No more typing reviews! Try our Samantha, our new voice AI agent.

DefectDojo vs Tenable Nessus comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
5th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
54
Ranking in other categories
Container Security (8th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (6th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
DefectDojo
Ranking in Vulnerability Management
55th
Average Rating
8.0
Reviews Sentiment
6.6
Number of Reviews
1
Ranking in other categories
DevSecOps (17th)
Tenable Nessus
Ranking in Vulnerability Management
3rd
Average Rating
8.4
Reviews Sentiment
6.2
Number of Reviews
88
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.2%, up from 1.0% compared to the previous year. The mindshare of DefectDojo is 0.7%, down from 0.8% compared to the previous year. The mindshare of Tenable Nessus is 3.6%, down from 7.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Tenable Nessus3.6%
Qualys TotalCloud1.2%
DefectDojo0.7%
Other94.5%
Vulnerability Management
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
reviewer2267097 - PeerSpot reviewer
Integration and Solution Architect at a government with 501-1,000 employees
Easy to use with efficient vulnerability reporting and team collaboration
Use case, so all the reports from GitLeaks, DefectDojo, GitLeaks or dependency check or Trivy, they make reports, and we send this report to DefectDojo to have CVMs, Central Vulnerability Management. DefectDojo is Central Vulnerability Management. If you have a dashboard to set, we have…
MohammedJaffir - PeerSpot reviewer
Founder at Cipheroot Cybersecurity Solutions
Has enabled me to reduce false positives and perform deep credential auditing with seamless integrations
I mostly use the configuration audit feature for the audit configuration as a scan policy, and I will use it for credential audit, which helps me scan credentials access such as local administrator or root access, performing a deeper and more accurate check of local configuration settings and file systems, making it a highly recommended feature. Regarding integration capabilities, we can integrate Tenable Nessus with SIM tools such as Splunk, IBM QRadar, and Azure Sentinel, as well as with ticketing systems such as ServiceNow, Jira, and Slack. There is no complexity as it is very easy to integrate everything. In terms of the reporting feature, while vulnerability scanning can throw some false positives, Tenable Nessus has very few, achieving a reduction of 75% to 80% false positives with manual analysis needed. We can generate standard Nessus reports that typically include host summaries and vulnerabilities by host and plugin, alongside solutions and remediation recommendations. The main benefits I get from Tenable Nessus are complete asset inventory and comprehensive attack surface management, allowing us to prioritize vulnerabilities based on risk, focusing on true risk and threat path analysis.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The best features in Qualys TotalCloud include the total asset management of the cloud environment. It is very easy to export the report and see the vulnerabilities related to the cloud specifically."
"The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility."
"Qualys TotalCloud has helped us view our risk structure, vulnerabilities, and security posture."
"Qualys TotalCloud provides a single, prioritized view of risk, reducing the workload associated with consolidating multiple sources for risk prioritization."
"The scalability is good as well. I would rate it ten out of ten."
"If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI."
"It is a cloud-native app that integrates with both IaaS and SaaS. It seamlessly integrates with other platforms."
"I would definitely recommend Qualys TotalCloud to other customers."
"With the pipeline of detection and DefectDojo, we are able to see the real vulnerabilities, and we fix them."
"Nessus gives me a good preview of vulnerabilities and good suggestions for remediation. It's easy to find a description of a given vulnerability and solutions for it."
"Tenable Nessus is good. It's the best vulnerability solution in the industry."
"We looked at Tenable, Qualys and Rapid7. We found Tenable was the best of all three."
"I have found the vulnerability assessment and the reports to be useful."
"The solution can conduct a full vulnerability assessment and also suggest mitigation of vulnerabilities and has a lot of other features."
"The initial setup is very straightforward."
"The most valuable aspect of this solution is that you receive the entire report, which details the breakdown, especially in terms of critical, high, low, and mediums."
"The solution can scale well."
 

Cons

"The onboarding process is a bit difficult. In the initial phase, it is very difficult to understand the features, what the dashboard contains, and what criteria they are using."
"In my opinion, what can be improved in Qualys TotalCloud includes pricing and container scanning."
"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"The response part of the Cloud Detection and Response (CDR) module can be improved."
"There is room for improvement in the support."
"Overall, we are satisfied with it. However, the response part of the Cloud Detection and Response (CDR) module can be improved. It is not yet in place according to requirements; it is not completely available even though the module has been released."
"There should be improvement from a dashboard perspective when collecting and showcasing data to lead management."
"The patching process with Qualys Patch Management, which is part of TotalCloud, does not cover installing certain prerequisites on the servers or workstations. This shortcoming means we must rely on SCCM when any service stack updates or additional prerequisites are needed."
"We need something to notify the team responsible for a product when vulnerabilities are found."
"The scalability of Tenable Nessus is good. However, it could be more flexible."
"From my point of view the solution basically is not for the big enterprise."
"Tenable Nessus could improve the price."
"The solution could improve by having better integration with different vendors' IPS solutions. The ACLs and IPS policies signatures should be enabled based on the results of Tenable Nessus automatically, we currently have to do it manually which is very time-consuming. It has done a good job integrating with Fortinet but we would like it to be better integrated with other solutions that we have."
"Technically, it is an excellent and the best solution available in Libya. My only concern is related to its pricing. They are an emerging company in Libya, and they need to put in some effort to provide us with very good prices so that customers can go with the best solution. Chinese companies are getting into the market here, and they're providing very cheap solutions."
"We feel the solution's technical support to be very bad."
"One area with room for improvement is instead of there just being a PDF format for output, I'd like the option of an Excel spreadsheet, whereby I could better track remediation efforts and provide reporting off of that."
"You can scale Nessus to the extent that you can afford it. You need to have a license for every device you scan. As long as you can afford the increased costs, you won't have a problem scaling it."
 

Pricing and Cost Advice

"The cost is high, but it meets our organizational needs."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"Qualys TotalCloud is expensive."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
Information not available
"Its pricing is great and can't be improved. It is very cheap. It is less than 2,000 pounds a license, and you can't really ask for more. It has unlimited IPs and unlimited scans. There are no particular pricing constraints. The only additional cost is the inherent cost of the people to actually review the actual scans."
"One problem with Tenable is its pricing policy. Optimal results can be achieved with Greenbone Solutions which has much more friendly pricing policies."
"The solution has a single price for unlimited assets."
"When comparing the price of Tenable Nessus to other similar solutions, such as Acunetix, Tenable Nessus is not as expensive. It is averagely priced in the market. We pay for the solution annually."
"Its price is high for Libya. The companies here in Libya don't have the awareness of and a good budget for cybersecurity services. If you want them to go for a product, you need to provide something different. This differentiation is related to the price. They should give about 40% to 45% discount per person on the current cost."
"We pay approximately $2,500 on a yearly basis."
"The solution is worth the cost. It's a good investment."
"We incurred a single cost for a perpetual license, although I cannot comment on the price as this is above my management level."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
11%
Manufacturing Company
11%
Financial Services Firm
10%
Comms Service Provider
14%
Financial Services Firm
11%
Construction Company
7%
Manufacturing Company
7%
Financial Services Firm
11%
Manufacturing Company
10%
Government
7%
Outsourcing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise11
Large Enterprise38
No data available
By reviewers
Company SizeCount
Small Business41
Midsize Enterprise19
Large Enterprise35
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
We purchased Qualys TotalCloud for GCP and Azure as well. It is comparatively better than others regarding pricing. T...
What needs improvement with Qualys TotalCloud?
I am unsure about how Qualys TotalCloud can be improved. I do not have anything else to add about the needed improvem...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is telemetry, although I am unsure about the specifics. A quick specific examp...
Ask a question
Earn 20 points
How would you choose between Rapid7 InsightVM and Tenable Nessus?
You have full visibility across cloud, network, virtual, and containerized infrastructures with Rapid7 Insight VM. Yo...
What's the difference between Tenable Nessus and Tenable.io Vulnerability Management?
Tenable Nessus is a vulnerability assessment solution that is both easy to deploy and easy to manage. The design of ...
What is your experience regarding pricing and costs for Tenable Nessus?
Based on my experience, the pricing for Tenable Nessus is somewhat higher, but customers still want to pay for it, so...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
No data available
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
Bitbrains, Tesla, Just Eat, Crosskey Banking Solutions, Covenant Health, Youngstown State University
Find out what your peers are saying about Wiz, Qualys, Tenable and others in Vulnerability Management. Updated: October 2026.
920,929 professionals have used our research since 2012.