No more typing reviews! Try our Samantha, our new voice AI agent.

PortSwigger Burp Suite Enterprise Edition vs Qualys VMDR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 25, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

PortSwigger Burp Suite Ente...
Ranking in Vulnerability Management
40th
Average Rating
8.0
Reviews Sentiment
7.2
Number of Reviews
12
Ranking in other categories
Dynamic Application Security Testing (DAST) (7th)
Qualys VMDR
Ranking in Vulnerability Management
3rd
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
96
Ranking in other categories
IT Asset Management (3rd), Configuration Management Databases (3rd), Container Security (9th), Risk-Based Vulnerability Management (1st)
 

Mindshare comparison

As of May 2026, in the Vulnerability Management category, the mindshare of PortSwigger Burp Suite Enterprise Edition is 1.1%, up from 0.9% compared to the previous year. The mindshare of Qualys VMDR is 4.2%, down from 8.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys VMDR4.2%
PortSwigger Burp Suite Enterprise Edition1.1%
Other94.7%
Vulnerability Management
 

Featured Reviews

OB
Studiant at Edifixio
Enables time-saving automated scanning and brute force attacks
The most appreciated functionality of PortSwigger Burp Suite is its ability to perform brute force attacks automatically. Its automated scanning feature saves time. Additionally, using this tool provides significant security insights, making our testing process more efficient and comprehensive, leading to considerable time savings, which in turn translates to financial benefits.
Vaibhav Ghule - PeerSpot reviewer
Soc Lead & Edr Administration at Persistent Systems
Continuous risk-based monitoring has strengthened incident response and vulnerability prioritization
I haven't explored Qualys VMDR's vulnerability lifecycle automation yet. One of my analysts mentioned that queries lack grouping operators in Qualys VMDR. From my experience, I would appreciate improvements in the query options in Qualys VMDR, specifically in the query-building process where I would need more features and operators. Additionally, we have been facing issues with Qualys on the cloud level. We cannot download the configuration profile from the cloud agent, and it is showing a pending action for download. During 2025, we noticed outages of Qualys a couple of times. I want to mention that there is an issue with receiving timely RCA deliveries. While this is not necessarily about the tool, it relates to support. The support has not been very responsive, and we are receiving RCAs a little delayed whenever we raise support cases or communicate with the TAMs. Additionally, the UI has a slight latency, which I and my team have experienced. They have also reported this latency issue when navigating through different pages.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The tool is loaded with many features that give us ROI."
"The initial setup is straightforward."
"The most valuable features of PortSwigger Burp Suite Enterprise Edition are the vast amount of options and ease of use, and they frequently improve the solution every six months to a year."
"We are in the early stage of using the solution making it difficult to fully determine the best features; however, we have noticed the CMDB and device discovery features look valuable at this time."
"I like normal dynamic scanning, general web applications scanning, and vulnerability assessments."
"The most valuable part is that a beginner can run those scans and the V scanning of that particular vulnerability."
"The most valuable features of PortSwigger Burp Suite Enterprise Edition are the vast amount of options and ease of use. They frequently improve the solution every six months to a year. Additionally, if we want any more features we can upload a custom script to meet our needs."
"The solution's extensions really expand the capabilities and features offered by the installation."
"The prioritization of vulnerabilities has improved our remediation efforts by around thirty to thirty-five percent."
"If you are familiar with or have hands on experience with Qualys Asset Inventory, this is a better tool, as it will give you in-depth details of all the assets and the managing inventory will be better, and it will also give you advanced features compared to those of other inventory tools."
"Qualys VM's best features are vulnerability management and customizable scoring."
"The solution, overall, is very useful for our organization; it is very easy to use and there are lots of options, and we can usually easily go through it and all of the things we want to configure, and we can configure everything to our specifications very easily."
"The integrations for this solution are very good. I use a different product for virtual patching of vulnerabilities and Qualys integrates well with that product."
"The integrations for this solution are very good, as I use a different product for virtual patching of vulnerabilities and Qualys integrates well with that product."
"Qualys VM has improved the way the organization functions."
"I value the scheduling of scans and reports as per the desired timeframes."
 

Cons

"PortSwigger Burp Suite Enterprise Edition should incorporate a static code analysis feature. One main issue we encounter is false positives. False positives can be challenging for developers."
"The product needs to have the ability to evaluate more."
"It's not a stable product. Sometimes, it takes a lot of time to scan."
"The implementation of the solution is quite complicated and could be easier."
"The stability is a big issue. So many times the scans fail."
"It would be better if the solution is cloud-based."
"It would be beneficial if Burp Suite provided predefined payloads for each attack category, such as SQL injection and cross-site scripting, to automate some tasks more effectively."
"The cost per license per user could be cheaper, specifically for individual licensing."
"The reporting in this solution can be improved."
"I do not like that all of the data is stored on the cloud."
"There needs to be better documentation. Maybe their price scheduler could be made simpler. It's expensive."
"The tool needs to improve the adding assets and report generation features. I would like to see the policy scan of offline appliances in the product's future releases."
"Improve the API speed."
"The solution is a bit expensive if you do not have access to discounts."
"Qualys could be improved in its overall performance compared to other vulnerability management or scanning tools."
"Qualys could improve the inbuilt dashboards."
 

Pricing and Cost Advice

"PortSwigger Burp Suite Enterprise Edition is neither a cheap nor an expensive product. PortSwigger Burp Suite Enterprise Edition is a good tool for companies."
"The tool's pricing is reasonable and costs around 400 dollars per year."
"PortSwigger Burp Suite Enterprise Edition is expensive compared to other solutions."
"Although the solution can be a bit expensive for small companies, its pricing is fairly reasonable for its capabilities."
"For Professional, it's about $400 per year."
"They have recently changed the pricing model, which is now better than it was before."
"Qualys is cheaper and more affordable than other solutions."
"Qualys VM is quite expensive. It's a subscription-based license, and it's yearly. Right now, it's open for me, and I don't have any limitations or caps on the licenses. They are seeing if the product is viable for 4500 users. I can add as much as I want, and at the end of the subscription, they'll let me know how many licenses were actually used and bill me accordingly. On a scale from one to five, I would give their pricing a three. It's still expensive."
"There are no additional fees in addition to the standard licensing fees."
"It is more expensive than other products on the market."
"We have an annual contract for Qualys VMDR. I believe it's for either two years or five years."
"There is a license for the use of this solution. We pay annually instead of monthly to receive a better discount on the price."
"We do see over $100,000 in terms of price, for mid-size programs. You likely will pay more than $100,000 without any discount. It is a bit pricey."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
893,311 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Manufacturing Company
8%
Computer Software Company
7%
Construction Company
6%
Financial Services Firm
16%
Computer Software Company
7%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise2
Large Enterprise7
By reviewers
Company SizeCount
Small Business20
Midsize Enterprise12
Large Enterprise70
 

Questions from the Community

What is your experience regarding pricing and costs for PortSwigger Burp Suite Enterprise Edition?
I am using the Community Edition, which is free, however, I understand there might be extra expenses for additional features or services.
What needs improvement with PortSwigger Burp Suite Enterprise Edition?
It would be beneficial if Burp Suite provided predefined payloads for each attack category, such as SQL injection and cross-site scripting, to automate some tasks more effectively.
What is your primary use case for PortSwigger Burp Suite Enterprise Edition?
I work with security testing tools for SaaS, focusing on static application security testing and using tools like Burp Suite for replaying Apex.
What is your experience regarding pricing and costs for Qualys VMDR?
My experience with pricing, setup cost, and licensing shows that we can consider both time and money saved.
What needs improvement with Qualys VMDR?
I haven't explored Qualys VMDR's vulnerability lifecycle automation yet. One of my analysts mentioned that queries lack grouping operators in Qualys VMDR. From my experience, I would appreciate imp...
What advice do you have for others considering Qualys VMDR?
I have some understanding about PeerSpot, and I have visited the website. PeerSpot is similar to TrustRadius. It takes reviews from customers or end users who are using the tools and technologies i...
 

Also Known As

No data available
Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security
 

Overview

 

Sample Customers

Nasa, Disney, Dow Jones, Iberia Bank, IBM, Ernest and Young, Apple, Ryanair, Thyssenkrupp, Delivery Hero
Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx
Find out what your peers are saying about PortSwigger Burp Suite Enterprise Edition vs. Qualys VMDR and other solutions. Updated: April 2026.
893,311 professionals have used our research since 2012.