Qualys Review 2026: Pricing, Pros, Cons and Alternatives

A security lead buying Qualys is buying a platform subscription, not a scanner license with a sticker. The 2026 question is whether the platform earns that quote, and which published prices you can lay beside it before the call.

The small-business floors are public and the enterprise subscription is not, which is where a budget gets invented if nobody asks for the asset count.

Toolradar data: Qualys is listed as an alternative to 10 tools in a set of 19 vulnerability scanning tools, as of October 2026, on our Qualys tool page.

That page also shows 4.2 out of 5 from 202 reviews across G2, Capterra, and Trustpilot, last checked September 17, 2026. The wider shortlist is our vulnerability scanner ranking, and the Nessus head-to-head, including scan limits, is on Nessus vs Qualys.

Qualys is a cloud security and compliance company, and the purchase is a program rather than a one-time scan. Its annual report, filed February 20, 2026, says it was founded and incorporated in December 1999 and is headquartered in Foster City, California.

The same filing reports over 10,000 customers as of December 31, 2025, including a majority of the Forbes Global 100, and revenue of $669.1 million in 2025. That is the scale of the vendor on the other side of the quote.

The product a vulnerability buyer is quoted is VMDR on the Enterprise TruRisk Platform.

The VMDR product page describes asset and vulnerability management, TruRisk scoring with real-time threat indicators, and patch detection, so the queue is ranked findings rather than a raw CVE list.

Certificate inventory, PCI ASV assessments including PCI 4.0, and CIS benchmark evaluations sit on that page, which keeps a compliance report with the scan. QFlow, ServiceNow ITSM, and Jira are listed too, so a finding can become a ticket without a second product.

Qualys sells VMDR as a set of cloud apps, not a single scanner SKU.

The subscriptions page says the price depends on which apps you pick, the number of network addresses, the number of web applications, and user licenses.

Every subscription includes Global AssetView, unlimited scans, unlimited Cloud Agents for inventory, and training and support, including 24/7 telephone and online support. A team that only wanted a scanner still lands in that bundle, and the quote still starts with an address count.

You do not install a Qualys server, and the subscription is an annual bill. The annual report says there is no hardware to buy, and scans can run at the perimeter, behind the firewall, in cloud environments, and on endpoints.

Customers generally pay up front for a term that is primarily annual, so the first invoice is the term rather than a month you can drop.

The VMDR page lists virtual scanners, Cloud Agents, passive sensors, agent gateways, and container sensors, and calls that sensor list unlimited.

Findings land in one console, where TruRisk ranks them with threat intelligence instead of a raw CVE list.

Patch detection and CVE correlation stay in the base description, so you see what is missing and this package does not install the fix. FixIT adds automated patching for operating systems and more than 100 third-party applications.

Qualys says that package can be up to 40% faster at remediation, and that speed figure is the vendor's claim, not a measurement from this review.

The per-asset unit and the dollar floors live on different pages.

The patch page says VMDR is priced per asset and tells you to start a trial or request a quote, which leaves the estate undefined. The floors do not name the asset count, and unlimited inventory agents are not an unlimited asset license.

Our Tenable review compares this with a buy page that does name the asset count.

Prices below were read on October 16, 2026, and the Qualys floors still do not name an asset count. Those floors come from the VMDR TruRisk trial page, and the enterprise path is the subscriptions page, which prints no dollar amount.

Competitor rates come from each vendor's own pricing page the same day, linked in this section.

VMDR TruRisk is the base line: a unified view of assets, patch detection, certificate monitoring, CIS checks, external scanning, TruRisk, an API, reporting, and a PCI ASV assessment.

FixIT adds remediation, and ProtectIT adds behavior-based antivirus and integrated endpoint detection, so a team that needs patches installed has already left the base line.

None of the three lines says how many assets the floor buys, or whether the figure is a year, a month, or a minimum order.

Qualys says VMDR is per asset, and the annual report says subscriptions are primarily annual and invoiced in full at the start of the term.

You cannot turn the base floor into a per-asset year, and the first invoice is not a monthly charge.

Community Edition is free on the community page, and that page states no asset cap, so the free account is not a sized plan.

The trial page offers 7 days, enough to open the console and too short to stand in for a year of the estate.

The public pages support arithmetic the Qualys floors do not.

Tenable's buy page prices one year of Tenable One Vulnerability Management at the 100-asset option, then $6,825 for two years and $9,975 for three years on that option. A longer term is its own total, not the one-year price repeated.

Dividing that one-year price by 100 assets is $35 per asset for the year, a unit you can put on a spreadsheet.

The same page shows $3,700 for one year of protection for up to 250 assets, so the online rate is not one flat number.

Nessus Professional is $4,790 for one year and includes unlimited vulnerability scanning, which prices the scanner rather than the cloud asset option.

Rapid7's pricing page lists InsightVM at $1.62 per asset per month for 500 assets, and at that count the year is $9,720.

The page gives no rate below 500 assets, so a smaller estate cannot borrow this number for a comparison.

InsightVM is now part of Exposure Command, while the dollar is still labeled InsightVM, so a renewal may arrive under the newer name.

Intruder's pricing page prices Cloud and Pro as a base fee plus a per-target fee, with a five-target minimum and a 20% discount for annual billing.

Cloud is $299 a month at five infrastructure targets and zero application licenses, which is $2,870 for the year after the discount. At 20 infrastructure targets Cloud is $380 a month, or $3,650 for the year after the same discount.

A shop smaller than five targets still pays the five-target total.

Pro adds agent scanning of internal servers and employee devices at $499 a month for five targets, and Intruder says the prices exclude VAT.

Enterprise is a quote, so a large attack surface leaves the calculator. The free plan includes weekly external scans, weekly checks of one cloud account, weekly scans of two container images, and three users.

That can watch the outside while a Qualys quote is open.

Microsoft's Defender pricing page lists the vulnerability management add-on at $2.00 per user per month.

After a one-month trial the card converts the subscription to 12 paid months, so the month on the card is a year-long bill.

Microsoft's licensing page says it is an add-on for Defender for Endpoint Plan 2 or a standalone subscription, licensed per user, and that Plan 2 already includes core vulnerability management.

Twenty users at the add-on rate is $480 for a year, if you already hold Plan 2 or another plan Microsoft names, including Microsoft 365 E5.

Microsoft publishes no standalone list price on that page, so a team without Plan 2 cannot finish the budget there.

Wiz does not publish a list price, so a cloud-only comparison is two quotes, not a quote against a rate card.

Methodology: we compared Qualys's published floors with rates that name a unit, using pages read on October 16, 2026.

We computed the Tenable per-asset year, the Rapid7 500-asset year, the Intruder annual totals, and the Microsoft 20-user year from those pages. Toolradar's rating and alternative count were read the same day, and we did not install the products. A quote from Qualys can land above or below every figure in this section.

Qualys fits a team that wants inventory, vulnerability ranking, PCI scanning, and, on FixIT, patch deployment on one path. That shape is mixed servers, endpoints, and some cloud, plus a compliance report someone will ask for.

Customers in that filing run from global firms to smaller businesses. The platform is sold by a field team and by inside sales, so a smaller buyer should still expect a quote.

Skip the quote if you cannot get a written asset definition and a term, because the floor is then not a price you can compare.

A consultant who needs a scanner this week wants Nessus Professional, not a Qualys enterprise bundle.

A cloud-only estate should read our cloud security posture ranking and price Wiz, because that page covers cloud and AI from code to runtime.

If endpoints already sit in Defender, read the Defender for Business review before you pay for a second agent.

If the gap is someone watching alerts, the endpoint protection ranking is the other list, and CrowdStrike is detection, not a Qualys substitute.

Endpoint detection on Qualys means ProtectIT, a higher package than the vulnerability floor.