Tenable vs Qualys: scan windows and patch-SLA evidence

The Friday scan window closes and criticals the board deck called due this sprint still show open. Authenticated coverage never reached the subnet, the prioritization language does not match the patch ticket queue, and nobody can show whether the fix landed or only that another unscored scan is scheduled. That scan-window and patch-SLA evidence gap is the hire this pair answers.

Between these two, Tenable packages Nessus-based Tenable One Vulnerability Management (cloud) and Tenable Security Center (on-prem), with Vulnerability Priority Rating (VPR) and optional expansion into the broader Tenable One Exposure Management platform. Qualys packages VMDR on the Enterprise TruRisk Platform: continuous inventory, TruRisk prioritization, and optional FixIT / ProtectIT packaging that ties detection to patch and endpoint response. Broader exposure shortlists sit under CTEM tools and UVM tools; attack-path validation is a different hire on Pentera vs SafeBreach, and outside-in ratings are not this job on BitSight vs SecurityScorecard.

	Tenable	Qualys
Primary use case	Nessus-based vulnerability / exposure management via Tenable One Vulnerability Management (cloud) or Tenable Security Center (on-prem); VPR prioritization; optional Tenable One platform domains (WAS, cloud, identity, OT, ASM)	VMDR on the Enterprise TruRisk Platform: asset inventory, vulnerability / configuration assessment, TruRisk prioritization, and response workflows; optional FixIT patch and ProtectIT endpoint packages
How a bad day closes	Scan or agent findings land in Tenable One / Security Center; VPR and asset criticality rank the queue; owners remediate via ticketing integrations; re-scan / agent poll clears the finding	Cloud Agent / scanner / sensor detections land in VMDR; TruRisk ranks by severity, threat intel, and asset criticality; owners remediate; FixIT can deploy correlated patches when licensed
Day-to-day workflow	Schedule network and agent scans, review VPR queues, drive remediation SLAs, report exposure / compliance	Maintain agent and scanner coverage, run TruRisk / prioritization reports, push ITSM tickets, track patch / mitigate status
Deploy	Cloud Tenable One Vulnerability Management with Nessus scanners / agents; on-prem Security Center; Enclave Security for high-assurance environments	Cloud Enterprise TruRisk Platform with unlimited virtual scanners (per VMDR packaging), Cloud Agents, passive sensors, and related sensors
License/pricing	Tenable One Vulnerability Management: 3,700 USD, 1-year subscription, up to 250 assets. The asset selector at 100 assets prints 3,500 USD for 1 year of the same product. Nessus Professional: 4,790 USD, 1-year license, unlimited vulnerability scanning, no asset cap on the store page. Nessus Expert: 6,790 USD, 1-year license, those Professional features plus web app scanning and external attack surface discovery. Exposure Management and Security Center: quote, no public dollar	SMB form: starting at 2,195 USD for VMDR TruRisk, 2,995 USD for FixIT, 4,645 USD for ProtectIT. Period, commitment, and host count were not found on that form. AWS Marketplace Qualys VMDR (US Only): 596.00 USD per month for 128 hosts, and 6,805.00 USD per month for 5,120 hosts, each a 1-month contract for Qualys VMDR
Who operates it	Vulnerability / exposure owners who want Nessus accuracy with cloud or on-prem program ops and VPR-led queues	Vulnerability / risk owners who want VMDR TruRisk continuous coverage and optional in-platform patch orchestration

Tenable

Qualys

Tenable’s current first-party packaging signal for this shortlist is Tenable One Vulnerability Management built on Nessus, with Security Center when you must stay on-prem, and Tenable One when you expand beyond classic VM into connected exposure domains. Qualys’s current packaging signal is VMDR on the Enterprise TruRisk Platform, with TruRisk scoring and FixIT / ProtectIT when detect-to-patch (or endpoint protection) should stay inside the same subscription story.

Editions and pricing

Both vendors sell mid-stage programs by asset or host count. Public dollars exist for entry VM and scanner SKUs; full exposure platforms and negotiated enterprise modules still need a written unit map.

	Tenable	Qualys
How you buy it now	Online store for Nessus and Tenable One Vulnerability Management asset tiers; sales / partners for Tenable One Exposure Management, Security Center, and larger deployments	Sales / partners for Enterprise TruRisk / VMDR; SMB TruRisk / FixIT / ProtectIT packages; AWS Marketplace host packages (US listing)
Public units (3 Oct 2026)	Tenable One Vulnerability Management, tenable.com/buy: 3,700 USD for a 1-year subscription covering up to 250 assets. Selector at 100 assets: 3,500 USD for 1 year, 6,825 USD for 2 years, 9,975 USD for 3 years. Those multi-year figures also sit under the 3,700 USD line, so do not read 6,825 USD as the 250-asset price. Nessus Professional: 4,790 USD for 1 year, 9,330.95 USD for 2 years, 13,637.54 USD for 3 years, unlimited vulnerability scanning, product Nessus Professional. Nessus Expert: 6,790 USD for 1 year, 13,208.13 USD for 2 years, 19,304.19 USD for 3 years. The Nessus licensing guide adds five web applications and five external domains per rolling 90 days on Expert unless you buy more. The store page marks Nessus prices with a VAT-included asterisk. Exposure Management and Security Center remain quotes	Qualys VMDR TruRisk form: 2,195 USD starting price for VMDR TruRisk, 2,995 USD for FixIT (VMDR plus patch remediation), 4,645 USD for ProtectIT (VMDR, remediation, and behavior-based antivirus). Currency is USD. Billing period, commitment, and included host count were not found on that form. AWS Marketplace, sold by Qualys, Qualys VMDR (US Only): 596.00 USD per month for a package of 128 hosts, and 6,805.00 USD per month for a package of 5,120 hosts, 1-month contract, product Qualys VMDR (not FixIT or ProtectIT). The listing also offers a 12-month contract labeled save up to 17%. That 17% is the listing’s own maximum label, not a price worked out here, and the 12-month dollar amounts were not in the 1-month table. Access ends if the contract is not renewed
What the invoice covers	Tenable One Vulnerability Management: an asset assessed in the past 90 days by an active scan, an agent scan, or an import that contains vulnerabilities. A discovery-only scan does not count. Add-on domains are separate when purchased. Nessus Professional and Expert: a license with unlimited vulnerability scanning, not a host count. Expert web-application and external-domain caps are separate from that scan license	Marketplace rows: a fixed host count of Qualys VMDR for the contract you pick. SMB starting prices: included hosts not found on the form. Qualys VMDR unit docs count unique assets assessed during the subscription by agents and scanners, once when correlation works. The unit-to-asset ratio is in the subscription. Worked ratios on that page are labeled illustrative examples, not your ratio
Billing honesty	3,700 USD is the 1-year, up-to-250-asset store line for Tenable One Vulnerability Management, not a Tenable One Exposure Management quote and not the 100-asset selector price. Match the 90-day asset window before comparing it with a Qualys monthly host package	2,195 USD is a starting price with no period or host count on the form. 596.00 USD is one month of Qualys VMDR for 128 hosts, not FixIT and not a year. Do not put that monthly host package next to a Tenable year without saying so

Do not equate 3,700 USD for one year of Tenable One Vulnerability Management, up to 250 assets, with 596.00 USD per month of Qualys VMDR for 128 hosts. The products, periods, commitments, and counts are different. The Qualys SMB starting prices still have no period or host count on the form.

How scanning and prioritization work

	Tenable	Qualys
Scanning method	A Nessus network scan reaches the host. A credentialed scan logs in and can list missing patches. An uncredentialed scan is the outside view. Nessus Agents run local checks on the host and do not run network checks. Tenable’s agent FAQ documents agents for Tenable One Vulnerability Management, and for Security Center through the On-Prem Agent Manager. That FAQ does not list standalone Nessus Professional as the agent manager	Qualys documents two primary methods and says most mature deployments use both. A Cloud Agent is a continuous sensor on the host and does not need network credentials. A Scanner Appliance runs network scans, authenticated or unauthenticated, and is the path for devices that cannot run an agent. Agents alone miss those devices. Scanners alone need a route, and authenticated scans need stored credentials
Stale assets	On Tenable One Vulnerability Management, a license follows assets assessed in the past 90 days. Deleted assets are reclaimed within 24 hours. If Asset Age Out is on, reclaim follows the period you set. Other assets are reclaimed after 90 days without a scan. This is the cloud VM license page. A Security Center reclaim rule was not on that page	Qualys VMDR unit docs count an asset assessed during the subscription. Inactive, terminated, or unused assets drop out only when purge rules are enabled. An on-premises agent that reported at any time in the term counts once by agent ID, regardless of current status. No-finding assets are excluded. A fixed 90-day automatic reclaim, matching Tenable’s rule, was not found on that page
Patch verification	Tenable One Vulnerability Management can launch a remediation scan that retests one plugin on a Nessus or cloud-sensor target. If the vulnerability is not identified, the status becomes Fixed. That scan is not supported for Tenable Agent, Tenable One Web App Scanning, or Tenable Network Monitor. If a credentialed plugin runs without working credentials, the docs warn the finding can be marked Fixed even though the check did not finish. How an agent-only finding is marked Fixed was not on that remediation-scan page	Qualys VMDR sets Fixed when the most recent scan verifies the vulnerability as fixed and the previous scan had detected it. New, Active, and Re-Opened are the other statuses on that page. The page does not exclude Cloud Agent results and does not describe a separate remediation-scan object. Whether a FixIT job completion alone sets Fixed was not found on that status page
Prioritization language	Vulnerability Priority Rating (VPR) with threat intel and context; exposure cards / attack path analysis when on broader Tenable One	TruRisk scores combining asset criticality, severity, threat intelligence, and business context; QDS / related detection scores in VMDR workflows
Category framing	Vulnerability management that expands into exposure management on Tenable One	Risk-based VMDR that expands into Enterprise TruRisk measurement and elimination across Qualys modules
Main buying consideration	Will VPR queues on Nessus-based Tenable One VM (or Security Center) become the weekly scan and SLA language your team staffs?	Will TruRisk VMDR queues with agent / scanner coverage (and optional FixIT) become the weekly detect-to-remediate language your team staffs?

That split matches the first-party packaging: Qualys VMDR leans on continuous agent / sensor coverage and TruRisk ranking for what to fix first; Tenable leans on Nessus assessment depth plus VPR and dashboard / exposure reporting operators and executives actually open.

Patch evidence and remediation

	Tenable	Qualys
Remediation path	Guided remediation, bi-directional ticketing, and optional Tenable Patch Management module paired with VM / Security Center / Tenable One licenses	VMDR prioritization plus FixIT patch management for OS and 100+ third-party apps when purchased; ITSM integrations (ServiceNow / Jira) on documented VMDR packaging
SLA evidence	Use the remediation scan above when the original result came from a Nessus or cloud sensor. Do not treat a missing credential as proof the patch landed. Agent-result verification was not on that page	A later VMDR scan is what sets Fixed. FixIT can deploy OS and third-party patches when that package is on the order. Job success and the Fixed status were not tied together on the status page
Main buying consideration	Do you need Nessus-led assessment with VPR queues and ticketing, with patch as an optional Tenable module?	Do you need VMDR TruRisk with optional in-platform FixIT so patch evidence stays on the same Qualys workflow?

If the open work after a missed patch window is still “prove coverage, rank what matters, and show the fix cleared,” staff the packaging you will operate weekly: Tenable One VM / Security Center with VPR and ticketing, or Qualys VMDR with TruRisk and FixIT when patch should not leave the platform.

Choose Tenable when the weekly queue is VPR on Tenable One Vulnerability Management or Security Center. The public cloud VM price is 3,700 USD for a 1-year subscription, up to 250 assets, or 3,500 USD for 1 year at the 100-asset selector. Nessus Professional is 4,790 USD for a 1-year license with unlimited vulnerability scanning. Nessus Expert is 6,790 USD for a 1-year license. Choose Qualys when the weekly queue is VMDR TruRisk, with FixIT only if patch deployment is on the order. The SMB form’s 2,195, 2,995, and 4,645 USD starts have no period or host count. The Marketplace anchor is 596.00 USD per month for 128 hosts of Qualys VMDR on a 1-month contract.