Qualys VMDR vs The NodeZero Platform by Horizon3.ai comparison

Qualys VMDR vs. The NodeZero Platform by Horizon3.ai

Download the complete report

Helped 879,310 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Zafran Security

Mindshare comparison

As of December 2025, in the Vulnerability Management category, the mindshare of Zafran Security is 1.1%, up from 0.2% compared to the previous year. The mindshare of Qualys VMDR is 5.5%, down from 9.7% compared to the previous year. The mindshare of The NodeZero Platform by Horizon3.ai is 1.4%, up from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Vulnerability Management Market Share Distribution
Product	Market Share (%)
Qualys VMDR	5.5%
The NodeZero Platform by Horizon3.ai	1.4%
Zafran Security	1.1%
Other	92.0%

Vulnerability Management

Featured Reviews

Reviewer6233

Works at a healthcare company with 10,001+ employees

Has become an indispensable tool in our cybersecurity arsenal

While Zafran Security is already a powerful tool, there are areas where it could be further improved to provide even greater value. One key area for enhancement is the searching capabilities within its vulnerabilities module. By incorporating the ability to create Boolean searches, users would gain the ability to apply more complex filters and customize their search criteria. This would greatly enhance the precision and efficiency with which security teams can identify and prioritize vulnerabilities. Having such tailored search capabilities would save time and resources by narrowing down vast lists of vulnerabilities to those that meet specific parameters relevant to our unique risk environment. Additionally, integrating more robust reporting and visualization tools would be advantageous. Enhanced dashboards that offer customizable visual representations of risk configurations and threat landscapes would facilitate better communication with stakeholders, making it easier to explain vulnerabilities and the rationale behind certain security measures. This would also aid in demonstrating the improvements and value derived from existing security investments to leadership and non-technical team members.

Read full review

reviewer2753559

Cyber Security Solution Engineer at a computer software company with 201-500 employees

Reduces vulnerability exposure time and automates workflow for efficient security management

One area where Qualys VMDR can be improved is the missing feature for deploying agents for over 1,000 assets, as we need to do it manually. Qualys doesn't have its own tool to deploy the agents all at once, so we need to use third-party tools such as BigFix or something else to deploy the agents, which is my main concern and should be fixed by the Qualys team. That is the main thing I would like to see changed, and apart from that, everything is good.

Read full review

Shaun Hunt

Chief Information Officer at a construction company with 1,001-5,000 employees

Has unified our IT teams by providing clear visibility into network vulnerabilities and accelerated remediation with real-world attack testing

One of the things that we've shared with Horizon is just the reporting. They've made a lot of changes over time, but when examining computers, most average normal people don't look at a computer and identify it as 114.82.117.180. They identify it as 'the printer for accounting.' When many of the reports give the very detailed technical IP address or serial number, that's really not helpful for anyone other than the person, the hands-on person that's trying to remediate it. All the managers, all the leaders, having information in that format isn't helpful. Being able to have information about what those devices are would be very helpful. There's a technical reason they can't just have an easy button because some people have really complicated networks. When examining things for the average company, the average executive, that 114 number, there's only one of those. But if examining an AT&T or a Walmart, it isn't unique. They haven't solved that problem. But for the 90% of companies, being able to have just a human readable name for all devices on your network in all of the reports all of the time would be the most beneficial.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Zafran is an excellent tool."

"We saw benefits from Zafran Security almost immediately after deploying it."

"Overall, we have seen about eighty-seven percent reduction of the number of vulnerabilities that require urgency to remediate, specifically the number of criticals."

"We are able to see the real risk of a vulnerability on our environment with our security tools."

"Zafran has become an indispensable tool in our cybersecurity arsenal."

"With Zafran Security, it integrates with your security controls, allowing you to take that risk score and reduce it based on the controls in place or increase the risk based on different factors, such as if the issue is internet reachable or if there's an exploit in the wild."

"It's very configurable to adjust impact to systems."

"Qualys has a continuous endpoint monitoring feature for agent-based scanning. Once you deploy the solution, it monitors everything that is happening every 30 minutes. Then, if there are any vulnerabilities, they are reported."

"It's really beneficial for scanning and interacting with the agent."

"The most valuable feature is the QID part, especially of CentralList, which makes it easy to assess new critical vulnerabilities."

"They also have threat detection which maps threats. There is a feed that comes from Qualys when a new vulnerability is found. It tells us which machines are infected with that vulnerability."

"I find the solution's dashboard interesting...The response time is fine. You can pull up reports without dragging or consuming bandwidth."

"Qualys VMDR is easy to understand and provides detailed reports."

"The most valuable feature is automation."

More Qualys VMDR pros

"My favorite feature about The NodeZero Platform is that it's autonomous, and it truly delivers on that promise—it can be set and forgotten while it performs its tasks, and it does exactly what it claims to do."

"Penetration testing and scans are useful features."

"The NodeZero Platform's real attack capabilities help identify vulnerabilities on my on-premise systems by adding an element of validation and offensive security testing on top of known vulnerabilities. The feature that allows security teams to fix and retest vulnerabilities instantly is very useful, even though it may not happen literally 'instantly.' It's a necessary tool for any organization to understand whether vulnerabilities are genuinely exploitable by attackers. With its near-real-time testing capabilities, it's an essential part of any security portfolio."

"I rate the stability of the NodeZero Platform a ten out of ten."

"For us, The NodeZero Platform is literally the single best security solution we have because the way that it works is we're able to scan every part of our network, both internally and externally, and then get completely actionable feedback that doesn't matter if it's for an application developer or a network admin."

"Overall, I'd rate NodeZero at nine to 9.5 out of ten."

"The NodeZero Platform's real attack capabilities help in identifying vulnerabilities on our on-prem systems because it provides actual vulnerabilities by attacking our systems."

"The NodeZero Platform is amazing; what I love most about it is that it's automated and comparable to the manual pen testing we did with a third-party company, but with the added benefit of unlimited retesting to validate fixes."

More The NodeZero Platform by Horizon3.ai pros

Cons

"I think the ability to have some enhanced reporting capabilities is something they can improve on, as they have good reports but we have asked for some specific reporting enhancements."

"Initially, we were somewhat concerned about the scalability of Zafran due to our large asset count and the substantial amount of information we needed to process."

"The dashboarding and reporting functionality of Zafran Security is an area that definitely could use some improvements."

"Qualys VM could improve by having more skilled support personnel."

"From the application security perspective, Qualys has a way to go."

"It would be nice to have an all-in-one solution that was automated and could handle the scanning and reports as well as the patching and updating."

"The customer support is very bad."

"The reporting needs improvement. It should generate much more stuff like field reports."

"Reports were lacking somewhat on the customization side."

"Qualys VM's machine learning and artificial intelligence features could be improved."

"There are scenarios where a vulnerability is reported once yet not in subsequent scans, even if we have not fixed it."

More Qualys VMDR cons

"Sometimes even their support doesn't know why we're seeing certain issues."

"The only issue we’ve encountered is that sometimes the scans take a long time to complete."

"They've added a chatbot which isn't particularly useful, but when it can't answer questions, it forwards messages to human support."

"The speed of the scans takes some time, but in my opinion, it is not surprising for what it is doing."

"One of the areas where improvement is needed is in the visibility and reporting for large enterprises."

"The areas for improvement for The NodeZero Platform involve integration and automation. It would be beneficial if it could integrate directly with vulnerability management tools that would allow the platform to automatically import data, identify vulnerable systems, and test targets immediately, potentially even enabling automated feedback loops for rescanning since the process is currently manual."

"I think The NodeZero Platform could improve by leveraging GPUs for password cracking, which would be pretty good."

"I encountered challenges with patch management, as we struggled to test and implement patches due to time constraints. This led to our patch management process being ineffective."

More The NodeZero Platform by Horizon3.ai cons

Pricing and Cost Advice

Information not available

"Qualys VM is better suited for medium to large companies because the price can be too much for smaller customers."

"Qualys VM is quite expensive. It's a subscription-based license, and it's yearly. Right now, it's open for me, and I don't have any limitations or caps on the licenses. They are seeing if the product is viable for 4500 users. I can add as much as I want, and at the end of the subscription, they'll let me know how many licenses were actually used and bill me accordingly. On a scale from one to five, I would give their pricing a three. It's still expensive."

"There is a license for the use of this solution. We pay annually instead of monthly to receive a better discount on the price."

"Qualys is a pay-as-you-go model, so there's flexibility to the pricing."

"The product is more expensive than that of any other vendor."

"We do see over $100,000 in terms of price, for mid-size programs. You likely will pay more than $100,000 without any discount. It is a bit pricey."

"Qualys is cheaper and more affordable than other solutions."

"They have recently changed the pricing model, which is now better than it was before."

More Qualys VMDR pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.

See recommendations

879,310 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

11%

Computer Software Company

Manufacturing Company

Outsourcing Company

Financial Services Firm

16%

Computer Software Company

10%

Manufacturing Company

Government

Computer Software Company

10%

Manufacturing Company

Educational Organization

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	12
Large Enterprise	69

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	1
Large Enterprise	4

Questions from the Community

What is your experience regarding pricing and costs for Zafran Security?

Since we stood Zafran Security up in our private cloud, we handle the maintenance on our side. As we opted not to use...

What needs improvement with Zafran Security?

In terms of areas for improvement, Zafran Security is doing a really great job as a new and emerging company. Oftenti...

What is your primary use case for Zafran Security?

My use cases for Zafran Security revolve around two primary areas. One is around vulnerability management and priorit...

What do you like most about Qualys VMDR?

I like that we have many scanners and channels that don't overload. It helps us scan and track easily. Also, the tagg...

What is your experience regarding pricing and costs for Qualys VMDR?

My experience with pricing, setup cost, and licensing shows that we can consider both time and money saved.

What needs improvement with Qualys VMDR?

One area where Qualys VMDR can be improved is the missing feature for deploying agents for over 1,000 assets, as we n...

What do you like most about Horizon3.ai?

Penetration testing and scans are useful features.

What needs improvement with Horizon3.ai?

I think The NodeZero Platform could improve by leveraging GPUs for password cracking, which would be pretty good.

What is your primary use case for Horizon3.ai?

We use The NodeZero Platform for control validation and we are also looking for the likelihood of vulnerabilities.

Wiz Code vs Zafran Security

Comparisons

Compared 27% of the time

Vulcan Cyber vs Zafran Security

Compared 12% of the time

Tenable Vulnerability Management vs Zafran Security

Compared 9% of the time

Nucleus vs Zafran Security

Compared 7% of the time

Armis vs Zafran Security

Compared 5% of the time

More Zafran Security Competitors

Tenable Nessus vs Qualys VMDR

Compared 9% of the time

Rapid7 InsightVM vs Qualys VMDR

Compared 8% of the time

Microsoft Defender Vulnerability Management vs Qualys VMDR

Compared 6% of the time

Tenable Security Center vs Qualys VMDR

Compared 5% of the time

Wiz vs Qualys VMDR

Compared 5% of the time

More Qualys VMDR Competitors

Pentera vs The NodeZero Platform by Horizon3.ai

Compared 31% of the time

Tenable Security Center vs The NodeZero Platform by Horizon3.ai

Compared 9% of the time

Tenable Vulnerability Management vs The NodeZero Platform by Horizon3.ai

Compared 6% of the time

vPentest vs The NodeZero Platform by Horizon3.ai

Compared 6% of the time

Rapid7 Penetration Testing Services vs The NodeZero Platform by Horizon3.ai

Compared 3% of the time

More The NodeZero Platform by Horizon3.ai Competitors

Product Reports

Zafran Security

Download Zafran Security product report

Qualys VMDR

Download Qualys VMDR product report

The NodeZero Platform by Horizon3.ai

Download The NodeZero Platform by Horizon3.ai product report

The NodeZero Platform by Horizon3.ai report

Also Known As

No data available

Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security

Horizon3.ai

Overview

Zafran Security integrates with existing security tools to identify and mitigate vulnerabilities effectively, proving that most critical vulnerabilities are not exploitable, optimizing threat management.

Zafran Security introduces an innovative operating model for managing security threats and vulnerabilities. By leveraging the threat exposure management platform, it pinpoints and prioritizes exploitable vulnerabilities, reducing risk through immediate remediation. This platform enhances your hybrid cloud security by normalizing vulnerability signals and integrating specific IT context data, such as CVE runtime presence and internet asset reachability, into its analysis. No longer reliant on patch windows, Zafran Security allows you to manage risks actively.

What are the key features of Zafran Security?

Threat Exposure Management: Utilizes existing tools to prioritize vulnerabilities and manage threats.
Integrative Analysis: Combines security data with IT context for precise vulnerability management.
Real-time Risk Reduction: Enables immediate risk management without waiting for patches.
Hybrid Cloud Compatibility: Functions across diverse cloud environments for comprehensive security.

What benefits can users expect from Zafran Security?

Improved Security: Enhances protection by efficiently identifying and mitigating risks.
Cost Efficiency: Reduces unnecessary patching expenses by confirming non-exploitable vulnerabilities.
Time Savings: Frees developers to focus on root causes by handling immediate threats.
Comprehensive Insight: Offers a holistic view of security threats and vulnerabilities.

In industries where security is paramount, such as finance and healthcare, Zafran Security provides invaluable protection by ensuring that only exploitable vulnerabilities are addressed. It allows entities to maintain robust security measures while allocating resources efficiently, fitting seamlessly into existing security strategies.

Zafran Security

Vulnerability Management, Detection, and Response (VMDR) is a cornerstone product of the Qualys TruRisk Platform and a global leader in the enterprise-grade vulnerability management (VM) vendor space. With VMDR, enterprises are empowered with visibility and insight into cyber risk exposure - making it easy to prioritize vulnerabilities, assets, or groups of assets based on business risk. Security teams can take action to mitigate risk, helping the business measure their actual risk exposure over time.

Qualys VMDR offers an all-inclusive risk-based vulnerability management solution to prioritize vulnerabilities and assets based on risk and business criticality. VMDR seamlessly integrates with configuration management databases (CMDB), Qualys Patch Management, Custom Assessment and Remediation (CAR), Qualys TotalCloud and other Qualys and non-Qualys solutions to facilitate vulnerability detection and remediation across the entire enterprise.

With VMDR, users are empowered with actionable risk insights that translate vulnerabilities and exploits into optimized remediation actions based on business impact. Qualys customers can now aggregate and orchestrate data from the Qualys Threat Library, 25+ threat intelligence feeds, and third-party security and IT solutions, empowering organizations to measure, communicate, and eliminate risk across on-premises, hybrid, and cloud environments.

Qualys

NodeZero by Horizon3.ai is an offensive security platform that enables users to adopt an attacker’s perspective, reveal vulnerabilities, and verify defense effectiveness with evidence-backed insights.

NodeZero provides autonomous pentesting, showing how attackers exploit misconfigurations, credentials, and exposures into attack paths. It helps focus on real risks rather than hypothetical ones, integrating seamlessly into existing IT and security workflows to streamline processes. The platform drives risk-based vulnerability management and CTEM by validating vulnerabilities and measuring resilience.

What standout features improve your security?

Autonomous Pentesting at Scale: Executes extensive pentests across broad IT landscapes swiftly.
Hybrid Cloud Coverage: Navigates on-premises and cloud domains to find attack paths.
Proof of Exploitation: Offers evidence for every finding.
Fix Validation: Allows quick retesting to ensure vulnerabilities are resolved.
NodeZero Tripwires: Uses deception tokens for real adversary detection.

What benefits should you expect from reviews?

Reduced Vulnerability Noise: Prioritizes exploitable risks with ServiceNow integration.
Automated Workflows: MCP Server automates processes, reducing bottlenecks and enhancing efficiency.
Immediate Fix Validation: Ensures defenses work during attacks.
Real-Time Resilience Measurement: Helps schedule routine assessments without external help.

NodeZero assists in automated penetration testing and vulnerability management in industries like finance and healthcare. It enhances security processes by complementing or replacing existing solutions, enabling efficient testing, feedback, and control validation.

Horizon3.ai

Sample Customers

Information Not Available

Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx

Government agencies, Defense Industrial Base organizations, and enterprises in regulated industries such as finance, healthcare, manufacturing, and criticalinfrastructure rely on NodeZero to meet rigorous security and compliance requirements with continuous, scheduled, and on-demand testing.

Qualys VMDR vs. The NodeZero Platform by Horizon3.ai