Try our new research platform with insights from 80,000+ expert users

JFrog Xray vs Microsoft Defender Vulnerability Management comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Zafran Security
Sponsored
Ranking in Vulnerability Management
16th
Average Rating
9.6
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Continuous Threat Exposure Management (CTEM) (1st)
JFrog Xray
Ranking in Vulnerability Management
32nd
Average Rating
7.8
Reviews Sentiment
6.4
Number of Reviews
9
Ranking in other categories
Container Security (18th), Software Composition Analysis (SCA) (6th), Software Supply Chain Security (2nd)
Microsoft Defender Vulnerab...
Ranking in Vulnerability Management
11th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Advanced Threat Protection (ATP) (16th), Microsoft Security Suite (20th), Risk-Based Vulnerability Management (5th)
 

Mindshare comparison

As of September 2025, in the Vulnerability Management category, the mindshare of Zafran Security is 1.0%, up from 0.1% compared to the previous year. The mindshare of JFrog Xray is 1.5%, up from 0.8% compared to the previous year. The mindshare of Microsoft Defender Vulnerability Management is 2.8%, down from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Market Share Distribution
ProductMarket Share (%)
Microsoft Defender Vulnerability Management2.8%
Zafran Security1.0%
JFrog Xray1.5%
Other94.7%
Vulnerability Management
 

Featured Reviews

Israel Cavazos Landini - PeerSpot reviewer
Weekly insights and risk analysis facilitate informed security decisions
I appreciate the weekly insights Zafran provides, which include critical topics for networks and IT security, allowing us to evaluate which insights apply to our environment. The organization score feature is valuable to keep the leadership team updated on how our infrastructure fares security-wise. The applicable risk level versus base risk level feature is beneficial because prior to Zafran, we only used the base risk level, but now understand that risk depends on the asset itself. Zafran is an excellent tool.
Anand Nanwana - PeerSpot reviewer
Offers flexibility across clouds and easy credential management while interface improvements are needed
For JFrog Xray, the Artifactory and package repositories are valuable features. There are many benefits from JFrog Xray. For example, with other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well. JFrog can support multiple packages, such as NuGet package, pip, and other technologies. It can be used for Terraform as well. The credential management is very easy in JFrog. For instance, when using GitHub action as a CI/CD tool, I just need to create a token and set up JFrog CLI there and give access to the repository. With multiple repositories, I can generate a token for a specific repository, add that token in the GitHub secret, fetch from the CI/CD, run the command JFrog CLI, and authenticate through the token. Then we can push the images into JFrog.
NaySan @ Suraj Verma - PeerSpot reviewer
Provides actionable vulnerability insights and recommendations with notable efficiency
They may need to improve the portal refresh rate for Microsoft Defender Vulnerability Management because it takes time for recommendations to disappear after mitigation; sometimes, it takes one week, when it should ideally take only one to two hours. Overall, everything is good with Microsoft Defender Vulnerability Management, but the portal refresh rate can take up to seven days in some cases and three or four days in others to reflect changes.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Zafran is an excellent tool."
"We are able to see the real risk of a vulnerability on our environment with our security tools."
"Zafran has become an indispensable tool in our cybersecurity arsenal."
"We saw benefits from Zafran Security almost immediately after deploying it."
"Overall, we have seen about eighty-seven percent reduction of the number of vulnerabilities that require urgency to remediate, specifically the number of criticals."
"JFrog Xray's reporting feature has a lot of options in it, including scanning."
"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."
"With JFrog, we can use this registry from any cloud or work locally as well, and it can support multiple packages such as NuGet, pip, and other technologies including Terraform, making credential management very easy."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
"Good reporting functionalities."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."
"JFrog Xray shows us a list of vulnerabilities that can impact our code."
"The solution is highly scalable."
"The integration with Sentinel has been one of the most valuable features for my organization."
"Microsoft Defender Vulnerability Management is a good product, and I believe it deserves a positive recommendation."
"The solution helps identify threats and vulnerabilities."
"Microsoft Defender Vulnerability Management is versatile and assesses vulnerabilities, providing detailed information on CVEs, their categories, and exploit statuses."
"One valuable feature is the Microsoft Security Scorecard."
"The main advantage of Microsoft Defender Vulnerability Management is that it can locate and prevent most threats even when the endpoints are not connected to the corporate network, as long as the internet is available."
"Microsoft Defender Vulnerability Management is versatile and assesses vulnerabilities, providing detailed information on CVEs, their categories, and exploit statuses."
 

Cons

"Initially, we were somewhat concerned about the scalability of Zafran due to our large asset count and the substantial amount of information we needed to process."
"I think the ability to have some enhanced reporting capabilities is something they can improve on, as they have good reports but we have asked for some specific reporting enhancements."
"The dashboarding and reporting functionality of Zafran Security is an area that definitely could use some improvements."
"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."
"Lacks deeper reporting, the ability to compare things."
"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."
"JFrog Xray does not have a dashboard."
"The speed of JFrog Xray should improve. Other solutions have better performance."
"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."
"The UI of JFrog Xray could be improved. There is a dialogue box in the Xray section that doesn't always work properly."
"Since we have been using the solution via APIs, there are some limitations in the APIs."
"The constant changes in the product configuration or the console setup can sometimes be challenging."
"It is expensive."
"We have experienced some logging issues, including a few hours of downtime initially. Despite this, I would rate the overall stability as an eight."
"It is challenging to extract and customize reports from the system."
"The automated remediations can be more specific."
"The worst aspect is the refresh rate of the dashboard. A vulnerability I patch within 15 minutes takes 24 additional hours for an update."
"The technical support takes too much time to resolve tickets."
"There should be risk scoring added to Microsoft Defender Vulnerability Management; specifically, they call it quantification of the risk."
 

Pricing and Cost Advice

Information not available
Information not available
"The licensing model follows a per-user per-month structure."
"The product’s pricing is medium."
"The licensing costs are reasonable."
"I rate the product's price a three on a scale of one to ten, where one is a low price, and ten is a high price."
"The tool is a bit costly."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
866,857 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
11%
Computer Software Company
10%
Manufacturing Company
7%
Government
5%
Financial Services Firm
25%
Manufacturing Company
12%
Computer Software Company
11%
Government
5%
Financial Services Firm
12%
Computer Software Company
12%
Government
9%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business1
Midsize Enterprise2
Large Enterprise6
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise2
Large Enterprise5
 

Questions from the Community

What is your experience regarding pricing and costs for Zafran Security?
Since we stood Zafran Security up in our private cloud, we handle the maintenance on our side. As we opted not to use...
What needs improvement with Zafran Security?
In terms of areas for improvement, Zafran Security is doing a really great job as a new and emerging company. Oftenti...
What is your primary use case for Zafran Security?
My use cases for Zafran Security revolve around two primary areas. One is around vulnerability management and priorit...
What do you like most about JFrog Xray?
JFrog Xray shows us a list of vulnerabilities that can impact our code.
What needs improvement with JFrog Xray?
The UI of JFrog Xray could be improved. There is a dialogue box in the Xray section that doesn't always work properly...
What is your primary use case for JFrog Xray?
I work with JFrog Xray. I use JFrog as an Artifactory registry and package registry. In JFrog Xray, there are many ar...
What is your experience regarding pricing and costs for Microsoft Defender Vulnerability Management?
I would rate the price as a three for us due to the partnership discounts. For non-partners, however, the cost could ...
What needs improvement with Microsoft Defender Vulnerability Management?
I have not thought about improvements for Microsoft Defender Vulnerability Management as of now, but this is typicall...
 

Also Known As

No data available
JFrog Security Essentials
No data available
 

Overview

 

Sample Customers

Information Not Available
google, amazon, cisco, netflix, oracle, vmware, facebook
Information Not Available
Find out what your peers are saying about JFrog Xray vs. Microsoft Defender Vulnerability Management and other solutions. Updated: July 2025.
866,857 professionals have used our research since 2012.