# Finding vulnerabilities is the easy part. The question is which twenty matter, and who fixes them.

*Vulnerability Management — a TechBag decision guide. Last reviewed 2026-10-03.*

> Every tool here will hand you thousands of findings on day one. The purchase is the model that ranks them by real risk, and the capacity — yours or the tool’s — to close the ones at the top.

**The checkable fact:** Tenable Nessus Professional is $4,790 a year per scanner, unlimited IPs. Qualys VMDR is reported at ~$199–250 per asset a year — and sells its own patch module. Same findings; opposite answers to “who fixes it”.

- Canonical: https://www.thetechbag.com/browse/security/vulnerability-management
- Category: [Security](https://www.thetechbag.com/browse/security)
- Products compared: 23

## What vulnerability management actually is

A continuous inventory of what you run and what is wrong with it: missing patches, misconfigurations, exposed services, weak ciphers — on hosts, web applications, cloud accounts, containers and industrial controllers. A scanner (or an agent) finds them; a scoring model ranks them; a report or a ticket hands them to whoever fixes things. That last hand-off is where most programmes fail.

The field has split three ways. **Scanners** (Nessus, Tenable VM, Qualys VMDR, WAS) find and rank. **Exposure platforms** (Tenable One, Qualys TruRisk, Trend CREM, Falcon Exposure) aggregate several sources into one risk view with attack-path context. **Remediation tools** (Action1, Qualys Patch Management) actually apply the fix — and a **service** (Mitigata VAPT, Sophos Managed Risk) does the work with people. Knowing which of the three your gap is saves the purchase.

**The most common mis-purchase.** Raw CVSS is useless at volume — half of everything is “high”. The **prioritisation model** (exploit activity, threat intelligence, asset criticality, compensating controls) is what separates a list from a plan. Ask every vendor how many of your 20,000 findings their model calls urgent, and why.

## Scanning vs exposure management vs pentest vs BAS

Four terms this buyer confuses, and nothing more. They are widening or adjacent scopes — not tiers. Each costs more and needs more people than the one before, and none replaces the others.

### Vulnerability scanning

Automated, continuous, broad: find known weaknesses on everything you can reach or install an agent on, rank them, report. The foundation — and the source of the thousands of findings nobody actions. Nessus, Tenable VM, Qualys VMDR, WAS, Falcon Exposure.

### Exposure management

Scanning's findings plus cloud posture, identity, OT and external attack surface, aggregated into one risk view with attack paths. Wider scope, enterprise price, and it still does not fix anything — it tells you what to fix first. Tenable One, Qualys TruRisk, Trend CREM.

### Penetration testing (VAPT)

Humans, point-in-time, goal-directed: can an attacker actually get in through this application or network, chaining what a scanner only lists. Required by many Indian regulators as an empanelled report. Mitigata VAPT; not a replacement for continuous scanning.

### Breach & attack simulation (BAS)

Automated adversary techniques run continuously against your controls to see what your EDR, mail filter and SIEM actually catch. Adjacent: it tests detection, not exposure. No BAS product is on this page — it belongs beside the SOC.

**These are adjacent and widening scopes, not a ladder.** Scanning finds; exposure management ranks across surfaces; a pentest proves; BAS tests the defenders. Each costs more and needs more people to act on than the last — and the cheapest purchase of all is remediation capacity for the findings you already have.

## The decision variables

Six variables decide this purchase. The instrument tests coverage, prioritisation model, agent vs agentless, remediation, the CERT-In line and published pricing; compliance reporting and scale are prose because the honest answer depends on your regulator and your estate.

**Scanning coverage.** Network and hosts, web apps and APIs, cloud accounts and containers, OT — each vendor covers some natively and sells the rest as separate SKUs. The chips name which.

**Prioritisation model.** The real differentiator: TruRisk, VPR, ExPRT.AI, Trend's risk index, an expert's judgement — or raw CVSS. Ask how many of your findings each model calls urgent, and why.

**Agent-based vs agentless vs both.** Agents see roaming laptops and need no scan window; scanners see unmanaged devices and need credentials; both is the usual honest answer for a mixed estate.

**Does it remediate or only report.** Where Action1 and Qualys differ fundamentally from Tenable, CrowdStrike and Trend: the fix on the same agent, or a ticket to your patch tool.

**Compliance reporting for RBI, SEBI CSCRF, ISO.** Tool reports satisfy many audits; some Indian regulators name an empanelled VAPT — Mitigata's line. Read the circular before the datasheet.

**Scale behaviour.** Per-asset pricing, scan windows, agent fleets and the size of the list nobody actions — the thresholds are in the scale section, the vendor-specific ones are delivery-team experience.

## The 23 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Rapid7 InsightVM — Rapid7

- **Who it's for:** Hybrid estates that want prioritisation grounded in real exploitation evidence rather than raw CVSS, and — the part most vulnerability tools do badly — a way to turn findings into assigned work with deadlines. Shares one agent with Rapid7’s SIEM, so a detection can be read alongside the vulnerability posture of the same host.
- **The honest limitation:** HYBRID, NOT SaaS — you must host a Security Console with a PostgreSQL database, and the sizing is heavy (12 cores / 64 GB / 2 TB at 20,000 assets). Reviewers report console memory exhaustion during parallel scans and scheduled scans taking 20 hours where a manual run takes 3–4. The agent does LOCAL checks only — no remote or unauthenticated network checks — so an agent-only rollout silently misses exposed services and TLS misconfigurations. Real Risk scoring was retired 21 Jan 2026 and historical scores cannot be recalculated.
- **Price:** ~$1.62 (≈ ₹1,577) — per asset / MONTH published from 500 assets (~$19/asset/year) — one of the few published prices in this category. Active Risk scores 0–1000 weighted by real exploitation evidence from CISA KEV, Metasploit and Rapid7’s own honeypot network; Remediation Projects and SLA goals assign findings as deadlined work
- **Details:** https://www.thetechbag.com/rapid7/rapid7-insightvm

### Rapid7 InsightAppSec — Rapid7

- **Who it's for:** Teams needing dynamic testing of internet-facing web applications and APIs, and Indian buyers mapping to SEBI CSCRF’s per-release VAPT expectation — per-application pricing lines up neatly with a per-application testing obligation.
- **The honest limitation:** DAST only — it tests running applications from the outside, so it finds nothing in source code and does not replace SAST or dependency scanning. Priced per application, so a large portfolio adds up quickly. And it inherits Rapid7’s platform constraint: no India data region.
- **Price:** $175 (≈ ₹1,74,300) — per APPLICATION / month published (~$2,100/app/year) — rare transparency in DAST, and it makes it easy to start with just the handful of applications that genuinely face the internet. Crawls running web apps and APIs and attacks them as an external tester would, covering the OWASP Top 10 with attack replay so a developer can reproduce a finding
- **Details:** https://www.thetechbag.com/rapid7/rapid7-insightappsec

### Qualys VMDR — Qualys

- **Who it's for:** Estates that want discovery, scanning, TruRisk prioritisation and remediation on one agent — the 'find it and fix it' tenant, with a Pune-engineered India platform.
- **The honest limitation:** No published list (reported per-asset ranges); full Patch Management, web-app scanning (WAS) and cloud (TotalCloud) are separate SKUs; the per-asset price looks high until volume discounts bite.
- **Price:** ~$199–250 (≈ ₹16,517) — per asset / year reported (volume discounts from ~1,000 assets); Cloud Agents + scanners; TruRisk scoring; limited free patch licence, full patching licensed separately; India platform
- **Details:** https://www.thetechbag.com/qualys/qualys-vmdr

### Qualys TruRisk Eliminate / Enterprise TruRisk Management — Qualys

- **Who it's for:** Qualys estates that want one risk number per business unit and mitigation options when patching is impossible.
- **The honest limitation:** A layer over Qualys telemetry — it aggregates what you already license; quote-only.
- **Price:** Quote — platform layer over Qualys data — risk aggregation across VM, WAS, TotalCloud; mitigations (isolate, disable) where a patch is not available
- **Details:** https://www.thetechbag.com/qualys/qualys-trurisk

### Qualys Web Application Scanning — Qualys

- **Who it's for:** Teams scanning web apps and APIs at scale from the same Qualys tenant as the host VM.
- **The honest limitation:** Web and API only; reports, does not fix; quote-only.
- **Price:** Quote — per web application / API; DAST with PCI-ready reporting
- **Details:** https://www.thetechbag.com/qualys/qualys-web-app-scanning

### Qualys Patch Management — Qualys

- **Who it's for:** Qualys estates closing the loop from finding to patch on the same agent.
- **The honest limitation:** Remediation, not discovery — it needs VMDR's findings; quote-only.
- **Price:** Quote — per asset / year; OS and third-party patching through the Qualys Cloud Agent, driven by VMDR findings
- **Details:** https://www.thetechbag.com/qualys/qualys-patch-management

### Tenable Vulnerability Management — Tenable

- **Who it's for:** The published-price cloud VM platform — Nessus breadth, VPR prioritisation, and a clean path to Tenable One later.
- **The honest limitation:** Reports and integrates; it does not patch. Web-app and cloud scanning are separate SKUs; Tenable lists an India site (in01, AWS Mumbai) in its site-region docs.
- **Price:** $28–45 (≈ ₹2,324) — per asset / year (from $3,700 / year for 100 assets); Nessus scanners + agents; VPR prioritisation
- **Details:** https://www.thetechbag.com/tenable/tenable-vulnerability-management

### Tenable Nessus Professional — Tenable

- **Who it's for:** Consultants, auditors and small teams that want the reference scanner with no per-asset meter.
- **The honest limitation:** A single scanner with no central management, no agents and no remediation — the enterprise tier is Tenable VM / Security Center; basic web scanning only.
- **Price:** $4,790 (≈ ₹3,97,570) — per scanner / year, unlimited IPs (2-year ≈ $4,665 / yr, 3-year ≈ $4,546 / yr); 24/7 support +$400; software you run
- **Details:** https://www.thetechbag.com/tenable/tenable-nessus

### Tenable One (Exposure Management) — Tenable

- **Who it's for:** Enterprises that want one exposure view across hosts, web apps, cloud, identity and OT with attack-path context.
- **The honest limitation:** Enterprise-priced and quote-only; reports and prioritises, does not remediate; you are buying several Tenable products at once.
- **Price:** Quote — platform licence (typically from ~$50k / year reported); VM + web + cloud + identity + OT + attack-path analysis
- **Details:** https://www.thetechbag.com/tenable/tenable-one

### Tenable OT Security — Tenable

- **Who it's for:** Plants and utilities that need vulnerability and asset visibility on PLCs and industrial networks without agents.
- **The honest limitation:** OT only — pair it with IT VM; quote-only; on-prem appliances you run.
- **Price:** Quote — per OT site / asset; passive monitoring plus active querying of industrial controllers; on-prem
- **Details:** https://www.thetechbag.com/tenable/tenable-ot-security

### CrowdStrike Falcon Exposure Management — CrowdStrike

- **Who it's for:** Falcon estates that want host vulnerabilities from the sensor they already run, prioritised by exploit intelligence, with no scan window.
- **The honest limitation:** Host coverage is wherever the Falcon sensor is — no network scanner, no web DAST; cloud posture is Falcon Cloud Security; it does not patch; quote-only.
- **Price:** Quote — module on the Falcon sensor (Spotlight + external attack surface); ExPRT.AI prioritisation; quote-only
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-exposure-management

### Trend Vision One Cyber Risk Exposure Management (ASRM) — Trend Micro

- **Who it's for:** Trend Vision One estates that want a risk index across endpoint sensors, cloud accounts and external attack surface in the same console as XDR.
- **The honest limitation:** Credit-priced — opaque until you run it; depth depends on Trend sensors being present; web-app and OT coverage not documented; does not patch.
- **Price:** Credits — Vision One credits — 20 credits per assessed desktop / server (Core), 8,000 per connected cloud account; risk index across endpoints, cloud accounts and external surface
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-attack-surface-risk-management

### Action1 Vulnerability Remediation — Action1

- **Who it's for:** Teams whose gap is remediation capacity, not discovery — it finds and fixes on the endpoint, free until the 201st.
- **The honest limitation:** Endpoints only — no network, web, cloud or OT scanning; prioritisation is severity-led rather than documented threat-intel risk scoring; unverified above 10,000 endpoints.
- **Price:** $4 (≈ ₹332) — per endpoint / month beyond 200 (annual) + support; Windows / macOS / Linux endpoints; assess and patch from one agent
- **Details:** https://www.thetechbag.com/action1/action1-vulnerability-remediation

### Mitigata VAPT — Mitigata

- **Who it's for:** India-regulated organisations that need a manual VAPT report for RBI, SEBI CSCRF, IRDAI or ISO audits — web, API, network, cloud and mobile — from an Indian provider.
- **The honest limitation:** A service, not a platform: findings and a re-test, you fix; priced per application rather than per asset; depends on Mitigata's team, not your console.
- **Price:** ₹52,000+ — per application (≈ $626), tiered; automated scanning + manual review + configuration analysis; Mitigata is not on CERT-In’s empanelled list, so confirm who signs the report
- **Details:** https://www.thetechbag.com/mitigata/mitigata-vapt

### Sophos Managed Risk (powered by Tenable) — Sophos

- **Who it's for:** Sophos Central estates that want Tenable scanning run and prioritised by Sophos's team, beside their MDR.
- **The honest limitation:** A managed service that advises — remediation is yours; quote-only; strongest inside a Sophos estate.
- **Price:** Quote — subscription per user and server; external attack surface plus internal (IASM by Tenable, July 2025) with Sophos analysts; Sophos Central
- **Details:** https://www.thetechbag.com/sophos/sophos-managed-risk

### Dynatrace Application Security — Dynatrace

- **Who it's for:** Teams already running Dynatrace who have a scanner backlog too long to fix in order, and want the few findings that are loaded and exposed ranked first.
- **The honest limitation:** It sees only where the Dynatrace agent runs — pre-deployment code and network exposure are other tools’ jobs, so it ranks scanner findings rather than replacing scanners. No Gartner Magic Quadrant placement. The Mumbai region is documented; the storage commitment is a contract question.
- **Price:** $13 — per 8 GiB host / month published for runtime vulnerability analytics (runtime application protection the same; posture management $5 per host) — ranks flaws by whether the vulnerable code is actually loaded, reachable and exposed in production, using the agent already monitoring the app
- **Details:** https://www.thetechbag.com/dynatrace/dynatrace-application-security

### vPenTest (Vonahi, a Kaseya company) — Kaseya

- **Who it's for:** MSPs and IT teams that want an automated internal and external network penetration test — exploitation, privilege escalation and lateral movement — every month instead of once a year.
- **The honest limitation:** Automated pentesting, not a vulnerability scanner or a regulator-accepted VAPT report: Vonahi is not CERT-In empanelled, so Indian compliance still needs an empanelled tester; no India hosting region.
- **Price:** Quote — licensed by internal and external IP, quote-only; runs monthly or on demand from an Ubuntu agent; reports within 48 hours, kept 90 days; hosted in the US, Germany or Australia
- **Details:** https://www.thetechbag.com/kaseya/vpentest

### Iru Vulnerability Management — Iru

- **Who it's for:** Iru-managed Mac and Windows fleets that want third-party application CVEs found and patched from the same agent, without a separate scanner.
- **The honest limitation:** Third-party application CVEs on managed Macs and Windows PCs only: no network, web, cloud or OT scanning, and one-click remediation only for apps in the Auto Apps catalogue.
- **Price:** Quote — per device by platform, quote-only; Mac and Windows application inventory every 15 minutes, matched to NVD CVEs hourly, scored by CVSS and CISA KEV, and fixed through Auto Apps
- **Details:** https://www.thetechbag.com/iru/iru-vulnerability-management

### Arctic Wolf Aurora Vulnerability Management (+ Resolve) — Arctic Wolf

- **Who it's for:** Arctic Wolf MDR customers who want vulnerability findings, asset inventory and patching in the same platform and Concierge review as their detections.
- **The honest limitation:** Strongest inside the Arctic Wolf estate: bought alone it competes with dedicated scanners (Tenable, Qualys, Rapid7) without their published pricing. Patching needs the Resolve add-on, and data is stored outside India.
- **Price:** Quote — quote-only; internal and external scanning, threat-based prioritisation, ITSM integration and AI remediation guidance; Resolve (automated patching) is a paid add-on; included in the Security Operations Plus and Total bundles
- **Details:** https://www.thetechbag.com/arcticwolf/arcticwolf-aurora-vulnerability-management

### Arctic Wolf Aurora Attack Surface Management — Arctic Wolf

- **Who it's for:** Teams whose asset inventory disagrees with their EDR, CMDB and scanner consoles, and who want the gaps (unmanaged, unagented, unscanned assets) found and ranked.
- **The honest limitation:** An aggregation and prioritisation layer, not a scanner: it depends on the tools it reads. Its Gartner Visionary placement (Exposure Assessment Platforms 2025) was Sevco’s, before the acquisition, and it launched under the Aurora name only in May 2026.
- **Price:** Quote — quote-only; built on the Sevco Security acquisition (2026): aggregates and de-duplicates assets from your existing tools to find security-control coverage gaps
- **Details:** https://www.thetechbag.com/arcticwolf/arcticwolf-aurora-attack-surface-management

### Aquila I Attack Surface Monitoring — Aquila I

- **Who it's for:** Indian teams that need an outside-in inventory of everything they expose to the internet, from an Indian vendor whose BAS and CART products can then test what it finds.
- **The honest limitation:** External discovery, not an authenticated scanner for internal hosts. Aquila I publishes no customers, pricing or hosting region, and is not CERT-In empanelled, so it does not stand in for an empanelled audit.
- **Price:** Quote — quote-only; continuous outside-in discovery and monitoring of your internet-facing assets (shadow IT, exposed ports, forgotten subdomains, expiring certificates), feeding Aquila I’s CTEM programme and its continuous automated red teaming (CART)
- **Details:** https://www.thetechbag.com/aquilai/aquilai-attack-surface-monitoring

### Omnissa Workspace ONE Vulnerability Defense — Omnissa

- **Who it's for:** Windows estates already running Workspace ONE UEM and the CrowdStrike Falcon sensor that want CVEs ranked by exploit likelihood and fixed from the console IT already patches from, inside existing maintenance windows.
- **The honest limitation:** Two licences from two vendors (Omnissa does not resell CrowdStrike), Windows desktops and servers only, known CVEs only: no macOS, Linux, mobile, network, web, cloud or configuration scanning. It is a remediation layer, not a scanner.
- **Price:** $3 (≈ ₹249) — per device / month list, an add-on to Workspace ONE UEM (included in Workspace ONE Platinum), plus CrowdStrike Falcon Exposure Management licensed directly from CrowdStrike; Windows desktops and Windows Server; findings ranked by ExPRT.AI and patched from the UEM console, with 10,000+ prepackaged app updates
- **Details:** https://www.thetechbag.com/omnissa/omnissa-workspace-one-vulnerability-defense

### Fortra Vulnerability Management (Fortra VM) — Fortra

- **Who it's for:** Mid-size teams without a dedicated vulnerability analyst who want scans run, analysed and reported for them (VM Pro and its Personal Security Analyst), and regulated Indian buyers who need the same scanner on-premises so scan data stays in their own data centre.
- **The honest limitation:** Reports and ranks, does not patch. SaaS is hosted in the US, UK, Japan, Switzerland and Sweden only, so India residency means the on-prem edition. Fortra’s docs list its ServiceNow integrations as temporarily unavailable since May 2025; no AWS, Azure or GCP account connectors are documented; agents are a paid add-on; no published price; not in Gartner’s Exposure Assessment Platforms Magic Quadrant (Nov 2025).
- **Price:** Quote — quote-only, tiered by the number of active devices; an RNA virtual appliance scans internal segments and Fortra’s own scanners test public IPs; Threat Rank and Active Risk prioritisation; Web Application Scanning, Active Threat Sweep, Agent Scans and Container Scanning are separate annual subscriptions; SaaS or on-premises
- **Details:** https://www.thetechbag.com/fortra/fortra-vulnerability-management

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**Must remediate, not only report.** Rules out Rapid7 InsightAppSec, Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM) and Fortra Vulnerability Management (Fortra VM) — reports and prioritises; remediation is your patch tool; Mitigata VAPT, Sophos Managed Risk (powered by Tenable), vPenTest (Vonahi, a Kaseya company), Arctic Wolf Aurora Attack Surface Management and Aquila I Attack Surface Monitoring — advisory: findings and a re-test, you fix. That leaves Rapid7 InsightVM, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Patch Management, Action1 Vulnerability Remediation, Dynatrace Application Security, Iru Vulnerability Management, Arctic Wolf Aurora Vulnerability Management (+ Resolve) and Omnissa Workspace ONE Vulnerability Defense.

**Web applications and APIs.** Rules out Rapid7 InsightVM, Qualys VMDR, Tenable Vulnerability Management and Fortra Vulnerability Management (Fortra VM) — web-app scanning is a separate SKU from this vendor; Qualys Patch Management, Tenable OT Security, CrowdStrike Falcon Exposure Management, Action1 Vulnerability Remediation, Dynatrace Application Security, Iru Vulnerability Management, Arctic Wolf Aurora Attack Surface Management and Omnissa Workspace ONE Vulnerability Defense — no web-application scanning. That leaves Rapid7 InsightAppSec, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Nessus Professional, Tenable One (Exposure Management), Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT, Sophos Managed Risk (powered by Tenable), vPenTest (Vonahi, a Kaseya company), Arctic Wolf Aurora Vulnerability Management (+ Resolve) and Aquila I Attack Surface Monitoring. It flags Qualys TruRisk Eliminate / Enterprise TruRisk Management — Web-app coverage not documented, Tenable Nessus Professional — Basic web checks only, Trend Vision One Cyber Risk Exposure Management (ASRM) — Web-app coverage not documented, Sophos Managed Risk (powered by Tenable) — Web-app coverage not documented, vPenTest (Vonahi, a Kaseya company) — Web-app coverage not documented, Arctic Wolf Aurora Vulnerability Management (+ Resolve) — Web-app coverage not documented and Aquila I Attack Surface Monitoring — Web-app coverage not documented — marked, not removed.

**Cloud accounts and containers.** Rules out Rapid7 InsightVM, Qualys VMDR, Tenable Vulnerability Management, CrowdStrike Falcon Exposure Management and Arctic Wolf Aurora Vulnerability Management (+ Resolve) — cloud posture is a separate SKU from this vendor; Qualys Web Application Scanning, Qualys Patch Management, Tenable Nessus Professional, Tenable OT Security, Action1 Vulnerability Remediation, Iru Vulnerability Management and Omnissa Workspace ONE Vulnerability Defense — no cloud-account coverage. That leaves Rapid7 InsightAppSec, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Tenable One (Exposure Management), Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, vPenTest (Vonahi, a Kaseya company), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring and Fortra Vulnerability Management (Fortra VM). It flags Rapid7 InsightAppSec — Cloud coverage not documented, Qualys TruRisk Eliminate / Enterprise TruRisk Management — Cloud coverage not documented, Sophos Managed Risk (powered by Tenable) — Cloud coverage not documented, vPenTest (Vonahi, a Kaseya company) — Cloud coverage not documented, Arctic Wolf Aurora Attack Surface Management — Cloud coverage not documented, Aquila I Attack Surface Monitoring — Cloud coverage not documented and Fortra Vulnerability Management (Fortra VM) — Cloud coverage not documented — marked, not removed.

**OT and industrial networks.** Rules out Rapid7 InsightAppSec, Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable Nessus Professional, CrowdStrike Falcon Exposure Management, Action1 Vulnerability Remediation, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, Iru Vulnerability Management and Omnissa Workspace ONE Vulnerability Defense — no OT / ICS coverage. That leaves Rapid7 InsightVM, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Tenable One (Exposure Management), Tenable OT Security, Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT, vPenTest (Vonahi, a Kaseya company), Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring and Fortra Vulnerability Management (Fortra VM). It flags Rapid7 InsightVM — OT coverage not documented, Qualys VMDR — OT coverage not documented, Qualys TruRisk Eliminate / Enterprise TruRisk Management — OT coverage not documented, Trend Vision One Cyber Risk Exposure Management (ASRM) — OT coverage not documented, Mitigata VAPT — OT coverage not documented, vPenTest (Vonahi, a Kaseya company) — OT coverage not documented, Arctic Wolf Aurora Vulnerability Management (+ Resolve) — OT coverage not documented, Arctic Wolf Aurora Attack Surface Management — OT coverage not documented, Aquila I Attack Surface Monitoring — OT coverage not documented and Fortra Vulnerability Management (Fortra VM) — OT coverage not documented — marked, not removed.

**Risk-based prioritisation.** Rules out Rapid7 InsightAppSec, Action1 Vulnerability Remediation, vPenTest (Vonahi, a Kaseya company) and Iru Vulnerability Management — severity-led; documented threat-intel risk scoring absent; Qualys Patch Management — a remediation tool, not a prioritiser. That leaves Rapid7 InsightVM, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring, Omnissa Workspace ONE Vulnerability Defense and Fortra Vulnerability Management (Fortra VM).

**Agentless only.** Rules out Qualys Patch Management, CrowdStrike Falcon Exposure Management, Action1 Vulnerability Remediation, Dynatrace Application Security, vPenTest (Vonahi, a Kaseya company), Iru Vulnerability Management and Omnissa Workspace ONE Vulnerability Defense — agent-based only. That leaves Rapid7 InsightVM, Rapid7 InsightAppSec, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT, Sophos Managed Risk (powered by Tenable), Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring and Fortra Vulnerability Management (Fortra VM). It flags Rapid7 InsightVM — Agent and agentless, Qualys VMDR — Agent and agentless, Qualys TruRisk Eliminate / Enterprise TruRisk Management — Agent and agentless, Tenable Vulnerability Management — Agent and agentless, Tenable One (Exposure Management) — Agent and agentless, Trend Vision One Cyber Risk Exposure Management (ASRM) — Agent and agentless, Sophos Managed Risk (powered by Tenable) — Agent and agentless, Arctic Wolf Aurora Vulnerability Management (+ Resolve) — Agent and agentless and Fortra Vulnerability Management (Fortra VM) — Agent and agentless — marked, not removed.

**Agents for roaming endpoints.** Rules out Rapid7 InsightAppSec, Qualys Web Application Scanning, Tenable Nessus Professional, Tenable OT Security, Mitigata VAPT, Arctic Wolf Aurora Attack Surface Management and Aquila I Attack Surface Monitoring — no agent; scanners or a service only. That leaves Rapid7 InsightVM, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Patch Management, Tenable Vulnerability Management, Tenable One (Exposure Management), CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, vPenTest (Vonahi, a Kaseya company), Iru Vulnerability Management, Arctic Wolf Aurora Vulnerability Management (+ Resolve), Omnissa Workspace ONE Vulnerability Defense and Fortra Vulnerability Management (Fortra VM).

**A manual VAPT report.** Rules out Rapid7 InsightVM, Rapid7 InsightAppSec, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, vPenTest (Vonahi, a Kaseya company), Iru Vulnerability Management, Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring, Omnissa Workspace ONE Vulnerability Defense and Fortra Vulnerability Management (Fortra VM) — not a manual VAPT report service. That leaves Mitigata VAPT.

**Vendor-published list price.** Rules out Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Sophos Managed Risk (powered by Tenable), vPenTest (Vonahi, a Kaseya company), Iru Vulnerability Management, Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring and Fortra Vulnerability Management (Fortra VM) — quote-only (reported ranges or credits). That leaves Rapid7 InsightVM, Rapid7 InsightAppSec, Tenable Vulnerability Management, Tenable Nessus Professional, Action1 Vulnerability Remediation, Mitigata VAPT, Dynatrace Application Security and Omnissa Workspace ONE Vulnerability Defense.

**Above 10,000 assets.** Rules out Tenable Nessus Professional — a single-scanner product; enterprise management is Tenable VM / Security Center. That leaves Rapid7 InsightVM, Rapid7 InsightAppSec, Qualys VMDR, Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation, Mitigata VAPT, Sophos Managed Risk (powered by Tenable), Dynatrace Application Security, vPenTest (Vonahi, a Kaseya company), Iru Vulnerability Management, Arctic Wolf Aurora Vulnerability Management (+ Resolve), Arctic Wolf Aurora Attack Surface Management, Aquila I Attack Surface Monitoring, Omnissa Workspace ONE Vulnerability Defense and Fortra Vulnerability Management (Fortra VM). It flags Action1 Vulnerability Remediation — Unverified above 10,000 and Mitigata VAPT — A service, priced per application — marked, not removed.

**Compliance reporting for RBI, SEBI CSCRF and ISO.** Every scanner here ships compliance templates (PCI, ISO, CIS); what the Indian regulator often wants is the empanelled auditor's report, which is Mitigata's line. Qualys and Tenable reports satisfy many ISO and internal audits; whether your regulator accepts a tool report or requires an empanelled VAPT is a question for the circular, not the datasheet.

**India data residency.** Documented: Qualys (India platform), Tenable (in01 site, AWS Mumbai), Mitigata (India). CrowdStrike (announced in-country cloud, January 2026), Trend, Action1, Sophos and Iru do not document an India region for vulnerability data — flagged, not ruled out.

**Scale behaviour.** Qualys, Tenable VM / One, CrowdStrike and Trend document estates well above 10,000 assets; Nessus Professional is a single scanner by design; Action1 is unverified above 10,000 endpoints; Mitigata is priced per application. Where a specific console strains for your estate is delivery-team experience: [TechBag to confirm].

## Eight situations, eight shortlists — starting from who fixes things

Every shortlist asks first whether your gap is discovery, prioritisation or remediation capacity. The vendor comes after.

### You have thousands of findings and nobody patches them

**Shortlist:** Action1 Vulnerability Remediation, Qualys VMDR, Qualys Patch Management

**Why:** The gap is remediation capacity, not discovery: Action1 finds and patches endpoints from one agent (free to 200); Qualys VMDR carries a limited patch licence on the Cloud Agent; Qualys Patch Management, licensed separately, closes the loop.

**Trade-off:** Action1 is endpoints only and severity-led; Qualys is per-asset priced with separate SKUs for web and cloud. Buying another scanner would not have helped.

### RBI / SEBI CSCRF / IRDAI audit — the regulator wants an empanelled report

**Shortlist:** Mitigata VAPT, Qualys VMDR, Tenable Vulnerability Management

**Why:** The regulator names a CERT-In-empanelled auditor — check CERT-In’s list (Mitigata sells VAPT but is not on it); Qualys and Tenable provide the continuous scanning and compliance reporting between audits.

**Trade-off:** A VAPT is a point-in-time service priced per application; continuous scanning is the platform. Most regulated estates need both — and should not confuse one for the other.

### Twenty vulnerabilities that actually matter out of twenty thousand

**Shortlist:** Qualys VMDR, Tenable Vulnerability Management, CrowdStrike Falcon Exposure Management

**Why:** TruRisk, VPR and ExPRT.AI all fold exploit activity, threat intelligence and asset context into the score — cutting the actionable list by half or more against raw CVSS.

**Trade-off:** Three different risk models; none knows your compensating controls unless you tell it. Falcon's view is the sensor's hosts only.

### Web apps and APIs are the exposed surface

**Shortlist:** Qualys Web Application Scanning, Tenable One (Exposure Management), Mitigata VAPT

**Why:** Qualys WAS scans web apps and APIs at scale; Tenable One includes web scanning in the exposure view; Mitigata's VAPT adds manual testing a DAST cannot.

**Trade-off:** Host scanners with 'web' on the datasheet (Nessus, VMDR, Tenable VM) run basic checks or need the separate WAS SKU — read the card.

### You already run CrowdStrike, Trend or Sophos

**Shortlist:** CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Sophos Managed Risk (powered by Tenable)

**Why:** Vulnerabilities from the sensor you already run, prioritised in the console you already watch — no scan window, no second agent.

**Trade-off:** Coverage is wherever the sensor is: no network scanner, web DAST or unmanaged-device discovery; Trend is credit-priced; Sophos Managed Risk advises, you fix.

### Plants, utilities, OT networks

**Shortlist:** Tenable OT Security, Tenable One (Exposure Management)

**Why:** Passive monitoring and safe active querying of industrial controllers — the agentless approach OT requires; Tenable One brings the OT findings into the enterprise exposure view.

**Trade-off:** OT only needs an IT VM beside it; quote-only and on-prem appliances you run. Qualys and Mitigata may cover OT — not documented here, so not ruled in.

### A consultant, an auditor, or a small team with no per-asset budget

**Shortlist:** Tenable Nessus Professional, Action1 Vulnerability Remediation, Tenable Vulnerability Management

**Why:** Nessus Professional is a flat $4,790 per scanner with unlimited IPs (Essentials free for 16); Action1 is free to 200 endpoints; Tenable VM publishes a per-asset list from $3,700 / 100 assets.

**Trade-off:** Nessus has no central console, agents or remediation; Action1 is endpoints only; Tenable VM reports, it does not fix.

### Enterprise — one exposure view across hosts, cloud, identity and OT

**Shortlist:** Tenable One (Exposure Management), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Trend Vision One Cyber Risk Exposure Management (ASRM)

**Why:** Exposure platforms that aggregate several scanners into one risk view with attack-path context; each assumes you run the underlying vendor's products.

**Trade-off:** You are buying several products at once: enterprise-priced, quote-only, and the view is only as complete as the sensors feeding it.

## At scale

Findings scale faster than assets. Prioritisation and remediation capacity are what keep the programme from becoming a report nobody opens.

### 500 assets — The list is the constraint

- Any scanner finds thousands; without a risk model and an owner for the top twenty, the programme is a monthly PDF.
- Nessus Professional, Action1 (free to 200), Tenable VM's published per-asset list and Mitigata per application fit this band.
- Authenticated scanning is the first thing to get right — and the first thing to silently break.

**The test:** Run an authenticated scan and confirm it authenticated; take the top ten by the vendor's risk model and see whether your team would patch them this week.

### 5,000 assets — Coverage and ownership are the constraint

- Web apps, cloud accounts and roaming laptops are now separate surfaces — separate SKUs at most vendors; agents for the laptops, scanners for the rest.
- Findings need owners by business unit and SLAs by risk tier, or the remediation rate is the only number that matters and it is falling.
- Per-asset pricing starts to matter; volume discounts start to exist.

**The test:** Measure mean time to remediate for critical-risk findings over a quarter; ask each vendor how their model would shrink that queue.

### 50,000 assets — Architecture and exposure are the constraint

- One exposure view across scanners, cloud, identity and OT (Tenable One, Qualys TruRisk) or you are reconciling spreadsheets.
- Scan windows, agent fleets, API limits and regional data become engineering problems; OT needs its own passive approach.
- The regulator's empanelled VAPT and the continuous platform are two budgets, both mandatory.

**The test:** Pull the full asset inventory through the API and reconcile it against the CMDB; price the exposure platform against the cost of the reconciliation you do today.

Qualys, Tenable VM / One, CrowdStrike and Trend document estates well above 10,000 assets; Nessus Professional is a single scanner by design; Action1 is unverified above 10,000 endpoints; Mitigata and Sophos Managed Risk are services. Which scanner or platform starts to strain at your asset count is delivery-team experience: [TechBag to confirm].

## Switching scanners is cheap; losing the history is not

Scanners and agents redeploy in weeks. The trend lines, the exceptions, the risk-acceptance records and the integrations into ticketing are what the next tool starts without.

**Scanners and agents** — Deploy the new agent through your UEM / RMM, stand up new scanners with the same credentials, run both for a cycle, retire the old. Weeks, scriptable. *(Scriptable)*

**Exceptions and risk acceptances** — Every accepted risk, compensating control and false-positive rule is rebuilt by hand — there is no import format between vendors. *(Rebuild)*

**History and trend lines** — Years of remediation-rate trends, audit evidence and per-asset history stay in the old tenant. Export before the licence ends, or the audit trail ends with it. *(Export or lose)*

**Integrations** — Ticketing, CMDB, patch-tool and SIEM integrations are re-wired; the prioritisation model changes, so every SLA keyed to a score is re-baselined. *(Re-wire, re-baseline)*

**Cut-over weeks and exception rebuild for your estate:** [TechBag to confirm] — TechBag scopes it from your asset count, surfaces and integrations.

## Per asset, per scanner, per application — three different meters

What you may already hold, the meters compared in USD and INR at three estate sizes, and what the licence leaves out — chiefly the people who patch.

### Do you already own one?

Four licences you may hold already find vulnerabilities. None of them is the whole programme; one of them may be the scanner.

- **Microsoft 365 E5 — Partly.** Defender Vulnerability Management is inside Defender for Endpoint P2 (E5); a standalone add-on otherwise. Good host coverage on Defender-managed devices; no network scanner, web DAST or OT.

- **Your EDR vendor — Often.** CrowdStrike (Falcon Exposure), Trend (CREM), Sophos (Managed Risk), SentinelOne and Bitdefender all sell vulnerability views on the sensor you run. Host-only, no scan window, no unmanaged devices.

- **Your RMM / patch tool — Partly.** Action1, NinjaOne, ManageEngine Endpoint Central and Qualys Patch Management assess and patch what their agent manages. The fix, without the wider discovery.

- **Your cloud provider — Partly.** AWS Inspector, Microsoft Defender for Cloud and Google Security Command Center scan their own workloads. Cloud-native, one cloud each — the cloud guide takes it from here.

If the sensor you already pay for covers the hosts, we say so — and then talk about the web apps, the cloud accounts and who patches.

### What the rest actually cost

Published and reported prices (INR for scale) on three meters — per asset per year, per scanner per year, per application — then worked at 500 / 5,000 / 50,000 assets. Where a product is quote-only or credit-priced the line says so.

### What isn't in the licence price

- **The patch team.** A scanner that reports needs people who patch — yours, your RMM’s, or a fixer tool. Price the remediation capacity beside the scanner; it is the larger number and the one that decides whether the programme works.

- **Credentials and coverage upkeep.** Authenticated scanning needs credentials that rotate, agents that get deployed to new builds, cloud accounts that get connected — an owner’s hours every month, or coverage quietly decays.

- **The empanelled report.** Where the regulator names a CERT-In-empanelled VAPT (RBI, SEBI CSCRF, IRDAI), it is a separate service priced per application (Mitigata from ₹52,000; it is not on CERT-In’s empanelled list, so check who signs) — not a line in the scanner contract. Your scope and frequency: [TechBag to confirm].

## What goes wrong

Documented tool behaviour, cross-checked against TechBag engagements before any becomes a named case. Most are programme failures the tool could not have prevented.

- **Scan results nobody actions.** Twenty thousand findings, a monthly PDF, no owner. The tool worked; the programme did not. Prioritisation model plus named owners plus SLAs — or do not buy the scanner.

- **Authenticated scans that were never actually authenticated.** Credentials expired or were wrong; the scanner fell back to unauthenticated and reported a clean, shallow picture for a year. Check the authentication status on every scan.

- **Agentless coverage gaps.** Laptops off the network at scan time, cloud workloads spun up between windows, containers that lived for an hour. Scanners see what is there when they look; agents see what they are on.

- **Prioritisation that ignores compensating controls.** The score said critical; the host was isolated behind three controls. No model knows your mitigations unless you tell it — exceptions are part of the programme.

- **Buying a scanner when the gap was remediation capacity.** A better list did not get patched faster. The purchase that would have helped was the fixer (Action1, Qualys patching) or the patch team.

- **Per-asset meter surprise.** Cloud workloads and containers counted as assets; the renewal doubled. Ask how ephemeral workloads are metered before the first cloud connector.

- **Tool report offered where the regulator wanted an empanelled VAPT.** The scanner's compliance PDF was not the CERT-In-empanelled report the circular named. Two documents, two budgets.

- **Single scanner stretched to the enterprise.** Nessus Professional on five laptops with five spreadsheets. The enterprise tier exists for a reason; the meter changes with it.

## Questions this guide answers

### What is the difference between vulnerability scanning, exposure management, a pentest and BAS?

Scanning finds and ranks known weaknesses continuously and broadly (Nessus, Tenable VM, Qualys VMDR). Exposure management aggregates scanning with cloud posture, identity, OT and external attack surface into one risk view with attack paths (Tenable One, Qualys TruRisk, Trend CREM). A pentest (VAPT) is humans proving, point-in-time, that an attacker can get in — often required by Indian regulators from a CERT-In-empanelled auditor (check CERT-In’s published list). BAS runs attacker techniques continuously to test what your defences catch. Adjacent and widening scopes, not tiers.

### Which vulnerability management tools also remediate?

Action1 assesses and patches Windows, macOS and Linux endpoints from one agent (free to 200 endpoints, $4 per endpoint per month beyond); Qualys VMDR includes a limited patch licence on the Cloud Agent and Qualys Patch Management (licensed separately) closes the loop, with TruRisk Eliminate adding mitigations where no patch exists. Tenable, CrowdStrike Falcon Exposure and Trend CREM report and prioritise; remediation is your patch tool. Mitigata VAPT and Sophos Managed Risk advise and re-test.

### How much does vulnerability management cost per asset?

Tenable Vulnerability Management publishes from $3,700 a year for 100 assets (about $28–45 per asset per year); Qualys VMDR is reported at roughly $199–250 per asset per year with volume discounts from about 1,000 assets; Nessus Professional is a flat $4,790 per scanner per year with unlimited IPs; Action1 is free to 200 endpoints then $4 per endpoint per month; Mitigata VAPT is priced per application from ₹52,000; Tenable One is reported from about $50,000 a year; CrowdStrike, Trend and Sophos are quote or credit priced.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/security/vulnerability-management*