No more typing reviews! Try our Samantha, our new voice AI agent.

ManageEngine Vulnerability Manager Plus vs Rapid7 Metasploit comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
11th
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
43
Ranking in other categories
Container Security (12th), Cloud Workload Protection Platforms (CWPP) (8th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (7th)
ManageEngine Vulnerability ...
Ranking in Vulnerability Management
40th
Average Rating
9.4
Reviews Sentiment
7.4
Number of Reviews
3
Ranking in other categories
No ranking in other categories
Rapid7 Metasploit
Ranking in Vulnerability Management
22nd
Average Rating
8.0
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.2%, up from 1.0% compared to the previous year. The mindshare of ManageEngine Vulnerability Manager Plus is 0.7%, down from 0.8% compared to the previous year. The mindshare of Rapid7 Metasploit is 2.1%, up from 1.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.2%
Rapid7 Metasploit2.1%
ManageEngine Vulnerability Manager Plus0.7%
Other96.0%
Vulnerability Management
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
MB
IT Helpdesk at a manufacturing company with 51-200 employees
Enhanced endpoint security with effective patch management and frequent scans
The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities. ManageEngine Vulnerability Manager Plus was the perfect fit for managing these requirements. We improved the number of scans and patches performed from four times per year per computer to four times per month.
reviewer1247523 - PeerSpot reviewer
Head of Sales Services Department at a comms service provider with 51-200 employees
Extensive exploit database and seamless integration enhance penetration testing capabilities
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even the same attack you provide today will go in different ways another day. I prefer when the auditor or pen-tester provides the attack in a non-automated mode. For some, it might be a valuable option, but I'm not sure it's valuable for us, as after the attack has been provided, we should release a report detailing how it transpired and what the customer should improve to block this way of attack. If the attack was provided in an automated mode, you cannot receive sufficient information that helps with this final report for the customer. While you can check the vulnerability, and the system will tell you there is no vulnerability, usually, a human can change one, two, or three parameters and using the same technique and the same scripts can break the system. Rapid7 Metasploit could be improved in areas concerning the experience with finding particular scripts pre-installed in the solution. Customers, administrators, and pen-testers spend considerable time trying to locate the specific component they need by the name of the technique or the name of the attack, so any improvements in making it easier to find those predefined components by name or timeframe would be beneficial. Search filters could be a correct improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility."
"Qualys TotalCloud provides a single, prioritized view of risk, reducing the workload associated with consolidating multiple sources for risk prioritization."
"Once you have your vulnerabilities fixed and your patches pushed out using Qualys TotalCloud, then you are able to eliminate threats and cyber risk."
"The best feature would be the ability to create policies. It is easy to control and update policies as required."
"The most valuable feature of Qualys TotalCloud is the visibility it provides."
"If someone were to ask me to review Qualys TotalCloud, I would summarize it as an end-to-end solution for cloud security with visibility and governance-grade controls without needing to manage multiple disconnected tools."
"We were able to realize its benefits within 24 to 48 hours."
"While automatic inventory detection upon connection is a helpful feature, a truly valuable capability would be assessing an environment's security posture against Azure and CIS best practices."
"I have been using it for over two years, and it is fantastic."
"The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities."
"ManageEngine is a comprehensive tool that is broad and can be customized to fit specific needs."
"The solution helps us figure out vulnerabilities and fix them."
"The search engine is actually pretty cool, it allows you to search the vulnerability very fast, and the big difference is that the exploit you see on Metasploit has been tested and imported, it's going to work and it is not going to crash anything."
"The solution is open source and has many small targetted penetration tests that have been written by many people that are useful. You can choose different subjects for the test, such as Oracle databases or Apache servers."
"I don't have any other tools like it, and I always use it when I'm doing a pen test. Metasploit is a great solution for penetration testing,"
"Technical support has been helpful and responsive."
"All of the features are great."
"The Search Engineering feature is good."
"The reporting on the solution is good."
"The most valuable features of Metasploit include its powerful capabilities for exploitation and scanning."
 

Cons

"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"It has been working very well, but it would be helpful if the dashboard could generate reports tailored to specific compliance needs. For example, in India, we have to comply with RBI and SEBI guidelines. It w"
"An area for improvement would be to focus on risks related to AI, such as large language models and potential data leakage."
"TotalCloud could improve its scanning of niche devices like Wi-Fi dongles and USB modems because they are often untested. It covers everything else, like laptops, mobile devices, and Bluetooth IoT devices. They can improve on the small IoT devices because hackers and testers use these."
"The main area needing improvement is integration. Although the team is strengthening TotalCloud, integration can be enhanced with SIEM, SOAR, ITSM, and other sources."
"Although TotalCloud is a helpful tool, some of its advanced features are still under development."
"Qualys TotalCloud needs to improve its accuracy for non-Windows operating systems."
"There is room for improvement in vulnerability scanning, particularly for PaaS environments. Currently, Qualys does not have full access to these instances, which limits its effectiveness."
"The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved."
"One area that needs improvement is the contract management. My legal team required some partner requirements for that, and ManageEngine could not support it."
"The user interface is the only drawback of the product."
"Rapid7 Metasploit can add a GUI feature because it is only available online."
"Exploit updates are slow after security patches to a certain OS."
"The solution should be more user friendly."
"At the time I was using it, the graphical user interface needed some improvements."
"The solution is not very scalable, it does not provide any automation to be able to scale it."
"I think areas with shortcomings that need improvement are more integration and automation."
"Better automation capabilities would be an improvement."
"There are numerous outdated exploits in their database that should be updated."
 

Pricing and Cost Advice

"TotalCloud's price is about right where I would expect it to be."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"The cost is high, but it meets our organizational needs."
"The price is very reasonable."
"The pricing structure involves a one-time purchase cost of approximately twenty thousand dollars or euros for all customers."
"We pay monthly. The pricing is reasonable."
"I have used the free version of Rapid7 Metasploit."
"It is a reasonably priced solution. I would rate it from five out of ten."
"The great advantage with Rapid7 Metasploit, of course, is that it's free."
"I use the open-source version of this product. Pricing is not relevant."
"There are two versions available, one of which is the Pro version, and the other is the free version."
"It is expensive. Our license expired, and our company is not thinking to renew because of our budget."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
909,725 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
13%
Comms Service Provider
11%
Outsourcing Company
11%
Financial Services Firm
10%
Financial Services Firm
12%
Comms Service Provider
8%
Computer Software Company
8%
Construction Company
8%
Construction Company
11%
Manufacturing Company
10%
Comms Service Provider
9%
Educational Organization
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise5
Large Enterprise31
No data available
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise12
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evalua...
What is your experience regarding pricing and costs for ManageEngine Vulnerability Manager Plus?
ManageEngine is considered an affordable solution, offering competitive pricing compared to similar solutions like Ut...
What needs improvement with ManageEngine Vulnerability Manager Plus?
The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved. The asset d...
What is your primary use case for ManageEngine Vulnerability Manager Plus?
I worked in an integrator solution company, and we implemented ManageEngine Vulnerability Manager Plus for different ...
What is your experience regarding pricing and costs for Rapid7 Metasploit?
The pricing of Rapid7 Metasploit is quite affordable. It has a free version that many customers start with, and after...
What needs improvement with Rapid7 Metasploit?
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even ...
What is your primary use case for Rapid7 Metasploit?
I use Rapid7 Metasploit as a distributor, as an integrator, and as a user. I use Rapid7 Metasploit in my company inte...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
Metasploit
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
City of Corpus Christi, Diebold, Lumenate, Nebraska Public Power District, Prairie North Regional Health, Apptio, Automation Direct, Bob's Stores, Cardinal Innovations Healthcare Solutions, Carnegie Mellon University
Find out what your peers are saying about ManageEngine Vulnerability Manager Plus vs. Rapid7 Metasploit and other solutions. Updated: August 2026.
909,725 professionals have used our research since 2012.