Overview
Qualys VMDR (Vulnerability Management, Detection and Response) is the core vulnerability management application of Qualys’s cloud platform, which Qualys now calls the Enterprise TruRisk Platform. It discovers and inventories known and unknown assets across hybrid environments, detects vulnerabilities and prioritizes them with TruRisk scoring and the Qualys Detection Score (QDS).
Data comes from Qualys sensors: virtual scanners, virtual passive scanning sensors and Cloud Agents, which Qualys includes with VMDR. VMDR correlates vulnerabilities with the patches that fix them, including the latest superseding patch, and can hand off to Qualys Patch Management for automated and zero-touch patching.
Qualys sells VMDR per asset, with nothing to install on the platform side, and offers a 30-day free trial. Patch Management, ServiceNow CMDB synchronization and some other capabilities are add-ons.
Key Features
Asset Discovery
Detects and inventories known and unknown assets connecting to a hybrid IT environment.
TruRisk Prioritization
Quantifies risk across vulnerabilities, assets and asset groups using factors beyond the CVSS score.
Qualys Detection Score
QDS ranks individual detections and shows the risk factors behind critical scores.
Patch Detection
Maps vulnerabilities to the patches that fix them, including the latest superseding patch.
Patch Management (add-on)
Deploys patches through Qualys Cloud Agents, including zero-touch patching.
Included Sensors
Unlimited virtual scanners, virtual passive scanning sensors and Cloud Agents.
Pros & Cons
Advantages
- 30-day free trial of VMDR
- Cloud service with no platform software to install or update
- Scanners, passive sensors and Cloud Agents included
- Prioritization that goes beyond CVSS with TruRisk and QDS
- Detection and patching can run in the same platform
Disadvantages
- No published prices
- Patch Management and ServiceNow CMDB sync are add-ons
- Many separately licensed Qualys apps can make purchasing complex
Pricing
Pricing is quote-based. Qualys prices VMDR per asset and does not publish list prices.
VMDR subscription
Per-asset pricing, including asset discovery, vulnerability detection, TruRisk and the Qualys sensors.
Add-ons
Patch Management, ServiceNow CMDB synchronization, mobile device patch management and container runtime security.
Free trial
30 days, with no software to download or install.
Recommended Certifications
Qualys offers product training and certifications for its cloud platform applications, including VMDR and Web Application Scanning.
Best Use Cases
Best For:
- Security teams that want vulnerability scanning, prioritization and patching in one service
- Hybrid environments mixing on-premises, cloud and remote endpoints
- Organizations that need to prioritize beyond CVSS scores
- Teams already using other Qualys applications
May Not Be Ideal For:
- Buyers who want published, self-service pricing
- Teams that only need occasional ad hoc scans
Comparison with Competitors
Qualys VMDR vs Alternatives
- vs Rapid7 InsightVM / Exposure Command: Rapid7 now sells InsightVM inside Exposure Command Essentials and Ultimate, on quote; Qualys sells VMDR per asset with a 30-day trial.
- vs Snyk: Snyk scans application code, dependencies, containers and IaC during development; VMDR scans running assets and infrastructure.
Screenshots & Interface
Explore Qualys's interface:
Frequently Asked Questions
What does VMDR stand for?
Vulnerability Management, Detection and Response.
How is Qualys VMDR priced?
Per asset, on quote. Qualys does not publish list prices.
Is there a free trial?
Yes. Qualys offers VMDR at no cost for 30 days.
Does VMDR patch systems?
VMDR detects missing patches and maps them to vulnerabilities. Deploying patches uses Qualys Patch Management, an add-on that runs through the Cloud Agents.
What is TruRisk?
Qualys’s risk scoring, which quantifies risk across vulnerabilities, assets and asset groups using factors beyond the CVSS score.
Final Verdict
Qualys VMDR is a mature, cloud-delivered vulnerability management service that combines discovery, risk-based prioritization and patch detection, with sensors included. The 30-day trial makes it easy to test; the trade-offs are quote-only pricing and add-ons for patch deployment and CMDB sync.