Sold by: Qualys
Deployed on AWS
Qualys VMDR (Vulnerability Management, Detection, and Response) allows you to discover, assess, prioritize in real time across your global hybrid IT environment.
4.3
Overview
Qualys VMDR seamlessly brings together discovery, assessment, detection and response into a single cloud-based app - significantly reducing risk, and effectively prevent breaches.
Highlights: Comprehensive coverage and visibility Pre-approved scanner for AWS EC2 Cloud AWS EC2 Cloud Connector
Highlights
- Comprehensive coverage and visibility. Cloud context aware scanning, providing end to end visibility from inventory and remediation.
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
VMDR Package 128 | Package of 128 Hosts for VMDR | $596.00 |
VMDR Package 256 | Package of Hosts for VMDR | $942.00 |
VMDR Package 512 | Package of 512 Hosts for VMDR | $1,489.00 |
VMDR Package 1024 | Package of 1024 Hosts for VMDR | $2,352.00 |
VMDR Package 1536 | Package of 1536 Hosts for VMDR | $3,075.00 |
VMDR Package 2048 | Package of 2048 Hosts for VMDR | $3,719.00 |
VMDR Package 2560 | Package of 2560 Hosts for VMDR | $4,309.00 |
VMDR Package 3072 | Package of 3072 Hosts for VMDR | $4,857.00 |
VMDR Package 4096 | Package of 4096 Hosts for VMDR | $5,878.00 |
VMDR Package 5120 | Package of 5120 Hosts for VMDR | $6,805.00 |
Dimensions summary
You buy Qualys VMDR under a contract based on host packages. Each dimension covers a fixed number of hosts you plan to protect. Options range from 64 hosts up to 5,120 hosts, with steps at 64, 128, 256, 512, 1024, 1536, 2048, 2560, 3072, 4096, and 5120. You pick the package that matches your host count. Larger packages cover more hosts under one commitment. Pricing scales with the host quantity you choose, so you select the tier that fits the size of your environment.
Top-of-mind questions for buyers
A host is a single asset you scan or monitor, such as a server, virtual machine, or workstation. Each package covers a set number of these assets. Every virtual machine counts as one host, even when several share the same physical server.
Each package covers a fixed host count under one contract. If your environment grows beyond that count, you move to a package that covers more hosts. The change is not automatic. You pick the tier matching your host count when you commit.
VMDR discovers, assesses, prioritizes, and helps patch vulnerabilities across the hosts in your package. It covers vulnerability detection and response for each protected asset. Coverage is the same per host across every package size; only the host count differs.
www.qualys.com
Helpful?
Vendor refund policy
Licensed Qualys customers should refer to their Service User Agreement (SUA) or contact their Qualys Technical Account Manager if they have questions about refund or cancellation policies which would apply to them.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Qualys' policy is to respond to all Qualys customer cases promptly as per SLA. An incident ticket is assigned a priority number based on the nature of the issue. || Service Level Agreement (SLA): https://www.qualys.com/support/sla/ https://www.qualys.com/support/ || support@qualys.com || US/Canada: +1 (866) 801-6161 (toll free) or +1 (650) 801-6161 || UK/Europe/International: +44 (0)1753 872102 || France: +33 1 41 97 35 81
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Qualys
By SAINT
By yamory Cloud Security Platform
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Cloud-Based Vulnerability Management Platform
Single cloud-based application that integrates discovery, assessment, detection, and response capabilities for vulnerability management
AWS EC2 Integration
Pre-approved scanner for AWS EC2 Cloud with AWS EC2 Cloud Connector for seamless cloud environment integration
Cloud Context-Aware Scanning
Scanning functionality that provides cloud context awareness to deliver end-to-end visibility across inventory and remediation
Real-Time Prioritization
Real-time prioritization of vulnerabilities across global hybrid IT environments
Comprehensive Asset Discovery and Assessment
Discovery and assessment capabilities that provide comprehensive coverage and visibility across hybrid IT infrastructure
Vulnerability Scanning
Integrated vulnerability scanning capability with automatic updates to protect against latest vulnerabilities
Penetration Testing
Penetration testing functionality integrated within the platform for security assessment
Scan Policy Configuration
20 built-in scan policies available with support for custom policy creation
Compliance Reporting
Compliance reporting templates supporting PCI, FISMA, HIPAA, NERC CIP, and SOX standards
Multi-Scanner Architecture
Support for both standalone and multi-scanner deployment architectures
Cloud Asset Scanning
Vulnerability management through extraction of dependent components in servers, containers, and applications by connecting AWS account to the service
Software Bill of Materials Management
Extraction of dependent components in application code with Software Composition Analysis (SCA) capabilities and vulnerability management functions
Configuration Management
Checks and manages AWS configuration deficiencies based on general rules such as CIS Benchmarks
End-of-Life Software Detection
Detection and management of end-of-life software based on extracted SBOM information using maintained EOL master database
Threat-Based Automatic Triage
Automatic prioritization of vulnerabilities based on threat level to focus resources on high-risk vulnerabilities
Standard contract
No
No
No
Customer reviews
Abdul Samad Irfan Shaik
Risk-based insights have transformed how our teams now prioritize and resolve critical vulnerabilities
Reviewed on Oct 15, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for Qualys Exposure Management is to handle vulnerability across multiple systems since we have a large number of systems where risk management is a serious consideration. We thought of bringing Qualys Exposure Management into our infrastructure to scan various systems and provide us with vulnerability scan reports so that we can remediate and resolve issues effectively.
A recent specific example of how I'm using Qualys Exposure Management is by enabling Qualys agents on employee laptops, which provide continuous information about the machines. This is particularly useful for remote laptops that rarely connect to corporate networks, as Qualys agent tracks everything on the user's end and sends any vulnerabilities to Qualys cloud for scanning and reporting to network admins.
In our day-to-day operations, Qualys Exposure Management tracks systems across various endpoints, ensuring that all production systems are monitored. We find Qualys Exposure Management powerful due to its combination of asset tags and cloud agent scanning capabilities, coupled with connectors and other mechanisms that enhance its functionality. This diverse range of options for performing vulnerability scans greatly benefits our projects and contributes to organizational growth.
How has it helped my organization?
Qualys Exposure Management has positively impacted my organization by enhancing security and operational outcomes. Before implementing Qualys Exposure Management, we relied on alerts that often missed critical vulnerabilities, but now we prioritize risks effectively, resulting in better asset visibility, faster remediation, and improved SLA compliance, which in turn has built trust with our customers.
After implementing Qualys Exposure Management, our critical vulnerabilities' mean time to resolve (MTTR) decreased from around 20 days to five to seven days, resulting in a 65-70% improvement. Additionally, we now meet SLA targets with 90% of critical findings addressed within the designated time frame.
What is most valuable?
The best features of Qualys Exposure Management include its risk prioritization mechanism, which focuses on business context to identify vulnerabilities that need fixing first, rather than solely relying on CVSS scores. It also has excellent asset discovery capabilities that continuously identify endpoints, servers, and network devices while keeping track of the systems being scanned.
The risk prioritization feature has significantly helped my team by allowing us to focus on the most critical vulnerabilities detected across our 10,000+ servers. For instance, if server A has a CVSS score of 9.8, but server B has a higher true risk score due to its Log4j enablement, it gets prioritized for remediation. This multi-dimensional assessment approach helps us concentrate on the most pressing risks first.
The dashboards and reporting features of Qualys Exposure Management are crucial as they turn vulnerability data into insightful views. They provide information on risk levels, asset prioritization, patch statuses, and top risky assets, which makes identifying systems that need attention much easier. The dashboards offer real-time operational views, while reports cover packaged information for longer durations.
In terms of governance and security, Qualys Exposure Management is a fantastic tool that ensures regular vulnerability scans of systems and compliance with organizational information security standards to keep data secure from attackers.
Regarding its AI capabilities, Qualys Exposure Management adds value through AI-powered risk analysis, better prioritization, threat intelligence enrichment, and risk summarization, which help us focus on critical vulnerabilities before they are exploited.
What needs improvement?
Some areas for improvement in Qualys Exposure Management include simplifying the learning curve, as understanding the system can be challenging for some users.
Other needed improvements are in the UI/UX, simplifying navigation, enhancing reporting flexibility, and better handling of false positives. The learning curve and a need for simpler onboarding materials could also greatly help new users.
I believe I have covered all the necessary improvements needed for Qualys Exposure Management that are crucial for organizations today.
For how long have I used the solution?
I have been using Qualys Exposure Management for more than four years.
What do I think about the stability of the solution?
Qualys Exposure Management is definitely stable.
What do I think about the scalability of the solution?
Qualys Exposure Management is very scalable, as the level of service you receive depends on how you utilize the system. It has no limitations and is designed to grow with your needs.
How are customer service and support?
Customer support is really great, with an average ticket turnaround time of about three days, and they respond swiftly to high-priority incidents, often resolving them in under 30 days.
Which solution did I use previously and why did I switch?
Previously, we used Microsoft Defender but switched to Qualys Exposure Management because Defender's multiple use cases became complex and costly, whereas Qualys Exposure Management consolidated everything into one tool with robust reporting capabilities.
What was our ROI?
We have seen a return on investment through reduced employee counts and decreased incident resolution times, resulting in better SLA outcomes and an increase in the number of customers utilizing our services.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing is that it is moderate; the setup cost was reasonable, with licenses based on the number of systems being scanned. We use the Q-flex consumption model, where we pay based on the volume of flex consumed for scanning assets.
Which other solutions did I evaluate?
We evaluated CrowdStrike and other solutions but found them lacking in service and budget; Qualys Exposure Management offered a better SLA and outcomes, which made us happy with our decision.
What other advice do I have?
My advice for others considering Qualys Exposure Management is that it is a great tool for securing systems from vulnerabilities that can significantly impact revenue. I recommend it for mid to large-scale enterprises, as smaller organizations may find the cost and learning curve challenging. I rate Qualys Exposure Management a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Higher Education
Great Vulnerability Insights, But API, Support, and Deployment Need Work
Reviewed on Aug 10, 2026
Review provided by G2
What do you like best about the product?
it tells me vulnerabilities that exist in my various systems
What do you dislike about the product?
their API, their customer service, their ease of deployment
What problems is the product solving and how is that benefiting you?
it tells me about vulnerabilities within my environemnt
Ajay Paul
Vulnerability management has prioritized high‑risk patching and simplified bulk system reporting
Reviewed on Aug 07, 2026
Review provided by PeerSpot
What is our primary use case?
I use Qualys Enterprise TruRisk Management for vulnerability management. We receive reports daily from Qualys Enterprise TruRisk Management that show which systems have vulnerabilities and prioritize them based on risk factors. This allows us to identify which systems have more vulnerabilities or higher risk levels and take appropriate action. We primarily use this tool for patch management and vulnerability patch management.
What is most valuable?
The most valuable feature is the ability to get vulnerability lists for bulk systems. My company has more than 300,000 employees, so we can generate a report of all systems and filter the results by location. This is the most interesting aspect of the tool. Additionally, Qualys Enterprise TruRisk Management provides many scoring metrics for critical and non-critical vulnerabilities, as well as high-risk ratings. This allows us to prioritize which vulnerabilities are more critical and focus on those first. Qualys Enterprise TruRisk Management also provides resolutions for vulnerabilities. For example, if a Windows update is missing, we can patch those systems directly from Qualys Enterprise TruRisk Management. It will connect directly to the Microsoft site and download the patch, so there is no need to search for patches separately. The patch will install directly from Qualys Enterprise TruRisk Management itself. For vulnerability management, Qualys Enterprise TruRisk Management is very good for our organization.
What needs improvement?
The primary issue is with the reporting functionality. Even though we fix vulnerabilities, the reports do not reflect the changes immediately. Sometimes we need to manually run a script to scan the systems before Qualys Enterprise TruRisk Management will update the scan results. The main issue is the reporting delay, and sometimes the Qualys Enterprise TruRisk Management agent will not scan the system, which means we do not receive accurate reports in a timely manner. Additionally, there are many metrics for calculating vulnerabilities, such as the Qualys ID, severity scores, CVSS scores, and other metrics. The abundance of information can be confusing. These two aspects are the most significant negatives I have experienced with this tool.
For how long have I used the solution?
I have been using this tool for the last one year.
What do I think about the stability of the solution?
I experienced a stability issue last week. For approximately 12 hours, we did not have access to Qualys Enterprise TruRisk Management. Even when we regained access, instead of displaying all 300 plus systems, it only showed fewer than 50 systems. This issue persisted for 12 hours and was only resolved after one day. I am uncertain whether the issue was caused by Qualys Enterprise TruRisk Management or our internal team. In one year of use, I have experienced this issue only once, when we lost access for one day.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is highly scalable. As my company has many employees, the tool performs very well for handling this large number of users. I believe the tool is very scalable for enterprise environments.
How are customer service and support?
I cannot contact Qualys Enterprise TruRisk Management directly. Only our Qualys team can contact them. I do not have the ability to contact them directly.
Which solution did I use previously and why did I switch?
I have not used other solutions in this company. However, in my previous company, I used a tool called ManageEngine. Compared with ManageEngine, Qualys Enterprise TruRisk Management is by far better.
What about the implementation team?
In my company, we have nearly 300,000 employees and approximately five or six team members dedicated to Qualys Enterprise TruRisk Management. They handle the deployment, access management, and patching for the entire organization. The size of the implementation team depends on the company size. If the company has very few users, such as 10 to 100 users, one fully dedicated team member is sufficient for managing the deployment.
What's my experience with pricing, setup cost, and licensing?
I am not familiar with the pricing structure. I know that Qualys Enterprise TruRisk Management charges per user, but I do not have detailed knowledge of the pricing. The pricing decisions are handled by the marketing team and senior management, so I do not have information about those details.
What other advice do I have?
Qualys Enterprise TruRisk Management is very easy to use. If we have access to the system, there is no need for high technical knowledge, and an average person can navigate and use this tool easily. The tool is also available as a web application, making it very easy to access. If we have internet connectivity and a password, we can access it from any laptop or location. The entire process depends on the type of vulnerability being addressed. For example, for Windows patch updates, the process takes between half an hour and one hour to fully complete, depending on internet speed. I consider this a normal timeframe and it does not take excessively long. I would rate this review an 8.5 out of 10.
SharmaAbhijeet
Centralized risk-based visibility has improved vulnerability remediation and automates patching
Reviewed on Jul 13, 2026
Review provided by PeerSpot
What is our primary use case?
We are using Qualys Enterprise TruRisk Management for vulnerability management. It identifies, prioritizes, and remediates vulnerabilities while focusing on the business risk itself. The latest TruRisk platform provides this functionality, and we are not just getting vulnerability counts, but we are actually working on the business risk of the vulnerabilities.
We automate the vulnerability patching with Qualys Enterprise TruRisk Management and use patch management as well. In this overall scenario, we are automating the risk factor using Qualys for risk.
What is most valuable?
Qualys Enterprise TruRisk Management is a centralized vulnerability platform that provides us with wide centralized visibility. It has risk-based prioritization, useful reporting capabilities, and integration with different assets is quite easy. It is scalable in our environment.
With Qualys Enterprise TruRisk Management, we are able to perform risk-based prioritization. It is scalable for our environment, which gives us a good advantage. Reporting is very useful, so we get valuable reports.
Risk-based prioritization is a new feature with Qualys Enterprise TruRisk Management, and overall, the vulnerability posture of our organization has improved significantly. Qualys has quite improved the overall vulnerability management.
With Qualys Enterprise TruRisk Management, we are able to automate processes and prioritize risks. The resources who were previously working on the administrative part of vulnerability management are now free to work on different areas and are able to automate the administrative part. They are working on the automation and are able to address different vulnerabilities and patch them in time. This helps us considerably, and resources are easily managed.
With Qualys Enterprise TruRisk Management, all three metrics have improved. Resource allocation has decreased, time has improved, and we are getting positive results.
What needs improvement?
Qualys Enterprise TruRisk Management is a big platform, and the initial deployment is tedious.
Licensing and features are somewhat complex for new customers, and that area could be improved.
For how long have I used the solution?
I have been working on Qualys Enterprise TruRisk Management for around three years.
What do I think about the stability of the solution?
Qualys Enterprise TruRisk Management has been stable, and no downtime has been experienced.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is scalable, and that is why we opted for it. It is one of the best products available for scalability.
How are customer service and support?
We reach out to customer support for Qualys Enterprise TruRisk Management occasionally, and it is quite easy to reach them. False positives are the main issue that we encounter and need to be handled by the support team.
Which solution did I use previously and why did I switch?
We were using a ManageEngine solution previously with Qualys Enterprise TruRisk Management, and we were conducting a proof of concept. As our environment was quite large, we migrated to Qualys, which proved to be more useful and more powerful for this environment.
How was the initial setup?
My experience with pricing, setup cost, and licensing for Qualys Enterprise TruRisk Management was somewhat tedious, and it consumed a lot of time.
Which other solutions did I evaluate?
Before choosing Qualys Enterprise TruRisk Management, we conducted a requirement analysis and selected a few vendors. We performed our own proofs of concept and finalized Qualys.
What other advice do I have?
We reach out to customer support for Qualys Enterprise TruRisk Management occasionally, and it is quite easy to reach them. False positives are the main issue that we encounter and need to be handled by the support team.
If you are looking for a good vulnerability management platform with Qualys Enterprise TruRisk Management and are open to a cloud-based or hybrid-based environment with good scalability for a large environment, you should choose Qualys. I would rate this solution a 9 out of 10.
Information Technology and Services
Real-Time Asset Visibility and TruRisk Prioritization at Scale
Reviewed on Mar 16, 2026
Review provided by G2
What do you like best about the product?
Real‑Time Asset Visibility
Risk-Based Prioritization (TruRisk)
Cloud‑Native & Highly Scalable
Integrates with ServiceNow, Splunk, QRadar, Sentinel etc.
Risk-Based Prioritization (TruRisk)
Cloud‑Native & Highly Scalable
Integrates with ServiceNow, Splunk, QRadar, Sentinel etc.
What do you dislike about the product?
Limited Third‑Party Application Patching
What problems is the product solving and how is that benefiting you?
Continuously tracks new assets as they appear so environments don’t become outdated or incomplete.
Turns vulnerability volume into meaningful, risk‑based actions.
Allows creating automated remediation workflows and packaging patches directly.
Turns vulnerability volume into meaningful, risk‑based actions.
Allows creating automated remediation workflows and packaging patches directly.