Software · head to head
Nessus vs Qualys VMDR
Qualys VMDR
Software
Vulnerability management, detection, and response
- From
- $3/month
- Rated
- -
The short version
- Only Nessus has a free tier, so it costs nothing to try first.
- Each has a real cost: Nessus nessus Professional is $4,790 for one year, with no free or low cost commercial tier; Qualys VMDR listed on UK G-Cloud at £18.75 to £61.58 per device per year for the Qualys Cloud Platform and VMDR, via reseller Barrier Networks Limited
- They diverge on capability: Nessus covers Configuration auditing, Qualys VMDR covers Threat detection.
Where they differ
Only the attributes on which Nessus and Qualys VMDR actually diverge.
| Attribute | Nessus | Qualys VMDR |
|---|---|---|
| Starting price | Free | $3/month |
| Free tier | Yes | No |
| Platforms | Desktop, Api | Web, Cloud, Api |
| Founded | 2002 | 1999 |
Identical on both: pricing model (subscription), user rating (Not yet rated), category (Unknown).
What each one covers
Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.
Only in Nessus
- Configuration auditing
- Malware detection
- Web application scanning
- Cloud scanning
- Compliance checks
- Patch auditing
- Pre-built policies
- JIRA
Only in Qualys VMDR
- Threat detection
- Asset discovery
- Compliance checking
- Remediation tracking
- Cloud asset visibility
- API access
- Custom policies
- Jira
Both cover
- Vulnerability scanning
- ServiceNow
- Splunk
- AWS
- Azure
- Google Cloud
What people use each for
The jobs each tool is most often brought in to do.
Nessus
- Scanning hosts and applications for known vulnerabilities and misconfigurationsnot Qualys VMDR
- Running compliance and configuration audits against a defined scopenot Qualys VMDR
Qualys VMDR
- Vulnerability Managementnot Nessus
- Asset Managementnot Nessus
- Compliancenot Nessus
Where each one falls short
Documented limitations, not opinions. Every one is a constraint you would hit in normal use.
Nessus
- Nessus Professional is $4,790 for one year, with no free or low cost commercial tier
- Multi year terms are the only discount route, at $9,330.95 for two years and $13,637.54 for three
- It is a single user scanner, so team workflows mean migrating to another Tenable product
- Tenable One vulnerability management is priced separately, starting at $3,500 a year for 100 assets
Qualys VMDR
- Listed on UK G-Cloud at £18.75 to £61.58 per device per year for the Qualys Cloud Platform and VMDR, via reseller Barrier Networks Limited
Pricing, plan by plan
Nessus
Free- Nessus Essentials (Free)Free
- 16 IP addresses
- Vulnerability scanning
- Configuration auditing
- Nessus Professional$2990/year
- Unlimited IPs
- Compliance checks
- Live results
- Nessus Expert$5290/year
- All Pro features
- External attack surface
- Cloud infrastructure scanning
Qualys VMDR
$3/month- VMDR$3/month
- Per asset
- Vulnerability scanning
- Detection
- VMDR+$5/month
- All VMDR features
- Advanced analytics
- Cloud integration
- VMDR Complete$7/month
- All VMDR+ features
- Threat intel
- Response automation
Which should you pick?
Choose Nessus if
- You need configuration auditing.
- You want to start without paying.
- You work on Desktop, Api.
- You also want malware detection.
Choose Qualys VMDR if
- You need threat detection.
- You work on Web, Cloud, Api.
- You also want asset discovery.
Questions people ask
- Is Nessus or Qualys VMDR better?
- Neither clearly leads. Nessus starts at Free and Qualys VMDR at $3/month, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
- Which is cheaper, Nessus or Qualys VMDR?
- Nessus has a free tier; the other does not. Paid plans start at Free for Nessus and $3/month for Qualys VMDR.
- Does Nessus or Qualys VMDR run on more platforms?
- Nessus runs on Desktop, Api. Qualys VMDR runs on Web, Cloud, Api.
- Can I use Nessus for free?
- Yes. Nessus has a free tier, so you can try it without paying. Qualys VMDR starts at $3/month.
- What is Nessus best used for?
- Nessus is most often used for scanning hosts and applications for known vulnerabilities and misconfigurations, running compliance and configuration audits against a defined scope. Of those, scanning hosts and applications for known vulnerabilities and misconfigurations and running compliance and configuration audits against a defined scope are not what Qualys VMDR is typically brought in for.
- What can Nessus do that Qualys VMDR cannot?
- Nessus covers Configuration auditing, Malware detection, Web application scanning, Cloud scanning. Qualys VMDR covers Threat detection, Asset discovery, Compliance checking, Remediation tracking. Both handle Vulnerability scanning, ServiceNow, Splunk, AWS.