No more typing reviews! Try our Samantha, our new voice AI agent.

AttackIQ vs JFrog Xray comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
11th
Average Rating
8.6
Reviews Sentiment
7.3
Number of Reviews
39
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (1st), Cloud-Native Application Protection Platforms (CNAPP) (6th)
AttackIQ
Ranking in Vulnerability Management
31st
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
7
Ranking in other categories
Breach and Attack Simulation (BAS) (4th), Attack Surface Management (ASM) (11th), Continuous Threat Exposure Management (CTEM) (4th)
JFrog Xray
Ranking in Vulnerability Management
43rd
Average Rating
7.8
Reviews Sentiment
6.3
Number of Reviews
10
Ranking in other categories
Container Security (16th), Software Composition Analysis (SCA) (7th), Software Supply Chain Security (3rd)
 

Mindshare comparison

As of July 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.1%, up from 1.0% compared to the previous year. The mindshare of AttackIQ is 0.7%, up from 0.2% compared to the previous year. The mindshare of JFrog Xray is 1.3%, down from 1.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.1%
AttackIQ0.7%
JFrog Xray1.3%
Other96.9%
Vulnerability Management
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
Akash Das Barman - PeerSpot reviewer
Cyber Security Trainee at DataSpace Academy
Continuous validation has improved MITRE-based detection coverage across hybrid environments
Overall, AttackIQ is a strong platform, but there are a few areas where it could improve. One area is the learning curve for new users. Since the platform is deeply tied to MITRE ATT&CK mapping and security validation workflows, beginners may need more guided onboarding and simplified explanations for certain modules. Another improvement could be more customizable dashboards and reporting views for different stakeholders, especially for executive-level summaries versus technical SOC analysis. I also think integrations and automation workflows could be expanded further for multi-vendor environments, making it easier to correlate results across different security tools. From an operational perspective, more built-in recommendations for remediation or detection tuning after simulation would also be valuable, especially for teams that are still maturing their security operations.One additional area for improvement in AttackIQ could be deeper real-time guidance during simulations, especially for less experienced analysts. For example, after identifying a detection gap, the platform could provide more prescriptive recommendations on how to improve SIEM correlation rules or EDR configuration. That would help teams move faster from validation to remediation. I also think improving visualization of attack paths and attack chain relationships would make investigations easier during purple team exercises. Another potential improvement is making some workflows lighter and easier for smaller organizations that may not have a large dedicated SOC team, because BAS platforms can sometimes feel enterprise-focused.
Anand Nanwana - PeerSpot reviewer
DevOps Engineer at Syvora
Offers flexibility across clouds and easy credential management while interface improvements are needed
For JFrog Xray, the Artifactory and package repositories are valuable features. There are many benefits from JFrog Xray. For example, with other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well. JFrog can support multiple packages, such as NuGet package, pip, and other technologies. It can be used for Terraform as well. The credential management is very easy in JFrog. For instance, when using GitHub action as a CI/CD tool, I just need to create a token and set up JFrog CLI there and give access to the repository. With multiple repositories, I can generate a token for a specific repository, add that token in the GitHub secret, fetch from the CI/CD, run the command JFrog CLI, and authenticate through the token. Then we can push the images into JFrog.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"If someone were to ask me to review Qualys TotalCloud, I would summarize it as an end-to-end solution for cloud security with visibility and governance-grade controls without needing to manage multiple disconnected tools."
"TotalCloud's best feature is the integration of cloud accounts. It helps with the risk and security posture management of our cloud infrastructure."
"If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI."
"The scalability is good as well. I would rate it ten out of ten."
"The best feature would be the ability to create policies. It is easy to control and update policies as required."
"Qualys TotalCloud's most valuable features are its security capabilities that help identify and mitigate risk factors."
"By integrating TotalCloud, we have significantly reduced vulnerabilities in our deployment pipeline."
"The most valuable feature is the consolidated information that it provides from various platforms."
"AttackIQ is solving a lot of the problems that I had before or that we as an organization had before, even the security team, so it is solving all my issues."
"AttackIQ has had a positive impact on the organization, especially in the areas of continuous security validation, detection improvement, and overall defensive readiness, with highlights including improved visibility into detection gaps, stronger security controls validation, better SOC readiness, and faster detection engineering improvements, which are improvement areas we have implemented in our project using AttackIQ."
"Overall, I've had a good experience with the product. It's worked well for me."
"After using AttackIQ, it has helped the team and the company improve on false positives and reduce risk, as most people are now capable of identifying how to work on detection, improving fine-tuning and all those things."
"Running in our SOC, it moves the conversation from assumptions and dashboards to measurable proof, which is exactly what makes AttackIQ valuable in day-to-day security operations."
"I am utilizing the deep scanning capabilities in JFrog Xray product, and this feature is very handy because with other software, you don't know where the bad dependencies come from."
"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."
"Good reporting functionalities."
"With JFrog, we can use this registry from any cloud or work locally as well, and it can support multiple packages such as NuGet, pip, and other technologies including Terraform, making credential management very easy."
"I would say the reporting functionalities are pretty good as are the policy watches."
"JFrog Xray shows us a list of vulnerabilities that can impact our code."
"The solution is stable and reliable."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
 

Cons

"In a future release, I suggest that zero-day vulnerabilities should be predicted in advance using AI technologies. The system is not 100% secure yet, so proactive threat hunting could be enhanced to be more proactive than the current system."
"We encountered challenges identifying the correct resource category for certain items, such as those in containers or storage."
"The onboarding process is a bit difficult. In the initial phase, it is very difficult to understand the features, what the dashboard contains, and what criteria they are using."
"Their customer support needs improvement."
"There is room for improvement in vulnerability scanning, particularly for PaaS environments. Currently, Qualys does not have full access to these instances, which limits its effectiveness."
"We would like to see Windows-based sensors available in Qualys, as this would make the platform more versatile and support a broader range of environments."
"In TotalCloud, I would suggest improvements in policy checks to cater to various inventory types like VPCs, subnets, S3 buckets, or IAMs. There is a lack of data segregation according to criticality or inventory."
"Two areas for improvement in Qualys TotalCloud are the speed of the public cloud platform and vulnerability detection."
"The main reasons I would not give it a full perfect score are the learning curve for new users and some opportunities for improvement in reporting, customization, and remediation guidance."
"The initial setup was difficult. It was not straightforward."
"There is a learning curve at the beginning, especially for teams that are quite new to a BAS or continuous validation solution."
"The customer support for AttackIQ is good but can be better."
"The initial setup was quite difficult and took a long time."
"One area for improvement is the initial configuration complexity, which is very complex in the initial stage to configure the whole thing and integrate with the SOC, presenting a learning curve for organizations that are new to adversary emulation or continuous security validation, particularly concerning the initial setup scenario customization and workflow tuning."
"Apart from this integration aspect, JFrog Xray does the job, but the user experience is not very good."
"I'd like to see deeper reporting, they're pretty basic and there are no categories for comparing things."
"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."
"The speed of JFrog Xray should improve. Other solutions have better performance."
"The UI of JFrog Xray could be improved. There is a dialogue box in the Xray section that doesn't always work properly."
"Lacks deeper reporting, the ability to compare things."
"JFrog Xray's documentation and error logging could be improved."
"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."
 

Pricing and Cost Advice

"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"The cost is high, but it meets our organizational needs."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"Qualys TotalCloud is expensive."
Information not available
Information not available
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
902,988 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
17%
Financial Services Firm
14%
Construction Company
8%
Comms Service Provider
7%
Financial Services Firm
16%
Manufacturing Company
12%
Government
8%
Construction Company
7%
Financial Services Firm
25%
Manufacturing Company
11%
Computer Software Company
7%
Government
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise29
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise5
By reviewers
Company SizeCount
Small Business1
Midsize Enterprise3
Large Enterprise6
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
Areas that need improvement in every solution include the remediation part. The remediation steps should be simple en...
What is your primary use case for Qualys TotalCloud?
Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal appli...
What needs improvement with AttackIQ?
Overall, AttackIQ is a strong platform, but there are a few areas where it could improve. One area is the learning cu...
What is your primary use case for AttackIQ?
My main use case for AttackIQ has been validating security controls and testing detection coverage against MITRE ATT&...
What advice do you have for others considering AttackIQ?
AttackIQ is very strong in continuous security validation, MITRE ATT&CK alignment, and realistic attack simulatio...
What needs improvement with JFrog Xray?
I would assess the integration of JFrog Xray with CI/CD tools as the weak point. You have two means to do that: one i...
What is your primary use case for JFrog Xray?
For JFrog Xray product, you can use it for two main goals: compliance and security. You can use it to check if your l...
What is your experience regarding pricing and costs for JFrog Xray?
It is affordable because JFrog Xray provides a free trial of 14 days. We can explore all the features of JFrog in the...
 

Comparisons

 

Also Known As

Qualys TotalCloud with FlexScan
DeepSurface
JFrog Security Essentials
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
google, amazon, cisco, netflix, oracle, vmware, facebook
Find out what your peers are saying about AttackIQ vs. JFrog Xray and other solutions. Updated: June 2026.
902,988 professionals have used our research since 2012.