- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
- Endpoint Management
- UEM & MDM
- RMM & Patch
- Endpoint Protection
- Remote Access & Support
Endpoint Management
- Security
- Backup & Cyber Resilience
- Backup & Recovery
- SaaS Backup
- Disaster Recovery
- Cyber Recovery
Backup & Cyber Resilience
- Identity & Access
- Privileged Access Management
- IAM, SSO & MFA
- Identity Governance
Identity & Access
- Network Security & SASE
- Firewall & Network Security
- SASE & SSE
- Zero Trust Access
- Secure Web & DNS
Network Security & SASE
Finding vulnerabilities is the easy part. The question is which twenty matter, and who fixes them.
Every tool here will hand you thousands of findings on day one. The purchase is the model that ranks them by real risk, and the capacity — yours or the tool’s — to close the ones at the top.
Tenable Nessus Professional is $4,790 a year per scanner, unlimited IPs. Qualys VMDR is reported at ~$199–250 per asset a year — and bundles the patch. Same findings; opposite answers to “who fixes it”.
Already decided — before the first scan
Still yours to weigh
What vulnerability and exposure management actually is
A continuous inventory of what you run and what is wrong with it: missing patches, misconfigurations, exposed services, weak ciphers — on hosts, web applications, cloud accounts, containers and industrial controllers. A scanner (or an agent) finds them; a scoring model ranks them; a report or a ticket hands them to whoever fixes things. That last hand-off is where most programmes fail.
The field has split three ways. Scanners (Nessus, Tenable VM, Qualys VMDR, WAS) find and rank. Exposure platforms (Tenable One, Qualys TruRisk, Trend CREM, Falcon Exposure) aggregate several sources into one risk view with attack-path context. Remediation tools (Action1, Qualys Patch Management) actually apply the fix — and a service (Mitigata VAPT, Sophos Managed Risk) does the work with people. Knowing which of the three your gap is saves the purchase.
The real differentiator
Raw CVSS is useless at volume — half of everything is “high”. The prioritisation model (exploit activity, threat intelligence, asset criticality, compensating controls) is what separates a list from a plan. Ask every vendor how many of your 20,000 findings their model calls urgent, and why.
Often confused withEndpoint Protection — what is being attacked, versus what could be →·Cloud & Workload Security — where posture and vulnerability merge for cloud estates →·RMM & Patch — the remediation half, if the scanner is not it →
Scanning vs exposure management vs pentest vs BAS
Four terms this buyer confuses, and nothing more. They are widening or adjacent scopes — not tiers. Each costs more and needs more people than the one before, and none replaces the others.
Vulnerability scanning
Automated, continuous, broad: find known weaknesses on everything you can reach or install an agent on, rank them, report. The foundation — and the source of the thousands of findings nobody actions. Nessus, Tenable VM, Qualys VMDR, WAS, Falcon Exposure.
Exposure management
Scanning's findings plus cloud posture, identity, OT and external attack surface, aggregated into one risk view with attack paths. Wider scope, enterprise price, and it still does not fix anything — it tells you what to fix first. Tenable One, Qualys TruRisk, Trend CREM.
Penetration testing (VAPT)
Humans, point-in-time, goal-directed: can an attacker actually get in through this application or network, chaining what a scanner only lists. Required by many Indian regulators as an empanelled report. Mitigata VAPT; not a replacement for continuous scanning.
Breach & attack simulation (BAS)
Automated adversary techniques run continuously against your controls to see what your EDR, mail filter and SIEM actually catch. Adjacent: it tests detection, not exposure. No BAS product is on this page — it belongs beside the SOC.
Six things decide this purchase. The feature grid is none of them.
Six variables decide this purchase. The instrument tests coverage, prioritisation model, agent vs agentless, remediation, the CERT-In line and published pricing; compliance reporting and scale are prose because the honest answer depends on your regulator and your estate.
Scanning coverage
Network and hosts, web apps and APIs, cloud accounts and containers, OT — each vendor covers some natively and sells the rest as separate SKUs. The chips name which.
Prioritisation model
The real differentiator: TruRisk, VPR, ExPRT.AI, Trend's risk index, an expert's judgement — or raw CVSS. Ask how many of your findings each model calls urgent, and why.
Agent-based vs agentless vs both
Agents see roaming laptops and need no scan window; scanners see unmanaged devices and need credentials; both is the usual honest answer for a mixed estate.
Does it remediate or only report
Where Action1 and Qualys differ fundamentally from Tenable, CrowdStrike and Trend: the fix on the same agent, or a ticket to your patch tool.
Compliance reporting for RBI, SEBI CSCRF, ISO
Tool reports satisfy many audits; some Indian regulators name an empanelled VAPT — Mitigata's line. Read the circular before the datasheet.
Scale behaviour
Per-asset pricing, scan windows, agent fleets and the size of the list nobody actions — the thresholds are in the scale section, the vendor-specific ones are delivery-team experience.
Narrow 13 products to your shortlist
Pick what holds for you. Products that fail a constraint fade with the reason on them; where a coverage is not documented either way the card is flagged and stays. Unset a chip and everything returns.
India
Report, or fix
Commercial shape
Coverage
Agent or agentless
Prioritisation
Estate size
Compliance reporting, India residency and scale are in the notes below, not chips — tool reports vary by regulator, two vendors document an India platform, and only one product is a single scanner by design.
per asset / year reported (volume discounts from ~1,000 assets); Cloud Agents + scanners; TruRisk scoring; one-click patch via the same agent; India platform
Estates that want discovery, scanning, TruRisk prioritisation and remediation on one agent — the 'find it and fix it' tenant, with a Pune-engineered India platform.
The catch: No published list (reported per-asset ranges); web-app scanning (WAS) and cloud (TotalCloud) are separate SKUs; the per-asset price looks high until volume discounts bite.
platform layer over Qualys data — risk aggregation across VM, WAS, TotalCloud; mitigations (isolate, disable) where a patch is not available
Qualys estates that want one risk number per business unit and mitigation options when patching is impossible.
The catch: A layer over Qualys telemetry — it aggregates what you already license; quote-only.
per web application / API; DAST with PCI-ready reporting
Teams scanning web apps and APIs at scale from the same Qualys tenant as the host VM.
The catch: Web and API only; reports, does not fix; quote-only.
per asset / year; OS and third-party patching through the Qualys Cloud Agent, driven by VMDR findings
Qualys estates closing the loop from finding to patch on the same agent.
The catch: Remediation, not discovery — it needs VMDR's findings; quote-only.
per asset / year (from $3,700 / year for 100 assets); Nessus scanners + agents; VPR prioritisation
The published-price cloud VM platform — Nessus breadth, VPR prioritisation, and a clean path to Tenable One later.
The catch: Reports and integrates; it does not patch. Web-app and cloud scanning are separate SKUs; India data region not documented.
per scanner / year, unlimited IPs (2-year ≈ $4,665 / yr, 3-year ≈ $4,546 / yr); 24/7 support +$400; software you run
Consultants, auditors and small teams that want the reference scanner with no per-asset meter.
The catch: A single scanner with no central management, no agents and no remediation — the enterprise tier is Tenable VM / Security Center; basic web scanning only.
platform licence (typically from ~$50k / year reported); VM + web + cloud + identity + OT + attack-path analysis
Enterprises that want one exposure view across hosts, web apps, cloud, identity and OT with attack-path context.
The catch: Enterprise-priced and quote-only; reports and prioritises, does not remediate; you are buying several Tenable products at once.
per OT site / asset; passive monitoring plus active querying of industrial controllers; on-prem
Plants and utilities that need vulnerability and asset visibility on PLCs and industrial networks without agents.
The catch: OT only — pair it with IT VM; quote-only; on-prem appliances you run.
module on the Falcon sensor (Spotlight + external attack surface); ExPRT.AI prioritisation; quote-only
Falcon estates that want host vulnerabilities from the sensor they already run, prioritised by exploit intelligence, with no scan window.
The catch: Host coverage is wherever the Falcon sensor is — no network scanner, no web DAST; cloud posture is Falcon Cloud Security; it does not patch; quote-only.
Vision One credits — 20 credits per assessed desktop / server (Core), 8,000 per connected cloud account; risk index across endpoints, cloud accounts and external surface
Trend Vision One estates that want a risk index across endpoint sensors, cloud accounts and external attack surface in the same console as XDR.
The catch: Credit-priced — opaque until you run it; depth depends on Trend sensors being present; web-app and OT coverage not documented; does not patch.
per endpoint / month beyond 200 (annual) + support; Windows / macOS / Linux endpoints; assess and patch from one agent
Teams whose gap is remediation capacity, not discovery — it finds and fixes on the endpoint, free until the 201st.
The catch: Endpoints only — no network, web, cloud or OT scanning; prioritisation is severity-led rather than documented threat-intel risk scoring; unverified above 10,000 endpoints.
per application (≈ $626), tiered; automated scanning + manual review + configuration analysis; CERT-In-empanelled reports
India-regulated organisations that need a CERT-In-empanelled VAPT report for RBI, SEBI CSCRF, IRDAI or ISO audits — web, API, network, cloud and mobile — from an Indian provider.
The catch: A service, not a platform: findings and a re-test, you fix; priced per application rather than per asset; depends on Mitigata's team, not your console.
subscription per user and server; external attack surface plus internal (IASM by Tenable, July 2025) with Sophos analysts; Sophos Central
Sophos Central estates that want Tenable scanning run and prioritised by Sophos's team, beside their MDR.
The catch: A managed service that advises — remediation is yours; quote-only; strongest inside a Sophos estate.
Why each constraint rules out what it doesShow the reasoning ↓
A CERT-In-empanelled reportRules out Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation and Sophos Managed Risk (powered by Tenable) — not a CERT-In-empanelled audit provider; reports are the tool's, not an empanelled auditor's. That leaves Mitigata VAPT.
Must remediate, not only reportRules out Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management and Trend Vision One Cyber Risk Exposure Management (ASRM) — reports and prioritises; remediation is your patch tool; Mitigata VAPT and Sophos Managed Risk (powered by Tenable) — advisory: findings and a re-test, you fix. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Patch Management and Action1 Vulnerability Remediation.
Vendor-published list priceRules out Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM) and Sophos Managed Risk (powered by Tenable) — quote-only (reported ranges or credits). That leaves Tenable Vulnerability Management, Tenable Nessus Professional, Action1 Vulnerability Remediation and Mitigata VAPT.
Web applications and APIsRules out Qualys VMDR (with patching) and Tenable Vulnerability Management — web-app scanning is a separate SKU from this vendor; Qualys Patch Management, Tenable OT Security, CrowdStrike Falcon Exposure Management and Action1 Vulnerability Remediation — no web-application scanning. That leaves Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Nessus Professional, Tenable One (Exposure Management), Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT and Sophos Managed Risk (powered by Tenable). It flags Qualys TruRisk Eliminate / Enterprise TruRisk Management — Web-app coverage not documented, Tenable Nessus Professional — Basic web checks only, Trend Vision One Cyber Risk Exposure Management (ASRM) — Web-app coverage not documented and Sophos Managed Risk (powered by Tenable) — Web-app coverage not documented — marked on the cards, not removed.
Cloud accounts and containersRules out Qualys VMDR (with patching), Tenable Vulnerability Management and CrowdStrike Falcon Exposure Management — cloud posture is a separate SKU from this vendor; Qualys Web Application Scanning, Qualys Patch Management, Tenable Nessus Professional, Tenable OT Security and Action1 Vulnerability Remediation — no cloud-account coverage. That leaves Qualys TruRisk Eliminate / Enterprise TruRisk Management, Tenable One (Exposure Management), Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT and Sophos Managed Risk (powered by Tenable). It flags Qualys TruRisk Eliminate / Enterprise TruRisk Management — Cloud coverage not documented and Sophos Managed Risk (powered by Tenable) — Cloud coverage not documented — marked on the cards, not removed.
OT and industrial networksRules out Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable Nessus Professional, CrowdStrike Falcon Exposure Management, Action1 Vulnerability Remediation and Sophos Managed Risk (powered by Tenable) — no OT / ICS coverage. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Tenable One (Exposure Management), Tenable OT Security, Trend Vision One Cyber Risk Exposure Management (ASRM) and Mitigata VAPT. It flags Qualys VMDR (with patching) — OT coverage not documented, Qualys TruRisk Eliminate / Enterprise TruRisk Management — OT coverage not documented, Trend Vision One Cyber Risk Exposure Management (ASRM) — OT coverage not documented and Mitigata VAPT — OT coverage not documented — marked on the cards, not removed.
Agentless onlyRules out Qualys Patch Management, CrowdStrike Falcon Exposure Management and Action1 Vulnerability Remediation — agent-based only. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT and Sophos Managed Risk (powered by Tenable). It flags Qualys VMDR (with patching) — Agent and agentless, Qualys TruRisk Eliminate / Enterprise TruRisk Management — Agent and agentless, Tenable Vulnerability Management — Agent and agentless, Tenable One (Exposure Management) — Agent and agentless, Trend Vision One Cyber Risk Exposure Management (ASRM) — Agent and agentless and Sophos Managed Risk (powered by Tenable) — Agent and agentless — marked on the cards, not removed.
Agents for roaming endpointsRules out Qualys Web Application Scanning, Tenable Nessus Professional, Tenable OT Security and Mitigata VAPT — no agent; scanners or a service only. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Patch Management, Tenable Vulnerability Management, Tenable One (Exposure Management), CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation and Sophos Managed Risk (powered by Tenable).
Risk-based prioritisationRules out Qualys Patch Management — a remediation tool, not a prioritiser; Action1 Vulnerability Remediation — severity-led; documented threat-intel risk scoring absent. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Tenable Vulnerability Management, Tenable Nessus Professional, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Mitigata VAPT and Sophos Managed Risk (powered by Tenable).
Above 10,000 assetsRules out Tenable Nessus Professional — a single-scanner product; enterprise management is Tenable VM / Security Center. That leaves Qualys VMDR (with patching), Qualys TruRisk Eliminate / Enterprise TruRisk Management, Qualys Web Application Scanning, Qualys Patch Management, Tenable Vulnerability Management, Tenable One (Exposure Management), Tenable OT Security, CrowdStrike Falcon Exposure Management, Trend Vision One Cyber Risk Exposure Management (ASRM), Action1 Vulnerability Remediation, Mitigata VAPT and Sophos Managed Risk (powered by Tenable). It flags Action1 Vulnerability Remediation — Unverified above 10,000 and Mitigata VAPT — A service, priced per application — marked on the cards, not removed.
Compliance reporting for RBI, SEBI CSCRF and ISOEvery scanner here ships compliance templates (PCI, ISO, CIS); what the Indian regulator often wants is the empanelled auditor's report, which is Mitigata's line. Qualys and Tenable reports satisfy many ISO and internal audits; whether your regulator accepts a tool report or requires an empanelled VAPT is a question for the circular, not the datasheet.
India data residencyDocumented: Qualys (India platform), Mitigata (India). Tenable, CrowdStrike (announced in-country cloud, January 2026), Trend, Action1 and Sophos do not document an India region for vulnerability data — flagged, not ruled out.
Scale behaviourQualys, Tenable VM / One, CrowdStrike and Trend document estates well above 10,000 assets; Nessus Professional is a single scanner by design; Action1 is unverified above 10,000 endpoints; Mitigata is priced per application. Where a specific console strains for your estate is delivery-team experience: [TechBag to confirm].
Eight situations, eight shortlists — starting from who fixes things
Every shortlist asks first whether your gap is discovery, prioritisation or remediation capacity. The vendor comes after.
You have thousands of findings and nobody patches them
Why: The gap is remediation capacity, not discovery: Action1 finds and patches endpoints from one agent (free to 200); Qualys VMDR bundles one-click patching on the Cloud Agent; Qualys Patch Management closes the loop for Qualys estates.
The trade-off: Action1 is endpoints only and severity-led; Qualys is per-asset priced with separate SKUs for web and cloud. Buying another scanner would not have helped.
RBI / SEBI CSCRF / IRDAI audit — the regulator wants an empanelled report
Why: Mitigata's CERT-In-empanelled VAPT is the document the regulator names; Qualys and Tenable provide the continuous scanning and compliance reporting between audits.
The trade-off: A VAPT is a point-in-time service priced per application; continuous scanning is the platform. Most regulated estates need both — and should not confuse one for the other.
Twenty vulnerabilities that actually matter out of twenty thousand
Why: TruRisk, VPR and ExPRT.AI all fold exploit activity, threat intelligence and asset context into the score — cutting the actionable list by half or more against raw CVSS.
The trade-off: Three different risk models; none knows your compensating controls unless you tell it. Falcon's view is the sensor's hosts only.
Web apps and APIs are the exposed surface
Why: Qualys WAS scans web apps and APIs at scale; Tenable One includes web scanning in the exposure view; Mitigata's VAPT adds manual testing a DAST cannot.
The trade-off: Host scanners with 'web' on the datasheet (Nessus, VMDR, Tenable VM) run basic checks or need the separate WAS SKU — read the card.
You already run CrowdStrike, Trend or Sophos
Why: Vulnerabilities from the sensor you already run, prioritised in the console you already watch — no scan window, no second agent.
The trade-off: Coverage is wherever the sensor is: no network scanner, web DAST or unmanaged-device discovery; Trend is credit-priced; Sophos Managed Risk advises, you fix.
Plants, utilities, OT networks
Why: Passive monitoring and safe active querying of industrial controllers — the agentless approach OT requires; Tenable One brings the OT findings into the enterprise exposure view.
The trade-off: OT only needs an IT VM beside it; quote-only and on-prem appliances you run. Qualys and Mitigata may cover OT — not documented here, so not ruled in.
A consultant, an auditor, or a small team with no per-asset budget
Why: Nessus Professional is a flat $4,790 per scanner with unlimited IPs (Essentials free for 16); Action1 is free to 200 endpoints; Tenable VM publishes a per-asset list from $3,700 / 100 assets.
The trade-off: Nessus has no central console, agents or remediation; Action1 is endpoints only; Tenable VM reports, it does not fix.
Enterprise — one exposure view across hosts, cloud, identity and OT
Why: Exposure platforms that aggregate several scanners into one risk view with attack-path context; each assumes you run the underlying vendor's products.
The trade-off: You are buying several products at once: enterprise-priced, quote-only, and the view is only as complete as the sensors feeding it.
Three models for the same twenty thousand findings
Raw CVSS calls half of everything “high”. The vendors below fold exploit activity, threat intelligence and asset context into a score — differently. Knowing which model you are buying is knowing what your patch team will be told to do on Monday.
Model A
Normalised risk score (0–1,000)
Qualys TruRisk blends CVSS, real-time threat indicators, exploit availability and asset criticality into one number designed for executives and business-unit roll-ups; Qualys TruRisk Eliminate adds mitigations when a patch does not exist.
Model B
Predictive priority (VPR) and attack paths
Tenable's VPR combines base severity with real-world threat and exploit activity — commonly halving the actionable list against raw CVSS; Tenable One adds attack-path context across hosts, cloud, identity and OT. Sophos Managed Risk rides on it with analysts.
Model C
Sensor-native, exploit-intel-weighted
CrowdStrike's ExPRT.AI pulls EPSS, KEV and adversary intelligence into the Falcon sensor's view; Trend's risk index scores endpoints, cloud accounts and external surface in Vision One. Action1 ranks by severity and then simply patches; Mitigata's testers rank by what they could actually exploit.
Agent vs agentless vs both
Each sees a different estate.
- —Agents (Qualys Cloud Agent, Tenable agents, the Falcon sensor, Action1, Trend sensors) see roaming laptops and cloud workloads continuously, need no scan window and no credentials — and see nothing they are not installed on.
- —Scanners (Nessus, Qualys and Tenable scanners, WAS, Tenable OT) see unmanaged devices, network gear, web apps and controllers — with credentials, scan windows and the “authenticated scan that was never actually authenticated” failure mode.
- —Both is the honest answer for a mixed estate: Qualys VMDR, Tenable VM / One, Trend and Sophos Managed Risk run both; Falcon and Action1 are agent-only; Nessus, WAS and Tenable OT are agentless; Mitigata is people.
Report or fix
The fundamental split — and the one most buyers get wrong.
- —Fixers: Action1 patches the endpoint it assessed; Qualys VMDR bundles one-click patching and TruRisk Eliminate mitigates when no patch exists; Qualys Patch Management closes the loop for the Qualys tenant.
- —Reporters: Tenable VM / Nessus / One / OT, CrowdStrike Falcon Exposure and Trend CREM find and prioritise; the fix is your patch tool, your RMM, your change process. Excellent scanners — and the reason findings pile up when the patch team was the gap.
- —Advisers: Mitigata VAPT and Sophos Managed Risk tell you what to fix, re-test after you do, and do not touch your systems.
- —Buy for the gap you have. If the list is long and nothing closes, a better scanner is the wrong purchase.
What changes at 500, 5,000 and 50,000 assets
Findings scale faster than assets. Prioritisation and remediation capacity are what keep the programme from becoming a report nobody opens.
The list is the constraint
- —Any scanner finds thousands; without a risk model and an owner for the top twenty, the programme is a monthly PDF.
- —Nessus Professional, Action1 (free to 200), Tenable VM's published per-asset list and Mitigata per application fit this band.
- —Authenticated scanning is the first thing to get right — and the first thing to silently break.
Put this in your PoC
Run an authenticated scan and confirm it authenticated; take the top ten by the vendor's risk model and see whether your team would patch them this week.
Coverage and ownership are the constraint
- —Web apps, cloud accounts and roaming laptops are now separate surfaces — separate SKUs at most vendors; agents for the laptops, scanners for the rest.
- —Findings need owners by business unit and SLAs by risk tier, or the remediation rate is the only number that matters and it is falling.
- —Per-asset pricing starts to matter; volume discounts start to exist.
Put this in your PoC
Measure mean time to remediate for critical-risk findings over a quarter; ask each vendor how their model would shrink that queue.
Architecture and exposure are the constraint
- —One exposure view across scanners, cloud, identity and OT (Tenable One, Qualys TruRisk) or you are reconciling spreadsheets.
- —Scan windows, agent fleets, API limits and regional data become engineering problems; OT needs its own passive approach.
- —The regulator's empanelled VAPT and the continuous platform are two budgets, both mandatory.
Put this in your PoC
Pull the full asset inventory through the API and reconcile it against the CMDB; price the exposure platform against the cost of the reconciliation you do today.
Qualys, Tenable VM / One, CrowdStrike and Trend document estates well above 10,000 assets; Nessus Professional is a single scanner by design; Action1 is unverified above 10,000 endpoints; Mitigata and Sophos Managed Risk are services. Which scanner or platform starts to strain at your asset count is delivery-team experience: [TechBag to confirm].
Switching scanners is cheap; losing the history is not
Scanners and agents redeploy in weeks. The trend lines, the exceptions, the risk-acceptance records and the integrations into ticketing are what the next tool starts without.
Scanners and agents
Deploy the new agent through your UEM / RMM, stand up new scanners with the same credentials, run both for a cycle, retire the old. Weeks, scriptable.
Exceptions and risk acceptances
Every accepted risk, compensating control and false-positive rule is rebuilt by hand — there is no import format between vendors.
History and trend lines
Years of remediation-rate trends, audit evidence and per-asset history stay in the old tenant. Export before the licence ends, or the audit trail ends with it.
Integrations
Ticketing, CMDB, patch-tool and SIEM integrations are re-wired; the prioritisation model changes, so every SLA keyed to a score is re-baselined.
Cut-over weeks and exception rebuild for your estate: [TechBag to confirm] — TechBag scopes it from your asset count, surfaces and integrations.
Per asset, per scanner, per application — three different meters
What you may already hold, the meters compared in USD and INR at three estate sizes, and what the licence leaves out — chiefly the people who patch.
Do you already own one?
Four licences you may hold already find vulnerabilities. None of them is the whole programme; one of them may be the scanner.
- Microsoft 365 E5
- Partly Defender Vulnerability Management is inside Defender for Endpoint P2 (E5); a standalone add-on otherwise. Good host coverage on Defender-managed devices; no network scanner, web DAST or OT.
- Your EDR vendor
- Often CrowdStrike (Falcon Exposure), Trend (CREM), Sophos (Managed Risk), SentinelOne and Bitdefender all sell vulnerability views on the sensor you run. Host-only, no scan window, no unmanaged devices.
- Your RMM / patch tool
- Partly Action1, NinjaOne, ManageEngine Endpoint Central and Qualys Patch Management assess and patch what their agent manages. The fix, without the wider discovery.
- Your cloud provider
- Partly AWS Inspector, Microsoft Defender for Cloud and Google Security Command Center scan their own workloads. Cloud-native, one cloud each — the cloud guide takes it from here.
If the sensor you already pay for covers the hosts, we say so — and then talk about the web apps, the cloud accounts and who patches.
What the rest actually cost
Published and reported prices (INR for scale) on three meters — per asset per year, per scanner per year, per application — then worked at 500 / 5,000 / 50,000 assets. Where a product is quote-only or credit-priced the line says so.
- Tenable Vulnerability Management($28–45 / asset / yr)$14,000–22,500 ≈₹11,62,000–₹18,67,500
- Qualys VMDR with patching(reported $199–250 / asset / yr)$99,500–1,25,000 ≈₹82,58,500–₹1,03,75,000
- Action1(free to 200, then $4 / endpoint / mo)$14,400 ≈₹11,95,200
- Nessus Professional($4,790 / scanner / yr, unlimited IPs)$4,790 ≈₹3,97,570
- Mitigata VAPT(₹52,000+ per application — not per asset)Quote
- Tenable One(reported from ~$50k / yr)Quote
- CrowdStrike Falcon Exposure ManagementQuote
- Trend CREM(credits)Quote
- Sophos Managed RiskQuote
- Qualys WAS / TruRisk / PatchQuote
- Tenable OT SecurityQuote
- Tenable Vulnerability Management($28–45 / asset / yr)$1,40,000–2,25,000 ≈₹1,16,20,000–₹1,86,75,000
- Qualys VMDR with patching(reported $199–250 / asset / yr)$9,95,000–12,50,000 ≈₹8,25,85,000–₹10,37,50,000
- Action1(free to 200, then $4 / endpoint / mo)$2,30,400 ≈₹1,91,23,200
- Nessus Professional($4,790 / scanner / yr, unlimited IPs)$4,790 ≈₹3,97,570
- Mitigata VAPT(₹52,000+ per application — not per asset)Quote
- Tenable One(reported from ~$50k / yr)$50,000 ≈₹41,50,000
- CrowdStrike Falcon Exposure ManagementQuote
- Trend CREM(credits)Quote
- Sophos Managed RiskQuote
- Qualys WAS / TruRisk / PatchQuote
- Tenable OT SecurityQuote
- Tenable Vulnerability Management($28–45 / asset / yr)$14,00,000–22,50,000 ≈₹11,62,00,000–₹18,67,50,000
- Qualys VMDR with patching(reported $199–250 / asset / yr)$99,50,000–1,25,00,000 ≈₹82,58,50,000–₹1,03,75,00,000
- Action1(free to 200, then $4 / endpoint / mo)$23,90,400 ≈₹19,84,03,200
- Nessus Professional($4,790 / scanner / yr, unlimited IPs)$4,790 ≈₹3,97,570
- Mitigata VAPT(₹52,000+ per application — not per asset)Quote
- Tenable One(reported from ~$50k / yr)$50,000 ≈₹41,50,000
- CrowdStrike Falcon Exposure ManagementQuote
- Trend CREM(credits)Quote
- Sophos Managed RiskQuote
- Qualys WAS / TruRisk / PatchQuote
- Tenable OT SecurityQuote
TechBag gives INR pricing, GST, PO cycle, minimums and tier-matched quotes. The INR above is conversion for scale at ≈₹83/$; the tier-matched INR quote is ours.
What isn’t in the licence price
The patch team
A scanner that reports needs people who patch — yours, your RMM’s, or a fixer tool. Price the remediation capacity beside the scanner; it is the larger number and the one that decides whether the programme works.
Credentials and coverage upkeep
Authenticated scanning needs credentials that rotate, agents that get deployed to new builds, cloud accounts that get connected — an owner’s hours every month, or coverage quietly decays.
The empanelled report
Where the regulator names a CERT-In-empanelled VAPT (RBI, SEBI CSCRF, IRDAI), it is a separate service priced per application (Mitigata from ₹52,000) — not a line in the scanner contract. Your scope and frequency: [TechBag to confirm].
What goes wrong
Documented tool behaviour, cross-checked against TechBag engagements before any becomes a named case. Most are programme failures the tool could not have prevented.
Scan results nobody actions
Twenty thousand findings, a monthly PDF, no owner. The tool worked; the programme did not. Prioritisation model plus named owners plus SLAs — or do not buy the scanner.
Authenticated scans that were never actually authenticated
Credentials expired or were wrong; the scanner fell back to unauthenticated and reported a clean, shallow picture for a year. Check the authentication status on every scan.
Agentless coverage gaps
Laptops off the network at scan time, cloud workloads spun up between windows, containers that lived for an hour. Scanners see what is there when they look; agents see what they are on.
Prioritisation that ignores compensating controls
The score said critical; the host was isolated behind three controls. No model knows your mitigations unless you tell it — exceptions are part of the programme.
Buying a scanner when the gap was remediation capacity
A better list did not get patched faster. The purchase that would have helped was the fixer (Action1, Qualys patching) or the patch team.
Per-asset meter surprise
Cloud workloads and containers counted as assets; the renewal doubled. Ask how ephemeral workloads are metered before the first cloud connector.
Tool report offered where the regulator wanted an empanelled VAPT
The scanner's compliance PDF was not the CERT-In-empanelled report the circular named. Two documents, two budgets.
Single scanner stretched to the enterprise
Nessus Professional on five laptops with five spreadsheets. The enterprise tier exists for a reason; the meter changes with it.
Three doors — pick by where you are
Vendor-neutral. No gated content.