE Numbering Authority has already provided one.

For a buyer, the practical result is that the free public data is thinner than it was. A scanner that relies only on a base severity score from NVD will rank thousands of findings as equally urgent. A product that adds its own exploit data, asset context or reachability checks gives the team a shorter list to work from.

Three signals worth asking about

CISA's Known Exploited Vulnerabilities catalog calls itself the authoritative source of vulnerabilities exploited in the wild and tells organizations to use it as an input to prioritization. Each entry carries a due date, and the dates vary. Two entries on the page we read were added on October 26 and October 30, 2026, with due dates three days and two weeks after they were added.

Under Binding Operational Directive 22-01, issued on November 3, 2021, US federal agencies had to fix each catalog entry by its listed due date. The directive has since been revoked and superseded by BOD 26-04. Private companies are not bound by either directive, but a catalog entry is a fair sign that attackers already use the flaw.

The second signal is the Exploit Prediction Scoring System from FIRST. It estimates the probability that a published CVE will be exploited in the wild in the next 30 days, as a score from 0 to 1 with a percentile. The scores are republished daily and are free to download. The third is the severity score, CVSS, which describes how bad a flaw could be and not how likely it is to be used.

Products differ in which signals they use. Intruder states that it ranks findings using CVSS, CISA KEV and EPSS data. Greenbone offers EPSS-based prioritization only in its paid Enterprise Feed. Tenable uses its own Vulnerability Priority Rating, and its product page does not mention EPSS or KEV. Qualys uses TruRisk with threat intelligence from more than 25 sources and does not name KEV on its product page. Ask any vendor on your shortlist which of these three signals feed its ranking and whether you can see the inputs behind a score.

Scanning approaches differ

Agent-based scanning installs software on each device, which helps with laptops that leave the office network. Network scanning probes systems from a scanner, which suits servers and network gear. Cloud-account scanning reads configuration through the provider's API. Most products here mix at least two of these.

Qualys lists unlimited virtual scanners, cloud agents, passive sensors and container sensors. ManageEngine Vulnerability Manager Plus scans endpoints through an agent and can patch them from the same console. Intruder covers internet-facing systems, cloud accounts and web apps, and it uses a license each time a target is scanned, which stays used for 30 days. Aikido starts from code, containers and cloud accounts, so it suits software teams more than a team that manages office laptops. Holm Security and Rapid7 cover network, cloud and internal assets.

Authenticated scans, which log in to a system, find more than unauthenticated ones. Rapid7's documentation notes that authenticated scans need roughly ten times the disk space of unauthenticated ones, so ask about storage and scan windows during a trial.

Tracking a fix to the end

Remediation tracking is where products differ most. The weakest version is a list of open findings that a person closes by hand. The stronger version assigns an owner, sets a due date and closes the item only after a rescan finds the flaw gone.

Rapid7's remediation projects mark each solution Open, Awaiting Verification, Will Not Fix, Closed or Reopen, and a solution marked Awaiting Verification returns to Open if a later scan does not confirm the fix. Greenbone's manual describes tickets that move from Open to Fixed to Fixed verified, with the last status set automatically after a repeat scan. Holm Security creates tickets by hand or by rule and reopens them when a new scan finds the flaw again. ManageEngine marks a vulnerability resolved once a rescan confirms it.

Ticketing links matter if the people who apply fixes do not work in the security console. Rapid7 and Holm Security name Jira and ServiceNow, Qualys names ServiceNow and Jira, and Intruder names Jira, GitHub, GitLab, ServiceNow and Azure DevOps. Tenable says it supports bi-directional ticketing but does not name the systems on the product page.

How the prices compare

Three vendors publish prices we could record, Intruder shows only its free plan, and the other four sell by quote. The published prices use different units, so they cannot be compared one to one.

Tenable lists $3,500 for one year of Vulnerability Management for 100 assets, with $6,825 for two years and $9,975 for three. ManageEngine's Professional cloud edition costs $895 a year for 100 computers, and the Enterprise edition costs $1,545. Servers are priced separately, from $195 a year for 10 servers on Professional, and each additional technician adds a charge.

Aikido and Intruder use plans. Aikido lists a free plan for two users, then $300 a month for Basic and $600 a month for Pro, each with 10 users, and 10% off for annual billing. Intruder has a free plan, a 14-day trial and a stated saving of 20% on annual billing, while its Cloud and Pro prices do not appear as numbers on the pricing page we read.

Qualys, Rapid7, Greenbone and Holm Security publish no prices. Qualys offers a 30-day trial, Greenbone offers a 14-day trial of OPENVAS BASIC, and Holm Security links a trial without stating its length. Rapid7's pricing page sends buyers to a demo request. Holm Security says contracts usually run one to three years. For these four, a quote is the only way to learn the cost, and the quote will depend on how you count assets.

The asset count decides the bill

Vendors count assets in different ways. Tenable counts assets, ManageEngine counts computers and servers, Holm Security counts active IP addresses for network scanning, and Intruder counts licenses used per scan target. Rapid7 says billable asset usage is tracked against the customer's entitlement.

A business with 300 laptops, 40 servers and a cloud account will get a different number of billable units from each vendor. Count the devices that sit behind each definition before asking for quotes, and ask how short-lived cloud instances and containers are counted. Written answers prevent a surprise at the first annual true-up.

Free and open source options

Greenbone's Community Feed is free and is included in OPENVAS FREE, but it leaves out EPSS-based prioritization, CIS compliance checks and Enterprise Support. Intruder's free plan offers weekly external scans on 5 infrastructure licenses without web app or API scanning. Aikido's free Developer plan covers 10 repos, 2 container images, 1 domain and 1 cloud account, with rescans every 3 days.

A free tier is a sound way to test a scanner on a real network. It rarely includes the ticketing and reporting that a compliance audit asks for, so check which features sit behind the paid plan.

Compliance evidence

Scan reports often serve as audit evidence. Qualys lists PCI ASV assessments, and Holm Security describes PCI ASV scanning as ASV-certified. Greenbone's Enterprise Feed adds CIS Benchmark checks, and ManageEngine states coverage of more than 130 CIS benchmarks. We did not record each vendor's own SOC 2 or ISO 27001 status for this page, so ask for current reports before signing.

What to test during a trial

• Scan one subnet, one cloud account and five laptops, then count how many findings each product reports for the same hosts.
• Take the ten highest-ranked findings and check whether each is in CISA's KEV catalog or has a high EPSS score.
• Create a ticket in your own tracker, fix the flaw, rescan and note whether the item closes without manual action.
• Ask for a written definition of a billable asset and a quote for twice your current count.