Qualys vs Rapid7 when the patch backlog needs a score, an owner, and proof the fix landed

Four thousand open criticals, a 30-day patch SLA, and a board slide that only counts what closed. Both vendors run authenticated and agent-based vulnerability scanning for that backlog. They split on whether the patch itself runs inside the VM subscription or the finding hands off to projects, tickets, and SOAR.

Qualys sells VMDR on the Enterprise TruRisk Platform, with TruRisk scoring and FixIT or ProtectIT packages that extend detection into patch deployment and endpoint protection. Rapid7 sells InsightVM as vulnerability risk management on the Insight Platform, with Active Risk scoring, Remediation Projects, and InsightConnect workflows.

Buy Qualys when detection and patch deployment should run inside one VM subscription. Buy Rapid7 when findings should flow into Remediation Projects, ticketing, and SOAR automation.

Overview

	Qualys	Rapid7
Primary use case	VMDR for asset inventory, vulnerability and configuration assessment, TruRisk prioritization, and optional FixIT patching on the Enterprise TruRisk Platform	InsightVM vulnerability risk management with Active Risk prioritization, Goals, Remediation Projects, and InsightConnect SOAR handoff on the Insight Platform
Day-to-day workflow	Maintain Cloud Agent and scanner coverage, sort by TruRisk, push ITSM tickets, and deploy correlated patches through FixIT when licensed	Scan with the Security Console or Insight Agent, set Active Risk as the risk strategy, open Remediation Projects, and auto-ticket or run InsightConnect workflows
Main buying consideration	AWS Marketplace Qualys VMDR (US Only) at USD 596 per month for 128 hosts and USD 6,805 per month for 5,120 hosts on 1-month contracts. SMB form lists starting prices of USD 2,195 for VMDR TruRisk, USD 2,995 for FixIT, and USD 4,645 for ProtectIT with no period or host count printed	Vulnerability risk management starts at USD 1.62 per asset per month for 500 assets on rapid7.com/pricing, checked 10 Oct 2026. InsightConnect SOAR and InsightIDR are separate catalog products

We reviewed Qualys VMDR packaging, the VMDR unit documentation, the Qualys VMDR AWS Marketplace listing, and the Brasilseg customer story, plus the Rapid7 pricing page, InsightVM Active Risk and Remediation Projects documentation, and InsightConnect vulnerability management guides, on 10 Oct 2026. We did not run either platform in a paid tenant.

Qualys

Rapid7

Editions and pricing

Both vendors print a dollar, but on different units and periods: Qualys a monthly host package on AWS Marketplace, Rapid7 a per-asset monthly start rate.

	Qualys	Rapid7
How it is sold	Enterprise TruRisk Platform subscriptions through sales and partners, SMB TruRisk, FixIT, and ProtectIT packages, and AWS Marketplace host packages	Vulnerability risk management card on rapid7.com/pricing, with web application security, cloud security, SIEM, and SOAR as separate cards
Figure on the public page	USD 596 per month for 128 hosts and USD 6,805 per month for 5,120 hosts, 1-month contracts, Qualys VMDR only. The listing labels its 12-month contract as save up to 17%	USD 1.62 per asset per month starting rate for 500 assets. Larger counts route to sales
What the unit counts	Unique assets assessed during the subscription by agents and scanners, counted once when correlation works, per Qualys VMDR unit documentation	Assets under vulnerability risk management. InsightConnect, InsightIDR, and InsightAppSec are separately licensed

Scanning and prioritization

Both assess hosts with scanners and agents and rank findings with threat-aware scores. The split is TruRisk on asset criticality versus Active Risk on exploit intelligence feeds.

	Qualys	Rapid7
Priority score	TruRisk scores combine vulnerability severity, threat intelligence, and asset criticality into asset and organization risk	Active Risk is the recommended 0-1000 strategy using CVSS plus AttackerKB, Metasploit, ExploitDB, CISA KEV, and other feeds. Legacy Real Risk was deprecated on 21 Jan 2026
Sensors	Cloud Agents, unlimited virtual scanners per VMDR packaging, passive network sensors, and cloud connectors	Security Console scan engines and the Rapid7 Insight Agent for assessment and live discovery
Asset inventory	CyberSecurity Asset Management on the same platform builds the inventory VMDR scores	Asset discovery through scans, agents, and cloud connectors into the InsightVM console

Remediation and automation

Both close the loop after the score. The documented split is in-platform patch deployment versus project-driven ticketing and SOAR.

	Qualys	Rapid7
Patch path	FixIT deploys patches correlated to VMDR detections on Windows, macOS, and Linux when licensed	Remediation Projects assign solutions to owners and track completion as rescans confirm fixes
Ticketing	ITSM integrations including ServiceNow push vulnerability tickets from VMDR	Remediation Projects auto-ticket to Jira Cloud and ServiceNow
Automation	Qualys workflows and APIs, with ProtectIT adding behavior-based antivirus in the same subscription	InsightConnect SOAR plugins for InsightVM Cloud and Console run enrichment and remediation workflows

Favor Qualys when the documented requirement is VMDR with Cloud Agents and passive sensors, TruRisk asset scoring, and FixIT patch deployment inside the same subscription. Favor Rapid7 when the documented requirement is InsightVM Active Risk, Remediation Projects auto-ticketing to Jira Cloud or ServiceNow, and InsightConnect automation.