No more typing reviews! Try our Samantha, our new voice AI agent.

Tenable.io Container Security vs Threat Stack Cloud Security Platform [EOL] comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Nov 16, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
54
Ranking in other categories
Vulnerability Management (5th), Container Security (8th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (6th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
Tenable.io Container Security
Average Rating
8.0
Reviews Sentiment
6.1
Number of Reviews
9
Ranking in other categories
Container Security (26th)
Threat Stack Cloud Security...
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
8
Ranking in other categories
No ranking in other categories
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
AS
Cyber Security Architect at a security firm with 201-500 employees
Detailed container image reports have improved vulnerability insight and support secure operations
Most valuable are the reports that are quite good, particularly the detailed ones for container image scanning. Tenable.io Container Security is giving me the vulnerability information of Docker images and the information about software bill of materials. However, my challenge at this time is that I am using all these solutions with GitLab Ultimate, and it does not support integration, so I am doing some alternate arrangements which are giving me operational complexity because I need to introduce something else instead of GitLab Ultimate. That is the primary concern regarding the benefits of real-time visibility into my containerized application security status.
SC
Software Development Manager at Rent Dynamics
SecOps program for us, as a smaller company, is amazing; they know what to look for
They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter. Even as part of the SecOps Program, that could be helpful; a quick analysis. They're analyzing our whole infrastructure and saying, "You have one VPC and that doesn't make a lot of sense, that should be multiple VPCs and here's why." The architecture of the servers in whatever cloud-hosting provider you're on could be helpful. Other than that, they should continue to expand on their notifications and on what's a vulnerability. They do a great job of that and we want them to continue to do that. It would be cool, since the agent is already deployed and they know about the server, they know the IP address, and they know what vulnerability is there, for them to test the vulnerability and see if they can actually exploit it. Or, once we patch it, they could double-check that it can't be. I don't know how hard that would be to build. Thinking on it off the top off my head, it could be a little challenging but it could also be highly interesting. It would also be great if we could test a couple of other features like hammering a server with 100 login attempts and see what happens. Real test scenarios could be really helpful. That is probably more something close to what they do with the SOC 2 audit or the report. But more visualization of that, being able to test things out on our infrastructure to make sure we can or can't hit this box could be interesting.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Generally, Qualys is very good at detections, whether on cloud or on-prem, and the agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us."
"One of the most valuable features of Qualys TotalCloud is FlexScan, which is specifically for internet-facing VMs. We found this feature to be very useful. It was a key differentiator for us."
"By integrating TotalCloud, we have significantly reduced vulnerabilities in our deployment pipeline."
"TruRisk Insights is the most important innovation they've released this year."
"Qualys TotalCloud fulfills all these needs."
"The dashboards are particularly valuable as they offer a comprehensive view of the environment, highlighting any misconfigurations."
"Its dashboards are brilliant. It provides in-depth insights."
"My experience with using TruRisk to mitigate noise from raw CVEs has been great."
"The strong security provided by the product in the container environment is its most valuable feature."
"Nessus scanner is very effective for internal penetration testing."
"By using Nessus, we are able to finish testing with assured results, in half the time."
"It helps us secure our applications from the build phase and identify the weaknesses from scratch."
"The tool's most valuable feature is scanning, reporting, and troubleshooting."
"Tenable.io detects misconfiguration when you deploy a Docker or Kubernetes container. It's much better to remedy these issues during deployment instead of waiting until the container is already in the production environment."
"It is a scalable solution. Scalability-wise, it is a good solution."
"The solution shows you the exploitable vulnerabilities and helps you prioritize."
"It has been quite helpful to have the daily alerts coming to my email, as well as the Sev 1 Alerts... We just went through a SOX audit and those were pivotal."
"The solution has a lot of different features that are quite useful."
"With Threat Stack, we quickly identified some AWS accounts which had services that would potentially be exposed and were able to remediate them prior to release of products."
"The capacity to respond to evidence requests from the SOX auditors has significantly improved because of this tool."
"We find the licensing and pricing very easy to understand and a good value for the services provided."
"Threat Stack has connectivity."
"There has been a measurable decrease in the meantime to remediation... because we have so many different tech verticals already collated in one place, our ability to respond is drastically different than it used to be."
"Finally, Threat Stack has cut down on the time needed to investigate potential attacks by about 75 percent."
 

Cons

"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."
"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"Some major banks and insurance companies require an on-premises solution for comprehensive vulnerability management, which TotalCloud does not offer."
"Qualys TotalCloud can be improved in the integration piece, especially with ServiceNow, where there's a bidirectional sync integrated, as there is no native capability from Qualys that can give monitoring metrics of how many assets came in and how many failed or were not properly reconciled or combined."
"In my opinion, what can be improved in Qualys TotalCloud includes pricing and container scanning."
"Two areas for improvement in Qualys TotalCloud are the speed of the public cloud platform and vulnerability detection."
"Overall, we are satisfied with it. However, the response part of the Cloud Detection and Response (CDR) module can be improved. It is not yet in place according to requirements; it is not completely available even though the module has been released."
"There is a lack of data segregation according to criticality or inventory."
"The support is tricky to reach, so we would like better-oriented technical support enabled."
"The solution’s pricing could be improved."
"The stability and setup phase of the product are areas with shortcomings where improvements are needed."
"Tenable.io Container Security should improve integration modules. It should also improve stability."
"I believe integration plays a crucial role for Tenable, particularly in terms of connecting with other products and various container solutions like Docker or Kubernetes. It seems that in future updates, enhanced integration is something I would appreciate. Currently, there is integration with Docker, but when it comes to Kubernetes or other container solutions, it appears to be a challenge, especially with on-prem scanners."
"I feel that in certain areas this product has false positives which the company should work on."
"I feel that in certain areas this product has false positives which the company should work on. They should also try to include business logic vulnerabilities in the scanner testing. Finally, the vulnerability assessment feature should be increased to other hardware devices, apart from firewalls."
"They need to work on auto-remediation so it's easier for the security team to act quickly when certain assets or resources are deployed. The latest version has a CIS benchmark that you need to meet for containers in the cloud, but more automation is needed."
"The user interface can be a little bit clunky at times... There's a lot of information that needs to be waded through, and the UI just isn't great."
"They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter."
"I would like further support of Windows endpoint agents or the introduction of support for Windows endpoint agents."
"The API - which has grown quite a bit, so we're still learning it and I can't say whether it still needs improvement - was an area that had been needing it."
"The reports aren't very good. We've automated the report generation via the API and replaced almost all the reports that they generate for us using API calls instead."
"The compliance and governance need improvement."
"The one thing that we know they're working on, but we don't have through the tool, is the application layer. As we move to a serverless environment, with AWS Fargate or direct Lambda, that's where Threat Stack does not have the capacity to provide feed. Those are areas that it's blind to now..."
"Some features do not work as expected."
 

Pricing and Cost Advice

"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"The cost is high, but it meets our organizational needs."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."
"TotalCloud's price is about right where I would expect it to be."
"I rate the tool's pricing a three out of ten."
"The product does not operate on a pay-per-license model."
"I rate the product’s pricing a six out of ten."
"The solution's pricing is neither cheap nor very expensive."
"It's best to be an institutional buyer and directly contact the sales team as they can provide over-the-top discounts for bulk orders."
"It is a cost-effective choice versus other solutions on the market."
"It is very expensive compared to some other products. The pricing is definitely high."
"I'm happy with the amount that we spend for the product that we get and the overall service that we get. It's not cheap, but I'm still happy with the spend."
"It came in cheaper than Trend Micro when we purchased it a few years ago."
"We find the licensing and pricing very easy to understand and a good value for the services provided."
"Pricing seems to be in line with the market structure. It's fine."
"What we're paying now is somewhere around $15 to $20 per agent per month, if I recall correctly. The other cost we have is SecOps."
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
11%
Manufacturing Company
11%
Financial Services Firm
10%
Financial Services Firm
14%
Outsourcing Company
8%
Manufacturing Company
6%
Media Company
6%
Outsourcing Company
16%
Construction Company
10%
Manufacturing Company
9%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise11
Large Enterprise38
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise3
Large Enterprise4
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise5
Large Enterprise2
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
We purchased Qualys TotalCloud for GCP and Azure as well. It is comparatively better than others regarding pricing. T...
What needs improvement with Qualys TotalCloud?
I am unsure about how Qualys TotalCloud can be improved. I do not have anything else to add about the needed improvem...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is telemetry, although I am unsure about the specifics. A quick specific examp...
What needs improvement with Tenable.io Container Security?
Several things need improvement about Tenable.io Container Security. First, they should support GitLab Ultimate. Seco...
What is your primary use case for Tenable.io Container Security?
I have been dealing with Tenable.io Container Security for almost four to six months.
What advice do you have for others considering Tenable.io Container Security?
Tenable.io Container Security is a good product. I am currently using Tenable Enclave Security. When I say metrics, I...
Ask a question
Earn 20 points
 

Also Known As

Qualys TotalCloud with FlexScan
Tenable FlawCheck, FlawCheck
Threat Stack, CSP,
 

Overview

 

Sample Customers

Information Not Available
ServiceMaster
StatusPage.io, Walkbase, Spanning, DNAnexus, Jobcase, Nextcapital, Smartling, Veracode, 6sense
Find out what your peers are saying about Wiz, SentinelOne, Palo Alto Networks and others in Container Security. Updated: October 2026.
920,929 professionals have used our research since 2012.