Try our new research platform with insights from 80,000+ expert users

Qualys CyberSecurity Asset Management vs Xygeni comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Nov 2, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys CyberSecurity Asset ...
Ranking in Software Supply Chain Security
4th
Average Rating
9.0
Reviews Sentiment
7.0
Number of Reviews
35
Ranking in other categories
Vulnerability Management (7th), Patch Management (4th), Cyber Asset Attack Surface Management (CAASM) (3rd), Attack Surface Management (ASM) (2nd)
Xygeni
Ranking in Software Supply Chain Security
13th
Average Rating
9.0
Reviews Sentiment
6.6
Number of Reviews
3
Ranking in other categories
Application Security Tools (22nd), Software Composition Analysis (SCA) (13th), Application Security Posture Management (ASPM) (11th)
 

Mindshare comparison

As of January 2026, in the Software Supply Chain Security category, the mindshare of Qualys CyberSecurity Asset Management is 2.4%, up from 1.1% compared to the previous year. The mindshare of Xygeni is 0.8%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Software Supply Chain Security Market Share Distribution
ProductMarket Share (%)
Qualys CyberSecurity Asset Management2.4%
Xygeni0.8%
Other96.8%
Software Supply Chain Security
 

Featured Reviews

AN
Cyber Security Specialist at UBS Financial
Customized dashboards and quick deployment support comprehensive asset management
We use the True Risk Score for vulnerability prioritization, though we do not solely rely upon it since some assets may be decommissioned soon or not in use. From Qualys CyberSecurity Asset Management, we primarily focus on internet-facing assets. We have created separate tasks for internet-facing assets and track the True Risk dashboard specifically for these assets. If the True Risk Score is higher for any internet-facing assets, then we take action accordingly. The True Risk Score is very helpful for prioritization. The initial setup was straightforward and easy. We needed to create customized tags, group them twice, and validate whether the operating system detection was true positive or false positive. We encountered some false positives, which required coordination with the IT team for verification. In six months, we had approximately 20-25 machines that needed verification on a weekly basis. We coordinated with the IT team to identify the exact operating system specifications.
AI
Business development manager at RSsecurity
Unified monitoring has reduced alert noise and provides accurate, proactive application security
Xygeni was highly effective for us, but there are areas where improvements could be made. More customization options for dashboards and reports would help teams tailor the platform to their specific metrics and workflows. I also occasionally encounter DevOps tools that are not yet supported natively. Expanded coverage for niche or emerging tools would make onboarding even smoother. These points, however, are minor compared to the overall value the platform delivers, especially given the strength of its AI-driven detection, remediation, and supply chain protection capabilities. It would also be an improvement for licensing with regard to on-premise variants. Perhaps we could have an on-premise option for standard subscription.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Qualys CyberSecurity Asset Management provides accurate content that identifies all the endpoints, making it better in that way, and the review results for finding vulnerabilities and reporting also show that it identifies most of them, helping us complete tasks in 3.5 days instead of five."
"Our favorite features are the tagging and the ability to quickly find assets in the portal."
"The scanning results are pretty good, and some insights are quite valuable."
"Qualys CSAM is valuable for providing end-of-life and end-of-sale information. It gives me visibility into the number of products or hardware items that are end-of-life."
"Tags are very useful for us since we can tag virus applications in infrastructure types such as databases, operating systems, or web platforms."
"The scanning results are pretty good, and some of the insights are quite valuable."
"I would rate Qualys CSAM a ten out of ten."
"The comprehensive view that Qualys CyberSecurity Asset Management gives us on our assets enables us to go to a single screen and get a good idea of our holistic asset count."
"Xygeni provides a comprehensive and developer-friendly approach to securing the entire software supply chain."
"The visibility of our open-source supply chain dependencies and real-time detection of vulnerabilities have been invaluable."
"Since using Xygeni, the time to review vulnerabilities has decreased."
 

Cons

"Integration of Qualys CyberSecurity Asset Management, particularly with ServiceNow, takes a very long time, and it needs prioritization of patch rules based on vulnerability risk."
"In my opinion, the area that needs improvement is the role-based access control (RBAC). The access privilege management needs to be more robust and streamlined to enhance user access management. Additionally, improvements to the user interface could be beneficial."
"There can be further simplification to reduce the overall noise and provide ESAM-related data."
"Some areas that would be helpful are more comprehensive tagging and the ability to set up better dynamic rules."
"As of now, the support, results, and low false positives do not necessitate changes."
"Based on the company's budget, Qualys offers limited features, which can also be utilized in other environments."
"They should address the false positives generated in EASM. It is fetching assets that have Infosys as the keyword."
"The Qualys CAPS service requires further exploration and improvement, particularly in its handling of protocols and reactivity with MAC and IP addresses for CAP agents."
"There should be more configuration options that make it easier to target the issues that are more important in your organization's context."
"Xygeni could be improved if on-premise options were available starting from the starter packages, not only the enterprise models."
"Xygeni was highly effective for us, but there are areas where improvements could be made."
 

Pricing and Cost Advice

"The pricing is fair. I would love to see the price come down a little bit, but we do get a lot of value out of it. We are squeezing every ounce of value we can out of the tool."
"The pricing is market-competitive."
"The cost for Qualys CyberSecurity Asset Management is high."
"Qualys offers excellent value for money."
"Qualys is competitively priced for its features. Its pricing is suitable for large organizations with more than 4,000 assets, but for smaller organizations with few assets, such as banks, the costs might be high. They should come up with packages that are suitable for small organizations."
"The pricing for Qualys CSAM is nominal."
"It is cost-effective because, in a single tool, we are getting everything. All the solutions come in a single license or price."
"Qualys CyberSecurity Asset Management can be expensive, especially if we already have VMDR."
Information not available
report
Use our free recommendation engine to learn which Software Supply Chain Security solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Financial Services Firm
13%
Manufacturing Company
9%
Comms Service Provider
6%
Comms Service Provider
32%
Security Firm
17%
Retailer
15%
Outsourcing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise2
Large Enterprise23
No data available
 

Questions from the Community

What needs improvement with Qualys CyberSecurity Asset Management?
I think the one thing Qualys CyberSecurity Asset Management can do better is the package management and the updating process. Knowing that you can't update any of the packages until you've done the...
What is your primary use case for Qualys CyberSecurity Asset Management?
I primarily use it for a small, single-site, multi-source setup with multi-WAN inputs. I have a main fiber connection and a couple of failovers while managing different networks across different se...
What is your experience regarding pricing and costs for Xygeni?
The setup is very easy. I highly recommend Xygeni to any organization looking to bolster its SDLC security.
What needs improvement with Xygeni?
There should be more configuration options that make it easier to target the issues that are more important in your organization's context. There are different kinds of scanners, each of them targe...
What is your primary use case for Xygeni?
We use Xygeni to harden our CI/CD pipelines in Azure DevOps. Our software is mainly in Python, but we also use Javascript and Csharp. Xygeni detects issues on our open-source third-party dependenci...
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Information Not Available
BKool, Onum, Napptive, Fintonic, Adaion, Metricool, Arexdata, ...
Find out what your peers are saying about Qualys CyberSecurity Asset Management vs. Xygeni and other solutions. Updated: January 2026.
881,082 professionals have used our research since 2012.