No more typing reviews! Try our Samantha, our new voice AI agent.

Checkmarx One vs ManageEngine Vulnerability Manager Plus comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
11th
Average Rating
8.6
Reviews Sentiment
7.3
Number of Reviews
39
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (1st), Cloud-Native Application Protection Platforms (CNAPP) (6th)
Checkmarx One
Ranking in Vulnerability Management
15th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
81
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (14th), Static Code Analysis (2nd), API Security (4th), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (2nd), Risk-Based Vulnerability Management (11th), Application Security Posture Management (ASPM) (3rd), AI Security (3rd)
ManageEngine Vulnerability ...
Ranking in Vulnerability Management
38th
Average Rating
9.4
Reviews Sentiment
7.4
Number of Reviews
3
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.1%, up from 1.0% compared to the previous year. The mindshare of Checkmarx One is 1.7%, up from 1.1% compared to the previous year. The mindshare of ManageEngine Vulnerability Manager Plus is 0.7%, down from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.1%
Checkmarx One1.7%
ManageEngine Vulnerability Manager Plus0.7%
Other96.5%
Vulnerability Management
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
Shahzad Shahzad - PeerSpot reviewer
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution
Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance
Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.
MB
IT Helpdesk at a manufacturing company with 51-200 employees
Enhanced endpoint security with effective patch management and frequent scans
The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities. ManageEngine Vulnerability Manager Plus was the perfect fit for managing these requirements. We improved the number of scans and patches performed from four times per year per computer to four times per month.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"TotalCloud's best feature is the integration of cloud accounts. It helps with the risk and security posture management of our cloud infrastructure."
"Qualys TotalCloud provides a single, prioritized view based on requirements such as identifying the most vulnerable assets and calculating the average time to remediate vulnerabilities."
"Qualys TotalCloud's most valuable features are its security capabilities that help identify and mitigate risk factors."
"I would definitely recommend it because it is easy to handle any cloud resources."
"The vulnerability management feature is the one I like the most because it provides a clear picture of all vulnerabilities."
"Qualys TotalCloud's most valuable features are its cloud security posture management, Kubernetes, and container security capabilities."
"The most valuable feature is the consolidated information that it provides from various platforms."
"I like the web API security and IoT scanning features the most. The user-friendly design of TotalCloud's interface enables customers to navigate it and use its full potential easily"
"It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc)."
"The solution is always updating to continuously add items that create a level of safety from vulnerabilities, and they are always ahead of the game when it comes to finding any vulnerabilities within the database, so I am assured that when I am scanning my product those vulnerabilities are identified at very initial stages, giving my development team more time to react."
"Checkmarx One has positively impacted our organization as we tend to find vulnerabilities very early in the development cycle."
"The features and technologies are very good. The flexibility and the roadmap have also been very good. They're at the forefront of delivering the additional capabilities that are required with cloud delivery, etc. Their ability to deliver what customers require and when they require is very important."
"We have used this product to verify the dev department's code in order to minimize security holes."
"The only thing I like is that Checkmarx does not need to compile."
"One of the most valuable features is it is flexible."
"Even if there are multiple vulnerabilities in the source coding, Checkmarx is able to identify which lines need to be corrected and then proceeds to automatically remediate the situation."
"ManageEngine is a comprehensive tool that is broad and can be customized to fit specific needs."
"The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities."
"The solution helps us figure out vulnerabilities and fix them."
"I have been using it for over two years, and it is fantastic."
 

Cons

"Enhancing clarity regarding its compliance capabilities would be beneficial, as the current scope is limited in geographic coverage."
"There is a lack of data segregation according to criticality or inventory."
"Overall, we are satisfied with it. However, the response part of the Cloud Detection and Response (CDR) module can be improved. It is not yet in place according to requirements; it is not completely available even though the module has been released."
"TotalCloud could improve the classification of vulnerabilities. Specifically, it could enhance the categorization of what aspects fall under patches resolved by OS or software updates and what pertains to configuration adjustments."
"Their customer support needs improvement."
"TotalCloud could improve its scanning of niche devices like Wi-Fi dongles and USB modems because they are often untested. It covers everything else, like laptops, mobile devices, and Bluetooth IoT devices. They can improve on the small IoT devices because hackers and testers use these."
"We encountered challenges identifying the correct resource category for certain items, such as those in containers or storage."
"There should be improvement from a dashboard perspective when collecting and showcasing data to lead management."
"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."
"The tool is currently quite static in terms of finding security vulnerabilities. It would be great if it was more dynamic and we had even more tools at our disposal to keep us safe. It would help if there was more scanning or if the process was more automated."
"You can't use it in the continuous delivery pipeline because the scanning takes too much time."
"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"We had to lock the number of CPUs used to not crash the Checkmarx Audit."
"The validation process needs to be sped up."
"The accessibility for customized Checkmarx rules is currently limited and should be improved."
"They could work to improve the user interface. Right now, it really is lacking."
"One area that needs improvement is the contract management. My legal team required some partner requirements for that, and ManageEngine could not support it."
"The user interface is the only drawback of the product."
"The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved."
 

Pricing and Cost Advice

"Qualys TotalCloud is expensive."
"TotalCloud's price is about right where I would expect it to be."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"The cost is high, but it meets our organizational needs."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
"The solution is costly."
"The interface used to create custom rules comes at an additional cost."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"It's relatively expensive."
"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."
"It is a good product but a little overpriced."
"The number of users and coverage for languages will have an impact on the cost of the license."
"The price is very reasonable."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
902,988 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
17%
Financial Services Firm
14%
Construction Company
8%
Comms Service Provider
7%
Financial Services Firm
16%
Manufacturing Company
9%
Computer Software Company
8%
Government
5%
Financial Services Firm
12%
Construction Company
8%
Comms Service Provider
8%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise29
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise9
Large Enterprise46
No data available
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
Areas that need improvement in every solution include the remediation part. The remediation steps should be simple en...
What is your primary use case for Qualys TotalCloud?
Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal appli...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed Ap...
What is your experience regarding pricing and costs for Checkmarx?
Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...
What is your experience regarding pricing and costs for ManageEngine Vulnerability Manager Plus?
ManageEngine is considered an affordable solution, offering competitive pricing compared to similar solutions like Ut...
What needs improvement with ManageEngine Vulnerability Manager Plus?
The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved. The asset d...
What is your primary use case for ManageEngine Vulnerability Manager Plus?
I worked in an integrator solution company, and we implemented ManageEngine Vulnerability Manager Plus for different ...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
No data available
 

Overview

 

Sample Customers

Information Not Available
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Information Not Available
Find out what your peers are saying about Checkmarx One vs. ManageEngine Vulnerability Manager Plus and other solutions. Updated: June 2026.
902,988 professionals have used our research since 2012.