Executive Summary
A vulnerability management platform finds known weaknesses, ranks them and tracks each one to a fix. Platforms differ in where the console runs, how data reaches it and which signals set the order of work.
Vulnerability management can run on your own servers, on an appliance the vendor maintains in your data center, or as a cloud service that collects data from scanners, agents and passive sensors inside your network. Endpoint and cloud security vendors also sell it as a module of an agent or cloud connection you may already run. Section 3 lists, from each vendor’s own pages, which platforms in this guide offer a console you host, an appliance, a self-hosted or air-gapped edition, or only a cloud service.
NIST defines a vulnerability as a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. A platform lists the vulnerabilities on each asset, ranks them and follows each one to a fix. Ranking changed for US federal agencies in 2026. CISA issued Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk on June 10, 2026, requiring federal civilian agencies to assess and align their vulnerability management policies across four criteria: Asset Exposure, Known Exploited Vulnerabilities (KEV) Status, Exploit Automation, and Post-Exploitation Technical Impact.
This guide defines the category from NIST, CISA and FIRST pages, lists what to test in a proof of concept, sets out five approaches to buying, names the eight platforms in the table that represent them, and lists published prices. Deploying the patches is covered in the Patch Management Buyer Guide. Discovering internet-facing assets is covered in the Attack Surface Management Buyer Guide.
What Is Vulnerability Management?
Vulnerability management and patch management meet at the fix. NIST defines enterprise patch management as the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization. A vulnerability management platform supplies the list that patching works from: which weaknesses exist, on which assets, and in what order to fix them. It also confirms the fix with a rescan.
Severity is not risk. NIST states that the Common Vulnerability Scoring System (CVSS) is a method used to supply a qualitative measure of severity, and that CVSS is not a measure of risk. FIRST states that CVSS Base (CVSS-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk. FIRST states that the CVSS Base Score should be supplemented with an analysis of the environment (Environmental Metrics) and with attributes that may change over time (Threat Metrics). NIST states that the NVD provides CVSS assessments of Base metrics, the innate characteristics of each vulnerability, and does not currently provide assessments for Temporal or Threat metrics. A platform that ranks only by the base score from the NVD ranks by severity alone.
Two public signals measure exploitation. CISA states that it maintains the authoritative source of vulnerabilities that have been exploited in the wild, and that organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. FIRST describes the Exploit Prediction Scoring System (EPSS) as a data-driven machine-learning model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. FIRST states that EPSS publishes a 0–1 probability, with ranking percentiles, every day for every CVE, and makes the data freely and openly accessible via CSV and API. Ask each vendor which of these signals its own score uses, and whether the KEV flag and the EPSS probability appear next to that score.
CISA states that Binding Operational Directive 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities, has been revoked and is superseded by BOD 26-04. CISA states that the Directive harmonizes and improves BOD 19-02 and BOD 22-01, and accounts for the threat actor capability, the asset deployment position on the network, the relative ease of the path to exploit the vulnerability, and the consequences of an exploitation event. CISA states that it is empowering federal civilian agencies to focus their efforts on the areas of highest risk and defer patching lower priority vulnerabilities. CISA states that it adds expectations for when and how to check if a vulnerable system was compromised by a threat actor before the patch was applied, and that applying a patch generally does not evict a threat actor. CISA states that the text “& forensic triage” means that the agency must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised. CISA states that the timelines for each asset are dynamic as facts change: removing a system from the internet, for example, changes the value of Publicly Exposed from Yes to No and shifts the required timeline for further action back.
CISA states that while the Directive is a mandate for federal agencies, it strongly encourages all partners to adopt similar actions in their vulnerability management policy. CISA states that its SSVC tree determines the decisions of Track, Track*, Attend and Act based on five values. Ask each vendor whether its ranking can show the four BOD 26-04 decision points for each finding: exposure, KEV status, automation and technical impact.
Can Vulnerability Management Run On Premises?
Yes. Four of the eight platforms in the table describe, on their own pages, a console, appliance or edition that keeps scan data on infrastructure you control. Two more describe scanning that runs inside your own environment. The rest are cloud services. Each answer below is the vendor’s own statement.
Software you install. Tenable states that Tenable Security Center and Tenable Security Center Plus are its on-premises vulnerability management solutions. Tenable states that Tenable Enclave Security can be deployed on-prem, in air-gapped or virtual private clouds, or as a managed service in AWS FedRAMP High and DoD Impact Level (IL5) boundaries. Rapid7 states that the Security Console is an on-premises vulnerability scanner and management system. Rapid7 states that the Security Console is not supported in a containerized environment, while the Scan Engine is available as a container image on Docker Hub. Rapid7 states that the Rapid7 Agent is lightweight software you can install on supported assets, in the cloud or on-premises, to centralize and monitor data on the Command Platform.
An appliance the vendor maintains. Qualys states that the Private Cloud Platform gives you the power of its cloud-based solutions as well as full control over the security and compliance data they generate. Qualys states that its software is pre-loaded and pre-configured, so that Private Cloud Platforms can be deployed quickly, and that all physical rack and cabling work is completed before the appliance arrives onsite.
A self-hosted or air-gapped edition of a ranking layer. Nucleus Security lists AWS GovCloud, self-hosted, or air-gapped deployment with Bring Your Own Key (BYOK) encryption for full data sovereignty.
A cloud console with collectors inside your network. Tenable states that cloud sensors, which Tenable manages, scan internet-facing assets from an external perspective, while linked sensors, which you install and update on your own hardware or virtual machines, scan assets inside your corporate firewall. Qualys lists unlimited Virtual Scanners, Cloud Agents, Passive Sensors, Agent Gateways and Container Sensors among what VMDR includes.
An agent or cloud connection you already run. Microsoft states that Defender Vulnerability Management built-in and agentless scanners continuously monitor and detect risk in your organization even when devices aren't connected to the corporate network. CrowdStrike states that Falcon Exposure Management with Network Vulnerability Assessment repurposes existing Falcon agents as network scanners, to identify unmanaged assets without deploying complex scanning infrastructure. Wiz states that its customer-hosted workload scanner runs in the customer's own environment using the customer's infrastructure and permissions, without granting Wiz privileges to create or delete snapshots.
Open source scanners you host. Greenbone states that all Greenbone products will be brought together under the OPENVAS brand. Greenbone states that its vulnerability management is available in three product lines: dedicated hardware appliances, virtual machine configurations compatible with all popular hypervisors, and the entry-level OPENVAS BASIC.
Federal deployment adds a second question: which authorization covers the service you buy. Qualys states that the Qualys Cloud Platform has been FedRAMP Moderate authorized since 2016, and that the Qualys Government Platform was FedRAMP High authorized in 2025. Nucleus Security states that Nucleus Unified Vulnerability Management is FedRAMP Moderate Authorized and approved for the Continuous Diagnostics and Mitigation Program (CDM) under the General Services Administration (GSA). Rapid7 states that InsightGovCloud does not validate the Security Console for compliance, and that the customer is responsible for Security Console configuration, scanning, and ongoing maintenance.
| Deployment model | Console and data | How data is collected | Ask the vendor |
|---|---|---|---|
| On-premises console | Your servers | Network scanners and agents you deploy | Who patches the console, and how often vulnerability content updates arrive |
| Vendor-maintained appliance | Hardware in your data center | The vendor’s scanners and agents | What the vendor’s staff can reach, and when |
| Self-hosted or air-gapped edition | Your environment, including isolated networks | Imports from scanners you already run | How vulnerability content reaches a network with no internet access |
| Cloud service with internal collectors | The vendor’s cloud | Scanners, agents and passive sensors inside your network | Which region holds the data, and which federal authorization applies |
| Endpoint agent or cloud API | The vendor’s cloud | An agent you already run, or read access to cloud accounts | How devices with no agent get assessed |
What Should You Test in a Vulnerability Management Platform?
Start with coverage. List your asset types: servers, laptops, network devices, cloud workloads, containers and operational technology. For each, ask how the platform collects data: an authenticated network scan, an agent, a passive sensor, a cloud API or an import from another tool. Run each finalist against the same 200 assets for two weeks and compare what each one finds.
Then test ranking. Give each finalist the same findings and ask why its top 20 rank above the rest. Ask which signals produced the order: CVSS severity, KEV status, EPSS probability, exposure to the internet, the asset’s business importance, and whether an exploit can be automated. Ask whether you can change the weights, and whether the platform shows the signals behind each score.
Test the path to a fix. Ask whether a finding opens a ticket in your ITSM tool with an owner already assigned, whether the platform maps the finding to the patch or configuration change that fixes it, and whether a rescan closes the ticket. Count the findings closed inside your own service levels during the trial.
If you already run several scanners, test aggregation. Import findings from two of them and check that duplicates merge into one finding per asset, and that the platform keeps the source of each finding.
Test reporting against your obligations. Federal civilian agencies need the BOD 26-04 decision points and reports for CISA. Other organizations need trends by business unit, and evidence for auditors that critical findings were fixed on time.
| Capability | What it does | Buyer translation |
|---|---|---|
| Asset discovery | Finds devices, cloud resources and software, including assets no one registered | Do we know everything we own? |
| Network scanning | Probes devices remotely, with or without credentials | Can it reach devices that cannot run an agent? |
| Agents | Assess a host from inside, on or off the corporate network | Are laptops covered when staff work from home? |
| Passive monitoring | Listens to network traffic instead of probing | Can fragile or industrial devices be assessed safely? |
| Cloud and container assessment | Reads cloud accounts and images through APIs | Are short-lived workloads assessed before they disappear? |
| Risk ranking | Orders findings by exploitation, exposure and asset value | Which 20 findings should be fixed this week? |
| Remediation workflow | Routes findings to owners, tickets and patches | Does a finding reach the person who can fix it? |
| Aggregation | Imports and deduplicates findings from other tools | Can one queue replace a dashboard per scanner? |
Vendors in Vulnerability Management Platforms
Representative vendors include CrowdStrike Falcon Exposure Management, Ivanti Neurons for RBVM (Ivanti Risk-Based Vulnerability Management), Microsoft Defender Vulnerability Management, Nucleus Security, Qualys, Rapid7, Tenable and Wiz. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow two questions: where the console runs, and how data reaches it. Three of the five approaches hold two platforms each.
A scanner-based platform sells network scanners, agents and a console, as a cloud service or as software you host. Tenable describes Tenable One as an exposure management platform to help organizations gain visibility across the modern attack surface, focus efforts to prevent likely attacks and accurately communicate cyber risk. Tenable announced on February 7, 2025 that it had closed its acquisition of Vulcan Cyber Ltd. Rapid7 states that InsightVM is the vulnerability management technology that powers Exposure Command.
A cloud platform runs scanning, agents and patching from the vendor’s cloud, with an appliance for sites that must keep data local. Qualys states that it patches Windows, Linux and Mac operating systems and third-party apps from a central dashboard, utilizing the same agent as VMDR.
An endpoint security vendor adds vulnerability management to the agent its customers already run. CrowdStrike states that Falcon Exposure Management helps security teams continuously find exploitable vulnerabilities, misconfigurations, and attack paths across external assets, endpoints, cloud, network, OT/IoT, and shadow AI. CrowdStrike states that Falcon Exposure Management prioritizes risk by combining exploitability analysis, adversary intelligence, attack path analysis, and asset context. Microsoft states that Defender Vulnerability Management delivers asset visibility, intelligent assessments and prioritization, and built-in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices. Microsoft states that Defender Vulnerability Management uses Microsoft's threat intelligence, breach likelihood predictions, business contexts, and device assessments to quickly prioritize the biggest vulnerabilities in your organization. Microsoft states that Defender for Endpoint Plan 2 customers can add Defender Vulnerability Management as an add-on, and that Defender Vulnerability Management Standalone is recommended for new customers or existing Defender for Endpoint P1 or Microsoft 365 E3 customers. Organizations that scanned unmanaged Windows devices with credentials should note one change. Microsoft states that Windows authenticated scan is deprecated from December 18, 2025, and that after this date the capability is no longer supported or available to customers.
Agentless cloud scanning reads cloud accounts through APIs instead of installing software on each workload. Wiz states that it uses agentless-first, cross-cloud scanning with a vulnerability catalog of 120,000+ supported vulnerabilities across 40+ operating systems. Wiz states that customers can use its agentless cloud scanning and extend to on-premises with Wiz UVM third-party aggregation and the Sensor Workload scanner. Google announced on March 11, 2026 the completion of its acquisition of Wiz, and stated that Wiz will join Google Cloud and maintain its brand. Google states that Wiz products will continue to work and be available across all major clouds, including Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud.
A ranking layer runs no scanner of its own. It imports findings from the scanners you run and decides the order of work. Ivanti states that the Ivanti Neurons for RBVM platform provides an API-based connector that integrates with Rapid7 InsightVM. Ivanti states that Ivanti Risk-Based Vulnerability Management enables you to prioritize the vulnerabilities and weaknesses that pose you the most risk. Ivanti states that Ivanti RBVM ingests asset and vulnerability data from network scanners and other third-party products and correlates it with threat intelligence. Ivanti states that, unlike CVSS, its Vulnerability Risk Rating (VRR) scores consider threats, not just severity, and update based on real-world threat context. Ivanti states that, through an API integration, security analysts can deliver lists of prioritized vulnerabilities directly to Ivanti Patch Management for patching. Ivanti announced in August 2021 that it had acquired RiskSense, a pioneer in risk-based vulnerability management and prioritization. Nucleus Security states that it integrates data from security, asset, and threat intelligence tools with 200+ built-in connectors and the FlexConnect universal adapter. Nucleus Security states that you can operationalize your custom risk score, implement CISA BOD 26-04 SSVC decision logic, and prioritize with asset context and real-world exploitation intelligence.
One more vendor appears in searches for on-premises scanning. Greenbone states that its OPENVAS SCAN Appliances use the OPENVAS ENTERPRISE FEED, a collection of over 100,000 vulnerability tests.
| Vendor | Approach | Where it fits |
|---|---|---|
| Wiz | Agentless cloud scanning | Agentless scanning, customer-hosted scanner option; part of Google Cloud |
| CrowdStrike Falcon Exposure Management | Built into the endpoint agent | Falcon agents as network scanners; adversary intelligence in ranking |
| Microsoft Defender Vulnerability Management | Built into the endpoint agent | Add-on to Defender for Endpoint Plan 2, or standalone; Intune remediation tasks |
| Qualys | Cloud platform with an on-premises appliance | VMDR with scanners, agents and sensors; Private Cloud Platform appliance |
| Ivanti Neurons for RBVM (Ivanti Risk-Based Vulnerability Management) | Ranking layer over existing scanners | Ingests scanner data; VRR scoring; sends lists to Ivanti Patch Management |
| Nucleus Security | Ranking layer over existing scanners | 200+ connectors; FedRAMP Moderate; self-hosted or air-gapped |
| Rapid7 | Scanner-based platform, cloud or on premises | InsightVM within Exposure Command; Security Console on premises |
| Tenable | Scanner-based platform, cloud or on premises | Tenable One in the cloud; Security Center and Enclave Security on premises |
Eight platforms across five approaches; three approaches hold two each. The approaches were set before any platform was chosen, and every row is a platform the previous edition evaluated. Rows in this table are not for sale. Greenbone, named above, and other vulnerability management vendors can make their own case in the Spotlight below.
How Is Vulnerability Management Priced?
Vendors here charge per asset, per user, per scanner license, by platform tier or by quote. Convert each quote to your own count of assets in scope, including cloud workloads that start and stop during the month.
Published list price. Tenable lists Tenable One Vulnerability Management at $3,500 for a 1-year subscription covering 100 assets. No other platform in the table publishes a list price for vulnerability management on its own pages, as checked in November 2026.
Trials and allowances. Qualys offers VMDR at no cost for 30 days as a trial. Microsoft states that the Defender Vulnerability Management add-on trial and Standalone trial each last 90 days. Network scanning from existing endpoint agents carries its own allowance. CrowdStrike states that Falcon Exposure Management customers can assess up to 10% of their assets at no cost.
Quotes. Rapid7 states that its pricing reflects the asset types and use cases actually in scope. Where a vendor in the table publishes no price, the price is a quote. All prices are US list prices as published when this guide was checked in November 2026.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Asset | Each device, cloud resource or web application assessed | Inventory size | Short-lived cloud workloads counted at their monthly peak |
| User | Each licensed user, with their devices | Headcount | Servers licensed separately from user plans |
| Scanner license | Each scanner install, often with unlimited targets | Number of scanning teams | Licenses bought for one team and shared by many |
| Platform tier | A bundle of capabilities across asset types | Modules switched on | Paying for cloud or application modules no one uses |
How long does implementation take for Vulnerability Management Platforms?
Most of the work is the asset inventory and the routing of findings to owners. Agree who owns each asset group before the first scan reaches them.
Import assets from your CMDB, cloud accounts and directory. Tag each group with an owner, its business importance and whether it is exposed to the internet.
Deploy scanners, agents or cloud connectors to one business unit. Compare the assets found with the inventory, and record what could not be reached.
Set the ranking rules, including KEV status and exposure. Connect the ITSM tool, and agree remediation deadlines with asset owners.
Add business units in waves. When replacing a scanner, run both on the same assets for one cycle and export the old findings and exceptions first.
What should you ask vendors about Vulnerability Management Platforms?
Ask each vendor to answer in writing and to demonstrate on your own assets.
-
Must the console and scan data stay on your own infrastructure?Yes Shortlist products with an on-premises console, an appliance or a self-hosted edition, and test how vulnerability content reaches them.No Include cloud services, and check data region and federal authorization.
-
Does one endpoint agent already run on most of your devices?Yes Test that vendor’s vulnerability module against one independent scanner on the same devices.No Weight network scanning, passive monitoring and agent rollout effort.
-
Do you already run several scanners?Yes Test a ranking layer that imports their findings before replacing any of them.No Weight a platform that scans, ranks and routes findings under one contract.
RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.