Invicti vs Qualys VMDR comparison

Invicti and Qualys are both solutions in the Container Security category. Invicti is ranked #25 with an average rating of 8.5, while Qualys is ranked #9 with an average rating of 8.6. Invicti holds a 0.6% mindshare in Container Security, compared to Qualys’s 2.4% mindshare. Additionally, 96% of Invicti users are willing to recommend the solution, compared to 94% of Qualys users who would recommend it.

Invicti

Read 31 Invicti reviews

3,137 Views
502 Comparison Views

96% willing to recommend

Qualys VMDR

Read 96 Qualys VMDR reviews

12,480 Views
2,371 Comparison Views

94% willing to recommend

Invicti

Qualys VMDR

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Invicti and Qualys VMDR based on real PeerSpot user reviews.

Find out in this report how the two Container Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Invicti vs. Qualys VMDR Report (Updated: December 2025).

Buyer's Guide

Invicti vs. Qualys VMDR

December 2025

Download the complete report

Helped 881,082 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Invicti

Ranking in Container Security

25th

Average Rating

8.2

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (11th), Software Composition Analysis (SCA) (8th), API Security (9th), Dynamic Application Security Testing (DAST) (5th), Application Security Posture Management (ASPM) (5th)

Qualys VMDR

Ranking in Container Security

9th

Average Rating

8.4

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

IT Asset Management (3rd), Vulnerability Management (3rd), Configuration Management Databases (2nd), Risk-Based Vulnerability Management (1st)

Mindshare comparison

As of January 2026, in the Container Security category, the mindshare of Invicti is 0.6%, up from 0.3% compared to the previous year. The mindshare of Qualys VMDR is 2.4%, down from 2.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Container Security Market Share Distribution
Product	Market Share (%)
Qualys VMDR	2.4%
Invicti	0.6%
Other	97.0%

Container Security

Featured Reviews

Valavan Sivgalingam

Senior Manager, Security Engineering at ESS

Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations

It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.

Read full review

Vaibhav Ghule

Soc Lead & Edr Administration at Persistent Systems

Continuous risk-based monitoring has strengthened incident response and vulnerability prioritization

I haven't explored Qualys VMDR's vulnerability lifecycle automation yet. One of my analysts mentioned that queries lack grouping operators in Qualys VMDR. From my experience, I would appreciate improvements in the query options in Qualys VMDR, specifically in the query-building process where I would need more features and operators. Additionally, we have been facing issues with Qualys on the cloud level. We cannot download the configuration profile from the cloud agent, and it is showing a pending action for download. During 2025, we noticed outages of Qualys a couple of times. I want to mention that there is an issue with receiving timely RCA deliveries. While this is not necessarily about the tool, it relates to support. The support has not been very responsive, and we are receiving RCAs a little delayed whenever we raise support cases or communicate with the TAMs. Additionally, the UI has a slight latency, which I and my team have experienced. They have also reported this latency issue when navigating through different pages.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I like that it's stable and technical support is great."

"The most attractive feature was the reporting review tool. The reporting review was very impressive and produced very fruitful reports."

"Crawling feature: Netsparker has very detail crawling steps and mechanisms. This feature expands the attack surface."

"I am impressed by the whole technology that they are using in this solution. It is really fast. When using netscan, the confirmation that it gives on the vulnerabilities is pretty cool. It is really easy to configure a scan in Netsparker Web Application Security Scanner. It is also really easy to deploy."

"The most valuable feature of Invicti is getting baseline scanning and incremental scan."

"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."

"The scanner is light on the network and does not impact the network when scans are running."

"One of the features I like about this program is the low number of false positives and the support it offers."

More Invicti pros

"The most valuable features of Qualys VMDR include patch management and the use of virtual scanners to scan appliances and devices, especially those provided by vendors where we cannot manage them ourselves."

"It is a stable solution."

"It is quite easy to implement."

"The initial setup is straightforward."

"The prioritization of vulnerabilities has improved our remediation efforts by around thirty to thirty-five percent."

"Authenticated scans provide different options, including those using or not using the FactSet and adding option profiles."

"The most valuable features are vulnerability detection and the scanning capability to enable identification of vulnerabilities across our network."

"The most valuable features are vulnerability scanning, policy compliance scanning, and tablet for web application scanning."

More Qualys VMDR pros

Cons

"Right now, they are missing the static application security part, especially web application security."

"Currently, there is nothing I would like to improve."

"They could enhance the support for data swap testing for the platform."

"They need to improve their support in the documentation. Their support mechanism is missing. Their responsiveness, technical staff, and these types of things need to be improved, and comprehensive documentation is required. They should have good self-service portal enhancement"

"Invicti's reporting capabilities need enhancement."

"The solution's false positive analysis and vulnerability analysis libraries could be improved."

"It would be better for listing and attacking Java-based web applications to exploit vulnerabilities."

"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."

More Invicti cons

"Qualys VM's scanner doesn't pick up every vulnerability, so we have to use multiple scanners to cover that gap."

"Qualys currently does not have any features for scanning SCADA, IoT, and Industrial Control Systems."

"I would like to see this solution more developed and competitive in the Cloud space."

"Finding things in management can be quite difficult."

"If AI features were integrated, it could enhance the capabilities significantly."

"Some of the older features could be polished instead of focusing on releasing new features."

"Qualys Container Security can improve the interface. It could be easier to navigate and be enriched."

"The reporting needs improvement. It should generate much more stuff like field reports."

More Qualys VMDR cons

Pricing and Cost Advice

"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."

"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."

"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."

"We never had any issues with the licensing; the price was within our assigned limits."

"The price should be 20% lower"

"It is competitive in the security market."

"OWASP Zap is free and it has live updates, so that's a big plus."

More Invicti pricing and cost advice

"When you want to cover yourself for scalability, you will be charged for the number you place on the scan itself."

"We have an annual contract for Qualys VMDR. I believe it's for either two years or five years."

"An annual license for a single scanner costs around $3,000."

"It's very expensive, especially if you want to use multiple modules of Qualys."

"It is different for every company, but for us, it's every three years."

"I used to work there, so I never paid for the product. As an employee, we get a lifetime license for personal use, and that's what I'm using. It is a comprehensive platform, so there is a lot more to it. There could be other solutions that are probably a little bit cheaper, but it depends on what people need. Different people have different needs. It offers many things on the same platform. If you add all the things up, it should be cheaper, but I have not done any analysis specifically."

"The license is on a yearly basis."

"Qualys Virtual Scanner Appliance isn't expensive right now. But the price for their product bundles could be better."

More Qualys VMDR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Container Security solutions are best for your needs.

See recommendations

881,082 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

11%

Manufacturing Company

Government

Financial Services Firm

16%

Computer Software Company

10%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	14
Midsize Enterprise	4
Large Enterprise	13

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	12
Large Enterprise	70

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?

The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...

See all answers

What needs improvement with Invicti?

At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...

See all answers

What is your primary use case for Invicti?

I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...

See all answers

What do you like most about Qualys VMDR?

I like that we have many scanners and channels that don't overload. It helps us scan and track easily. Also, the tagging system is good for tagging. We can still use QualysAgent task ID tools even ...

See all answers

What is your experience regarding pricing and costs for Qualys VMDR?

My experience with pricing, setup cost, and licensing shows that we can consider both time and money saved.

See all answers

What needs improvement with Qualys VMDR?

See all answers

Comparisons

Acunetix vs Invicti

Compared 16% of the time

SonarQube vs Invicti

Compared 8% of the time

Veracode vs Invicti

Compared 7% of the time

OpenText Dynamic Application Security Testing vs Invicti

Compared 6% of the time

Rapid7 InsightAppSec vs Invicti

Compared 6% of the time

More Invicti Competitors

Rapid7 InsightVM vs Qualys VMDR

Compared 9% of the time

Tenable Nessus vs Qualys VMDR

Compared 9% of the time

Microsoft Defender Vulnerability Management vs Qualys VMDR

Compared 6% of the time

Tenable Security Center vs Qualys VMDR

Compared 5% of the time

Wiz vs Qualys VMDR

Compared 4% of the time

More Qualys VMDR Competitors

Product Reports

Buyer's Guide

Invicti

January 2026

Download Invicti product report

Buyer's Guide

Qualys VMDR

January 2026

Download Qualys VMDR product report

Also Known As

Netsparker

Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security

Overview

Invicti helps DevSecOps teams automate security tasks and save hundreds of hours each month by identifying web vulnerabilities that matter. Combining dynamic with interactive testing (DAST + IAST) and software composition analysis (SCA), Invicti scans every corner of an app to find what other tools miss with 99.98% accuracy, delivering on the promise of Zero Noise AppSec. Invicti helps discover all web assets — even ones that are lost, forgotten, or created by rogue departments. With an array of out-of-the-box integrations, DevSecOps teams can get ahead of their workloads to hit critical deadlines, improve processes, and communicate more effectively while reducing risk and hitting the ROI goals.

Invicti

Vulnerability Management, Detection, and Response (VMDR) is a cornerstone product of the Qualys TruRisk Platform and a global leader in the enterprise-grade vulnerability management (VM) vendor space. With VMDR, enterprises are empowered with visibility and insight into cyber risk exposure - making it easy to prioritize vulnerabilities, assets, or groups of assets based on business risk. Security teams can take action to mitigate risk, helping the business measure their actual risk exposure over time.

Qualys VMDR offers an all-inclusive risk-based vulnerability management solution to prioritize vulnerabilities and assets based on risk and business criticality. VMDR seamlessly integrates with configuration management databases (CMDB), Qualys Patch Management, Custom Assessment and Remediation (CAR), Qualys TotalCloud and other Qualys and non-Qualys solutions to facilitate vulnerability detection and remediation across the entire enterprise.

With VMDR, users are empowered with actionable risk insights that translate vulnerabilities and exploits into optimized remediation actions based on business impact. Qualys customers can now aggregate and orchestrate data from the Qualys Threat Library, 25+ threat intelligence feeds, and third-party security and IT solutions, empowering organizations to measure, communicate, and eliminate risk across on-premises, hybrid, and cloud environments.

Qualys

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank

Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx

Buyer's Guide

Invicti vs. Qualys VMDR

December 2025

Free Report: Invicti vs. Qualys VMDR

Find out what your peers are saying about Invicti vs. Qualys VMDR and other solutions. Updated: December 2025.

DOWNLOAD NOW

881,082 professionals have used our research since 2012.

See our Invicti vs. Qualys VMDR report.

See our list of best Container Security vendors.

We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.