No more typing reviews! Try our Samantha, our new voice AI agent.

Nucleus Security vs Rapid7 Metasploit comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 23, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
11th
Average Rating
8.6
Reviews Sentiment
7.3
Number of Reviews
39
Ranking in other categories
Container Security (13th), Cloud Workload Protection Platforms (CWPP) (9th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (1st), Cloud-Native Application Protection Platforms (CNAPP) (8th)
Nucleus Security
Ranking in Vulnerability Management
41st
Average Rating
7.0
Reviews Sentiment
6.9
Number of Reviews
1
Ranking in other categories
Application Security Tools (27th), Risk-Based Vulnerability Management (14th), Continuous Threat Exposure Management (CTEM) (13th)
Rapid7 Metasploit
Ranking in Vulnerability Management
24th
Average Rating
8.0
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.0%, up from 0.9% compared to the previous year. The mindshare of Nucleus Security is 0.9%, up from 0.8% compared to the previous year. The mindshare of Rapid7 Metasploit is 1.9%, up from 1.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.0%
Rapid7 Metasploit1.9%
Nucleus Security0.9%
Other96.2%
Vulnerability Management
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
reviewer2808414 - PeerSpot reviewer
Health Care Specialist at a healthcare company with 11-50 employees
Improved radiation safety and compliance has supported patient care but daily workflows still need refinement
I think it can be improved by making it more practical, integrated, and easier for teams to apply in real-world workflow from a healthcare perspective. The main improvements I can see right now are better user training with real-case scenarios rather than only theory, and clear and simple protocols for day-to-day operations. Strong integration between safety compliance and documentation systems would help significantly in practice for the healthcare field, which is a niche field. The biggest gain would come from making security processes easier to follow consistently, especially in busy environments where teams need to be aware of clarity and really need to rely on the documentation they are using.I chose a rating of seven because it offers strong value in safety, risk reduction, and compliance, especially in healthcare. However, there is still room for improvement in usability and day-to-day integration. Protocols can be too complex in practice sometimes, and some processes can feel heavy and disconnected from our daily workflow.
reviewer1247523 - PeerSpot reviewer
Head of Sales Services Department at a comms service provider with 51-200 employees
Extensive exploit database and seamless integration enhance penetration testing capabilities
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even the same attack you provide today will go in different ways another day. I prefer when the auditor or pen-tester provides the attack in a non-automated mode. For some, it might be a valuable option, but I'm not sure it's valuable for us, as after the attack has been provided, we should release a report detailing how it transpired and what the customer should improve to block this way of attack. If the attack was provided in an automated mode, you cannot receive sufficient information that helps with this final report for the customer. While you can check the vulnerability, and the system will tell you there is no vulnerability, usually, a human can change one, two, or three parameters and using the same technique and the same scripts can break the system. Rapid7 Metasploit could be improved in areas concerning the experience with finding particular scripts pre-installed in the solution. Customers, administrators, and pen-testers spend considerable time trying to locate the specific component they need by the name of the technique or the name of the attack, so any improvements in making it easier to find those predefined components by name or timeframe would be beneficial. Search filters could be a correct improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Generally, Qualys is very good at detections, whether on cloud or on-prem, and the agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us."
"Qualys TotalCloud's most valuable feature is its ability to link clusters of assets, providing a clear model of deployments, vulnerabilities, and statuses."
"Qualys TotalCloud is an excellent platform, and the beauty of the platform is that we can get all the vulnerabilities, see all the reports in a single dashboard, view them segregated, and easily learn about critical, high, and medium findings with appropriately provided remediation steps."
"The agent and agentless scanning in TotalCloud, particularly the FlexScan method, is incredibly valuable. With traditional scanning approaches, we had to give IP ranges and whitelist IPs. All that is now simplified. FlexScan requires minimal intervention, and after configuration, it automatically collects data and performs necessary scans."
"While automatic inventory detection upon connection is a helpful feature, a truly valuable capability would be assessing an environment's security posture against Azure and CIS best practices."
"If someone were to ask me to review Qualys TotalCloud, I would summarize it as an end-to-end solution for cloud security with visibility and governance-grade controls without needing to manage multiple disconnected tools."
"One of the most valuable features of Qualys TotalCloud is FlexScan, which is specifically for internet-facing VMs. We found this feature to be very useful. It was a key differentiator for us."
"Qualys TotalCloud has significantly reduced our workload in terms of managing risks, helping us to be more efficient and save substantial resources."
"We have seen clear compliance and risk control outcomes more than other operational metrics, including fewer process gaps during documentation and safety checks, strong consistency in following protocols for handling, traceability, and staff awareness, better audit readiness, a lower chance of procedure errors, and faster escalation when something appears out of standard, which is very important for us in the healthcare sector."
"I would definitely recommend Metasploit to others."
"It's not possible to do penetration testing without being very proficient in Metasploit."
"This product is fantastic."
"The option to generate phishing emails has proven to be very valuable in understanding the behavior of users."
"The most valuable feature for us is the support for testing Linux-based web server components."
"The reporting on the solution is good."
"Technical support is very good; whenever we need assistance, they are quite helpful and responsive."
"I don't have any other tools like it, and I always use it when I'm doing a pen test. Metasploit is a great solution for penetration testing,"
 

Cons

"It has been working very well, but it would be helpful if the dashboard could generate reports tailored to specific compliance needs. For example, in India, we have to comply with RBI and SEBI guidelines. It w"
"To improve the user experience, reporting could be simplified for better comprehension by end users and project managers, facilitating issue resolution."
"I would appreciate additional integration options to connect Qualys TotalCloud with our other vulnerability management tools."
"Overall, we are satisfied with it. However, the response part of the Cloud Detection and Response (CDR) module can be improved. It is not yet in place according to requirements; it is not completely available even though the module has been released."
"In TotalCloud, I would suggest improvements in policy checks to cater to various inventory types like VPCs, subnets, S3 buckets, or IAMs. There is a lack of data segregation according to criticality or inventory."
"I sometimes have difficulty detecting or uninstalling certain versions of applications, which I have to do manually."
"The onboarding process is a bit difficult. In the initial phase, it is very difficult to understand the features, what the dashboard contains, and what criteria they are using."
"It is already perfect, but they can bring some newer dashboards and customization options for the dashboard. It would be great to be able to include on-prem assets on the dashboard."
"Protocols can be too complex in practice sometimes, and some processes can feel heavy and disconnected from our daily workflow."
"While Metasploit excels in vulnerability assessment, it could improve in vulnerability management."
"The reporting feature needs improvement."
"Rapid7 Metasploit can add a GUI feature because it is only available online."
"It is necessary to add some training materials and a tutorial for beginners."
"The solution should be more user friendly."
"Metasploit cannot be installed on a machine with an antivirus."
"The database is not always updated with the latest vulnerabilities or zero-day exploits."
"The reporting feature needs improvement. The time taken to fetch reports based on the number of events can be extensive, unlike Tenable, which is more user-friendly and faster."
 

Pricing and Cost Advice

"Qualys TotalCloud offers cost-effective licensing flexibility."
"TotalCloud's price is about right where I would expect it to be."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"Qualys TotalCloud is expensive."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
Information not available
"Rapid7 Metasploit is cheaper than Tenable.io Vulnerability Management."
"The cost is approximately $15 per device."
"There are two versions available, one of which is the Pro version, and the other is the free version."
"We pay monthly. The pricing is reasonable."
"The great advantage with Rapid7 Metasploit, of course, is that it's free."
"I use the open-source version of this product. Pricing is not relevant."
"It is expensive. Our license expired, and our company is not thinking to renew because of our budget."
"The pricing structure involves a one-time purchase cost of approximately twenty thousand dollars or euros for all customers."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
896,099 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Computer Software Company
9%
Manufacturing Company
9%
Government
8%
Computer Software Company
14%
Financial Services Firm
12%
Construction Company
8%
Comms Service Provider
7%
Manufacturing Company
9%
Construction Company
9%
Computer Software Company
9%
Comms Service Provider
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise3
Large Enterprise28
No data available
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise12
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
Areas that need improvement in every solution include the remediation part. The remediation steps should be simple en...
What is your primary use case for Qualys TotalCloud?
Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal appli...
What is your experience regarding pricing and costs for Nucleus Security?
I have a good experience with that, so we don't have much problem dealing with pricing, setup, and licensing.
What needs improvement with Nucleus Security?
I think it can be improved by making it more practical, integrated, and easier for teams to apply in real-world workf...
What is your primary use case for Nucleus Security?
I have been using Nucleus Security for the past few years in my company, particularly in the healthcare field.I use N...
What is your experience regarding pricing and costs for Rapid7 Metasploit?
The pricing of Rapid7 Metasploit is quite affordable. It has a free version that many customers start with, and after...
What needs improvement with Rapid7 Metasploit?
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even ...
What is your primary use case for Rapid7 Metasploit?
I use Rapid7 Metasploit as a distributor, as an integrator, and as a user. I use Rapid7 Metasploit in my company inte...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
Metasploit
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
City of Corpus Christi, Diebold, Lumenate, Nebraska Public Power District, Prairie North Regional Health, Apptio, Automation Direct, Bob's Stores, Cardinal Innovations Healthcare Solutions, Carnegie Mellon University
Find out what your peers are saying about Nucleus Security vs. Rapid7 Metasploit and other solutions. Updated: April 2026.
896,099 professionals have used our research since 2012.