Qualys VMDR vs. Tenable Nessus

Qualys VMDR is best suited for larger companies with a very large IT asset footprint. Qualys VMDR is not suited for businesses that are small and upcoming as the price for the tool is very expensive and could be a budget sink if not used properly. In our organization we use the Qualys VMDR dashboard and reporting in order to collect any vulnerabilities we miss during our routine audits to ensure that our environment is stable and protected for attacks.

Incentivized

Nessus is perfectly suitable for performing comprehensive vulnerability assessment scans being a vulnerability scanner. It is less appropriate for performing penetration testing since it is not a penetration testing tool, it does not have the ability and modules to exploit the vulnerabilities of the system.

Incentivized

• vulnerability detection
• updated CVEs and support from product
• Reporting
• Scheduling tasks

Incentivized

• With Nessus we can find the missing critical patches for a server or workstations.
• Nessus points out any vulnerable or outdated software Technologies used in the system, thus eliminating any chances for security flaws being turned up.
• Nessus typically points any configuration level issues in accordance with the OWASP guidelines. Even the configuration of SSL related which are most of the time handled by some vendors or 3rd parties.
• Nessus not only lists out these Vulnerabilities but describes clearly the vulnerabilities in details with its thousands of plugins updated regularly, the tool also recommends solution with practical details of easy implementation.

Incentivized

• Front-line technical support
• A little expensive in comparison with other solutions

Incentivized

• Could use an upgrade within reports.
• Scans can take a long time to complete. Have to break them down in small sections.

Incentivized

Nessus is best and easy to use application for Vulnerabilities finding and reporting, it has multiple platforms and wide scope covering almost all devices for security improvement so far, thus we are very likely to continue its services.

Incentivized

It's very much a plug and play application that the user can go into with limited knowledge and set-up scans in minutes.

Incentivized

This is iron but I am giving it 5 star and I can give more If I can do because they are best in support. So once you own this product they will assign a dedicated support for you and when you are under the weather with anything just connect them with anything call, ping or ticket they will come like Genie.

I haven't needed to contact support yet. But issues are easily solved with a quick internet search which means support and by extension, the larger community are involved and knowledgeable.

Incentivized

Qualys VMDR was selected against competitors because of the depth of insight the platform provides. When stacked against other competitors, platforms like Syxsense couldn't produce the same level on insight and reporting like how Qualys VMDR does. Qualys VMDR also does a great job at gathering information about the latest security definitions and using those to analyze our environment to alert of any vulnerabilities. Something that Syxsense couldn't.

Incentivized

Sometimes when we identify a vulnerability with Nessus that has an exploit, we made a proof of concept with Metasploit in order to show to the IT managers the importance of the software/hardware hardening.

Incentivized

• Faster patching
• Easy reports for multiple teams to work in coordination
• Solutions to patch vulnerabilities

Incentivized

• Nessus certainly has a positive impact while me while performing my job, either as security research, or performing vulnerability assessments for clients. It gives a lot of information about the system/application after performing scans. The number of false positives is also less compared to other vulnerability scanners.
• The professional edition is very useful as policy templates available in this edition are very handy and useful even to perform compliance scan like PCI DSS scan.
• Also, the ability to export the scan results into reports in formats like HTML, PDF is very useful which could be for performing system/application reviews.

Incentivized